12

According to shadow:

C:\Users\mark.henderson>shadow /?
Monitor another Remote Desktop Services session.

SHADOW {sessionname | sessionid} [/SERVER:servername] [/V]

  sessionname         Identifies the session with name sessionname.
  sessionid           Identifies the session with ID sessionid.
  /SERVER:servername  The server containing the session (default is current).
  /V                  Display information about actions being performed.

/V is meant to Display information about actions being performed. But for the life of me, I cannot get this flag to do anything. Technet is no more helpful than the above text; and neither is google.

Performing, say shadow 3 /server:myts1.example.com /V just shadows the account normally.

Mark Henderson
  • 68,316
  • 31
  • 175
  • 255
  • 3
    So far as I can tell it doesn't do anything. – Zoredache Aug 16 '12 at 01:44
  • Have you tried piping the command to a `.txt` file? I did and ended up with an empty .txt file, so I'm leaning towards "nothing," but that's maybe something worth trying out (I don't trust my environment to behave normally, so someone should verify that behavior). – HopelessN00b Aug 17 '12 at 13:15
  • Although it says "display..." I'd check the event logs and see if anything extra is being put in there. – John Gardeniers Aug 18 '12 at 23:03

1 Answers1

4

The description seems a bit off.

The correct command is:

shadow /V [n]

Where [n] is actually a session number.

shadow /V 1

The above would remotely connect you to a session 1. The session number can be found under the User tabs from Task Manager.

A prompt would appear on the session and request the user to either accept or decline the remote control.

Remote control request

Cold T
  • 2,391
  • 2
  • 16
  • 28
  • I'm so sorry for not following up on this earlier! I didn't see your answer come past for some reason. This explains a lot, thanks! – Mark Henderson Sep 14 '12 at 05:41