Citrix XenApp

How to setup Citrix Director Shadowing with Remote Assistance using Group Policy



Citrix Director is considered the first console you should open when you want to see an overview of what’s going on in your Citrix environment. You can do quite a bit of drilling down now with the latest 7.6.100 update which you can get here:

Don’t forget to run the following after the install is complete:

C:\inetpub\wwwroot\Director\tools/DirectorConfig.exe /upgrade

with an elevated command prompt (necessary for Server 2012 R2 but not for Server 2008 R2 from my testing). If you get all green text and it says ” Director configuration completed!” you are good to go.

One of the best features of Director is the ability to “Shadow” a user and remote control their XenDesktop VM using Microsoft Remote Assistance. This has been a feature for Director for quite some time and is nothing new to 7.x but it still requires a little bit of setup to work in most environments. In the first screenshot above, I have an unmanaged virtual desktop running with a user currently connected. Make sure you are using Director with IE 11 for best compatibility. I click the blue Shadow button shown in the the picture since it’s not greyed out.

Next I get this message in the Remote Assistance Viewer console that pops up saying it is waiting for the user to connect:


and on the user’s virtual desktop, they will see this message to accept the offer for remote help:


Once they hit Yes it will let them know the “helper” can see the session:

In the meantime I can “Request control” to help the user or begin a chat session with them:


and the user will have to grant me control to help them:


Very easy right! But here’s what can sometimes happen, the Shadow button is greyed out or if you click on it you might get an error like:

Failed to initiate Remote Assistance: You have insufficient permissions (error code 102). Refer to documentation for Remote Assistance configuration. View server event logs for further information.

This means Shadowing is not configured properly for the user that is logged into Director. Usually because the Director user is not a local Administrator on the virtual desktop. I used to have this happen to me all the time in XenDesktop 5.6 environments and the fix is pretty easy using group policy. It’s the same old procedure for XenDesktop 7.6. Go to your XenDesktop group policy that applies to your VMs and drill down into:

Computer Configuration > Policies (this may be skipped depending on the group policy console you are using) > Administrative Templates > System > Remote Assistance > Offer Remote Assistance

You’ll want to enable:

Configure Offer Remote Assistance

and in the drop down select:

Allow helpers to remotely control the computer

so it will look like this:


A “helper” is a someone that is going to try and Shadow a user and offer remote assistance through Director. You will need to define who the “helpers” will be. So now go ahead and click the Show button:


and begin to add the same security groups that have access to Director (you delegate access to Director via Citrix Studio in Configuration > Administrators). It should like this with one domain\usergroup per line:


Save the group policy and go to one of your virtual desktops and do a gpupdate. Then go to Computer Management and double click on the “Offer Remote Assistance Helpers”:


You should see your groups you added in the group policy here:


Now if the Director user attempts to Shadow the virtual desktop user it will work just fine.

About Jason Samuel

Jason Samuel is a Solutions Architect and Security Practice Lead working at Alchemy Tech Group in Houston, TX with a primary focus on mobility, virtualization, and cloud technologies from Citrix, Microsoft, & VMware. He also has an extensive background in web architecture and information security. He is certified in several technologies and is 1 of 50 people globally that is a recipient of the prestigious Citrix Technology Professional (CTP) award. He is 1 of 35 people in the world that is a VMware EUC Champion. He is 1 of 28 people in the world that is an Atlantis Community Expert (ACE). He is a featured author on DABCC which provides the latest IT Community News on Cloud, Data Center, Desktop, Mobility, Security, Storage, & Virtualization. In his spare time Jason enjoys writing how-to articles and evangelizing the technologies he works with.

Recommended for you

1 Comment

  1. Max

    June 2, 2017 at 2:42 PM

    Hello my friend, is there any configuration to allow remote assistance to connect in a computer without user intervention, as it was in XA 6.5, i.e.?
    thank you

Leave a Reply

Your email address will not be published. Required fields are marked *