Configuring Windows 7 virtual desktops for shadowing with Citrix XenDesktop 5.5 / 5.6 Desktop Director

One of the features I like most about Citrix’s XenDesktop 5.5 / 5.6 virtual desktop solution as compared to VMware View is that Citrix provides a virtual desktop management application named Desktop Director.  This tool allows virtual desktop administrators to easily monitor the XenDesktop environment at a high level as well as drill down to the single virtual desktop level to provide user shadowing sessions.  Although the shadowing feature really just leverages Windows Remote Assistance, the integration into the Desktop Director console provides ease of use and central administration.  With that being said, the feature doesn’t just work as several configuration steps need to be taken.  I’ve written a blog post earlier in the year:

Configuring WinRM for Windows XP SP3 for Citrix XenDesktop 5.5 / 5.6 Desktop Director
http://terenceluk.blogspot.com/2012/05/configuring-winrm-for-windows-xp-sp3.html

… to demonstrate how to set this up for Windows XP desktops and while it’s not quite as difficult for Windows 7 desktops, I figure I’ll write a post anyways so I have something to refer to in the future.

First off, failure to configure the required settings will result in the following error when you initiate a shadowing session for a virtual desktop:

Failed to initiate Remote Assistance: You have insufficient permissions (error code 102). Refer to documentation for Remote Assistance configuration. View server event logs for further information.

The reason why this error is thrown is because the appropriate permissions has not been granted to the administrator who is soliciting the remote assistance / shadow session.  You can quickly check by launching the Computer Management console of the Windows 7 desktop, navigating to Local Users and Groups –> Groups and checking to see if the group Offer Remote Assistance Helpers exists:

WinRM

Unlike Windows XP, WinRM is installed by default on a Windows 7 desktop so there is no need to install it.

Enabling Offer Remote Assistance Helpers Group

Begin by creating a new GPO and assign it to the OU with the virtual desktop Active Directory computer objects.  Edit the group policy and navigate to Computer Configuration –> Policies –> Administrative Templates –> System –> Remote Assistance:

Open up the setting Solicited Remote Assistance, enable the feature and set the following configuration as such:

Permit remote control of this computer: Allow helpers to remotely control the computer

Maximum ticket time (value): 1

Maximum ticket time (units): Hours

Method for sending e-mail invitations: Simple MAPI

Apply the settings, open up the setting Offer Remote Assistance, enable the feature and configure the settings as such:

Permit remote control of this computer: Allow helpers to remotely control the computer

Helpers: domain\domain admins

**Note: that you can set the helpers to any group you choose.

Apply the settings and you should see the following:

Once the GPO has been applied to the desktops, you should now see the group Offer Remote Assistance Helpers listed:

Once you’ve verified that the GPO has been applied, proceed by attempting to shadow a user’s desktop and remote assistance should launch:

Hope this helps anyone who might be looking for instructions to set up Windows 7 desktops for shadowing sessions.