Will RoyalTS 7 support RDP session shadowing?

Questions Royal TS (for Windows)
1

Hello,

We are looking to move our tech support team to Royal TS but during a PoC test of v6, one of the deal-breakers was that the RDP plugin does not support session shadowing with a result similar to this cmd prompt:

mstsc /shadow:1 /v:192.168.0.1 /noConsentPrompt /control

We noticed that the changelog mentions that v7 will switch to a different RDP Plugin, FreeRDP, which should support shadowing, according to their maintainer:
https://github.com/FreeRDP/FreeRDP/discussions/6747

Does this mean, RDP shadowing will finally work with v7? A search in this forum has shown that this has been requested as a feature for over 4 years by many users.
mRemoteNG supports this (at least with its view only mode), so this should be doable for Royal TS as well.

It would really make Royal TS eminently more usable for tech support, also obviating the need for insecure tools like VNC, to help a user within their own desktop session and not throwing them out when a support agent connects to a user’s PC via normal RDP session from Royal TS (which will currently take them back to the login screen; when the user then logs back in, the support agent in turn gets thrown out of the session again, and so forth…).

Fingers crossed!

Thanks and keep up the great work.

2

Hi Johnnie,

in Royal TS V6 you can actually execute mstsc /shadow directly from the dashboard:

2330×814 47.4 KB

Is this not working for you?

Regards,
Stefan

3

Hi Stefan,

Thanks for your reply.

Yes, the Dashboard option works - albeit somewhat clumsily - via the dashboard, because it requires several extra clicks.

What we were hoping for is basically a checkbox in the configuration screen (Properties) of an RDP Connection in RoyalTS that says something like “Connect to session [1/2/3/console] and shadow session”, with the additional options “no consent prompt” and “control”.

These options should also be available when you right-click on a connection in the Navigation pane and select “Connect with Options”, indeed in the same way as they are currently available from the dashboard.

The whole idea is to be able to simply double-click an RDP connection in the Navigation pane (e.g. in a folder named “Tech Support - Shadow Connections”), and instantly be connected to the existing user’s session on that PC and be able to help him by seeing his screen(s) without him being thrown back to the Windows login screen.

On the face of it, it does not seem too difficult to implement, especially since, as you mention, the code is already there to use with Terminal Servers from the Dashboard. Seems more a case of adding the checkboxes and menu entries to the UI, and copying the entries from the context menu of the dashboard to the “Connect with Options” menu…

Of course, a separate but probably bigger challenge is probably to have this RDP session run embedded in RoyalTS instead of loading the external mstsc.exe

Here is where we were hoping that this could finally work with FreeRDP in v7.

But of course, it would already be a big help if the shadowing options were available to set in the connection properties, so they would automatically execute on double-click or via the “Connect with Options” menu.

As this is really the only way to provide support to Windows users on physical PCs without resorting to third-party software such as VNC etc., having this functionality is pivotal to use RoyalTS in a tech support context as a replacement for other solutions that have this feature already.

Thanks for your great work.

4

Further to my last message, I wanted to add that we hit another snag:

Shadowing, even if started via Dashboard, will by default apparently use the username and password of the user with which you, the operator, is logged into the Windows machine on which RoyalTS is running (!).

That account may or may not have the permission to start / shadow an RDP session on the target machine (in practice, most often, it will probably not).
In this case, the connection attempt will simply fail with a short error message saying “Permission denied”.

Hence we need to provide a username and password with shadow permissions before starting the connection.

Of course, as mstsc.exe does not allow the direct passing of credentials, the only option I know of is to save them with cmdkey first, as in this sample quick & dirty powershell script that I have written:

$RemoteComputer = "192.168.0.1"

$cmdkeyArgs = "/generic:TERMSRV/$RemoteComputer /user:DOMAIN\Johnnie /pass:MySecretPw"
Start-Process -FilePath "cmdkey.exe" -ArgumentList $cmdkeyArgs -NoNewWindow -Wait

# Create a new RDP session
$RDPArgs = "/v:$RemoteComputer /shadow:1"
Start-Process -FilePath "mstsc.exe" -ArgumentList $RDPArgs

There is only one small problem: It does not work.
As soon as you pass the parameter /shadow to mstsc.exe, it will ignore the credentials previously saved with cmdkey!
If you try without “/shadow:1”, the above script works perfectly (only then of course you take over the session and don’t shadow it).

So it seems that by using the default mstsc.exe, it is impossible to pass a username and password programmatically if you want to shadow a session. Maybe this is a bug (or an undocumented but intended feature) of mstsc.exe

So again, our only hope would be that FreeRDP in RoyalTS v7 will support this functionality natively and we will not have to use mstsc.exe anymore.

Hope you can make it happen…

5

Hi Johnnie,

let me quickly go through your list and make some comments:

  • Adding a shadow checkbox in the connection properties
  • Connect with Options
  • Embedding the shadow session
  • Passing on Credentials

There are a couple of issues with that:

  1. We actually don’t know upfront which sessions are available. The dashboard is gathering this information in real time.
  2. Gathering the information is using a different technique/API and is not using RDP itself. This means that even though RDP might work (because of 3389 or whatever port is configured is open) it doesn’t necessarily mean that getting the session information using the terminal services API is working (because of blocking RDC calls, etc.)
  3. As you already mentioned, the session cannot be embedded. Session shadowing is a weird beast and it feels like a student’s implementation during a summer job at MS with lots of shortcuts.
  4. mstsc.exe /shadow ignoring credentials is not something we can fix on our end.

I suggest you take a look into Command Tasks. It allows you to implement your shadow feature in two ways:

  • Configure a ready to use task which only needs a double-click in the navigation panel to start the shadow session.
  • Use the $URI$ replacement token to make the task context aware. This way you can right-click on an RDP connection and start the shadow session for this server/session - pretty much like you would with the connect with options menu. The main issue, that you don’t really know which sessions are available still remains in this case though.

Also note, that in V7 we plan to only implement FreeRDP itself. A tighter integration with freerdp-shadow is not planned. You can, of course, use the command task as mentioned above with freerdp-shadow.

Regards,
Stefan