Cant Shadow on XP - CSHADOW access denied error 5

[lostexchange]

We have a helpdesk team that cannot shadow. The 3rd Line support staff with Domain Admin rights can shadow. We have Citrix Xpe, Fr2 on Win2k sp3. We have 6 servers in the farm. Shadowing is enabled. The helpdesk team are Citrix Administrators. From the pcs the helpdesk are using the 1st liners cannot shadow but the 3rd liners can (from same pc)
We have upped the permission on the ICA connection in Citrix Connection Configuration tool to Full permission for the helpdesk group but the didnt help. We did the same in Terminal Services Configuration - still didnt help. We gave them full permission on cshadow.exe - didnt help. We have verified FR2 is set on the citrix server. We have check the screen resolution on the pc. The only thing that did help was giving the 1st liners Domain Admin rights. But this as you all will understand is not a good idea and definitly not an acceptable fix.
I wonder if anyone has had the same problem and found a fix.
Please help! Thanks

 

[lostexchange]

Hey I found a fix! What you need to do is open up Citrix Connection Configuration tool in Citrix. Select ICA connection. From the Security menu, select Permissions. Add the group and either give them full control or select Advanced tab, select the group, click View/Edit, and make sure Shadow is Allowed.
I also got a email back from Citrix saying I should check out my policies in the CMC but we didnt have any set. Hope this helps anyone who has the same problem.

 

[yoz2002]

We had to grant the user group the right to "Act as part of the operating system" on each server and that seemed to do the trick.

 

[Frodo29]

Hey yoz2002,
can you explain me, where to grant this right on the server?
I additionally found out that if i delete all policies in the CMC shadowing is working again. So it must be something with the policies.

 

[lostexchange]

Yeah it is a policy. Local Security Settings\Security Settings\Local Policies\User Rights Assigned\ you will find it in there 2nd from the top.
Good luck!

 

[Frodo29]

I have still this stupid error.
I tried all your tips but nothing of them helps me, only giving the user domain admin rights which is really not the solution.

Please help if you have another tips for me.
thanks.

 

[Traver]

If you are using terminal service to acess the server, and from there shadowing, that can be a trouble.
Try access the server using VNC. Then you are working on the console, and then you got the rights to shadow (if you are an administrator)

 

[Frodo29]

I can't and won't give admin rights to a power user.
What i also have done is giving him local admin right with no success.
I't seems like the poweruser needs domain admin rights for that task.
thanks for any other tips!?!

 

[ascotta]

Dopey question I know but when all else fails back to basics. do the 1st liners have and ICA client. Must have or shadowing won't work.