3,503 settings · 23H2 · 1.0 · 15 Jul 2024

9 settingsCSV

Windows Components › Remote Desktop Services › Remote Desktop Session Host › Connections

Set rules for remote control of Remote Desktop Services user sessions

UserNative Intune settingTS_RemoteControl_1

Supported on Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, Windows 7, Windows Vista, and Windows XP

23H2 · 1.0

What it does

If you enable this policy setting, administrators can interact with a user's Remote Desktop Services session based on the option selected. Select the desired level of control and permission from the options list: 1. No remote control allowed: Disallows an administrator to use remote control or view a remote user session. 2. Full Control with user's permission: Allows the administrator to interact with the session, with the user's consent. 3. Full Control without user's permission: Allows the administrator to interact with the session, without the user's consent. 4. View Session with user's permission: Allows the administrator to watch the session of a remote user with the user's consent. 5. View Session without user's permission: Allows the administrator to watch the session of a remote user without the user's consent. If you disable this policy setting, administrators can interact with a user's Remote Desktop Services session, with the user's consent.

What it writes

Hive: HKEY_CURRENT_USER
Registry key: SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services

In Intune

Native Intune setting: Yes — Policy CSP

./User/Vendor/MSFT/Policy/Config/ADMX_TerminalServer/TS_RemoteControl_1ADMX_TerminalServer on Microsoft LearnADMX-backed: Windows ships this template, so it is set with the template's own values, without an import.Windows builds listed: 10.0.22000, 10.0.19043.1202, 10.0.19042.1202, 10.0.19041.1202.

From Microsoft's Policy CSP DDF files (DDF v2 Files, February 2026), read 18 Oct 2026.

Options

Option	Type	Registry value	Allowed values
OptionsDefault: No remote control allowed	Drop-down list	`Shadow`	No remote control allowed`0` Full Control with user's permission`1` Full Control without user's permission`2` View Session with user's permission`3` View Session without user's permission`4`

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

Enabled · User · template defaults

Registry file (.reg)

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services]
"Shadow"=dword:00000000

PowerShell

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Set rules for remote control of Remote Desktop Services user sessions
# Name: TS_RemoteControl_1
# Scope: User
# State: Enabled
# Source: TerminalServer.admx

Set-RegistryValue -Path 'Registry::HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -Name 'Shadow' -PropertyType 'DWord' -Value 0

These deployment candidates come from the ADMX template; they are separate from the native CSP mapping above.

The OMA-URI is an inferred ADMX-backed Policy CSP candidate derived from the source ADMX file name and policy name.
Some Microsoft policies use built-in Policy CSP pages whose area names don't match the ADMX file name, so verify the candidate against Microsoft Learn before deployment.

ADMX profile candidate (OMA-URI)

./User/Vendor/MSFT/Policy/Config/ADMX_TerminalServer/TS_RemoteControl_1

ADMX SyncML candidate

<SyncML xmlns="SYNCML:SYNCML1.2">
  <SyncBody>
    <Replace>
      <CmdID>1</CmdID>
      <Item>
        <Meta>
          <Format>chr</Format>
          <Type>text/plain</Type>
        </Meta>
        <Target>
          <LocURI>./User/Vendor/MSFT/Policy/Config/ADMX_TerminalServer/TS_RemoteControl_1</LocURI>
        </Target>
        <Data>&lt;enabled/&gt;
&lt;data id="TS_RemoteControl_Levels" value="0"/&gt;</Data>
      </Item>
    </Replace>
    <Final/>
  </SyncBody>
</SyncML>

Intune remediation scripts

Detection

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' { return [uint64]$actual -eq [uint64]$Expected }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Set rules for remote control of Remote Desktop Services user sessions
# Name: TS_RemoteControl_1
# Scope: User
# State: Enabled
# Source: TerminalServer.admx

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -Name 'Shadow' -Kind 'DWord' -Expected 0
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Shadow') | Out-Null
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

Remediation

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Set rules for remote control of Remote Desktop Services user sessions
# Name: TS_RemoteControl_1
# Scope: User
# State: Enabled
# Source: TerminalServer.admx

Set-RegistryValue -Path 'Registry::HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -Name 'Shadow' -PropertyType 'DWord' -Value 0

History 3 retained releases

22H2 · 1.015 Jul 2024
- Already present in the first release ChangeIntel keeps.

2 later releases left it unchanged.

Template

Internal name: TS_RemoteControl_1
Namespace: Microsoft.Policies.TerminalServer
Template file: TerminalServer.admx
Release: Windows 11 23H2 · 1.0 · file set d784d0ea5f14a680…

Definition, editor controls and support

Definition

<policy class="User" displayName="$(string.TS_RemoteControl)" explainText="$(string.TS_RemoteControl_EXPLAIN)" key="SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" name="TS_RemoteControl_1" presentation="$(presentation.TS_RemoteControl_1)" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.TerminalServer:TS_CONNECTIONS" />
      <supportedOn ref="Microsoft.Policies.TerminalServer:TS_SUPPORTED_ONLY_LEGACY" />
      <elements>
        <enum id="TS_RemoteControl_Levels" valueName="Shadow">
          <item displayName="$(string.TS_RemoteControl_0)">
            <value>
              <decimal value="0" />
            </value>
          </item>
          <item displayName="$(string.TS_RemoteControl_1)">
            <value>
              <decimal value="1" />
            </value>
          </item>
          <item displayName="$(string.TS_RemoteControl_2)">
            <value>
              <decimal value="2" />
            </value>
          </item>
          <item displayName="$(string.TS_RemoteControl_3)">
            <value>
              <decimal value="3" />
            </value>
          </item>
          <item displayName="$(string.TS_RemoteControl_4)">
            <value>
              <decimal value="4" />
            </value>
          </item>
        </enum>
      </elements>
    </policy>

Editor controls

<presentation id="TS_RemoteControl_1" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <dropdownList defaultItem="0" noSort="true" refId="TS_RemoteControl_Levels">Options:</dropdownList>
      </presentation>

Supported platforms and category

Microsoft.Policies.TerminalServer:category:TS_CONNECTIONS
<category displayName="$(string.TS_CONNECTIONS)" explainText="$(string.TS_CONNECTIONS_Help)" name="TS_CONNECTIONS" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.TerminalServer:TS_TERMINAL_SERVER" />
    </category>
Microsoft.Policies.TerminalServer:category:TS_GP_NODE
<category displayName="$(string.TS_GP_NODE)" explainText="$(string.TS_User_Help)" name="TS_GP_NODE" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:WindowsComponents" />
    </category>
Microsoft.Policies.TerminalServer:category:TS_TERMINAL_SERVER
<category displayName="$(string.TS_TERMINAL_SERVER)" explainText="$(string.TS_TERMINAL_SERVER_Help)" name="TS_TERMINAL_SERVER" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.TerminalServer:TS_GP_NODE" />
    </category>
Microsoft.Policies.TerminalServer:definition:TS_SUPPORTED_ONLY_LEGACY
<definition displayName="$(string.TS_SUPPORTED_ONLY_LEGACY)" name="TS_SUPPORTED_ONLY_LEGACY" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
           <reference ref="Microsoft.Policies.Products:WindowsServer2008_R2" /> 
           <reference ref="Microsoft.Policies.Products:WindowsServer2008_RTM" />
           <reference ref="Microsoft.Policies.Products:MicrosoftWindowsServer2003" /> 
           <reference ref="Microsoft.Policies.Products:MicrosoftWindows7" />          
           <reference ref="Microsoft.Policies.Products:MicrosoftWindowsVista_RTM" />
          <reference ref="Microsoft.Policies.Products:MicrosoftWindowsXP" />
        </or>
      </definition>
Microsoft.Policies.TerminalServer:unresolved:Microsoft.Policies.Products:MicrosoftWindows7
<unresolved reference="Microsoft.Policies.Products:MicrosoftWindows7" />
Microsoft.Policies.TerminalServer:unresolved:Microsoft.Policies.Products:MicrosoftWindowsServer2003
<unresolved reference="Microsoft.Policies.Products:MicrosoftWindowsServer2003" />
Microsoft.Policies.TerminalServer:unresolved:Microsoft.Policies.Products:MicrosoftWindowsVista_RTM
<unresolved reference="Microsoft.Policies.Products:MicrosoftWindowsVista_RTM" />
Microsoft.Policies.TerminalServer:unresolved:Microsoft.Policies.Products:MicrosoftWindowsXP
<unresolved reference="Microsoft.Policies.Products:MicrosoftWindowsXP" />
Microsoft.Policies.TerminalServer:unresolved:Microsoft.Policies.Products:WindowsServer2008_R2
<unresolved reference="Microsoft.Policies.Products:WindowsServer2008_R2" />
Microsoft.Policies.TerminalServer:unresolved:Microsoft.Policies.Products:WindowsServer2008_RTM
<unresolved reference="Microsoft.Policies.Products:WindowsServer2008_RTM" />
Microsoft.Policies.Windows:category:WindowsComponents
<category displayName="$(string.WindowsComponents)" explainText="$(string.WindowsComponents_Help)" name="WindowsComponents" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.TerminalServer:category:TS_CONNECTIONS
<category displayName="$(string.TS_CONNECTIONS)" explainText="$(string.TS_CONNECTIONS_Help)" name="TS_CONNECTIONS" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.TerminalServer:TS_TERMINAL_SERVER" />
    </category>
<strings><string id="Microsoft.Policies.TerminalServer:TS_CONNECTIONS">Connections</string><string id="Microsoft.Policies.TerminalServer:TS_CONNECTIONS_Help">Controls connection settings on a Remote Desktop Session Host server</string></strings>
Microsoft.Policies.TerminalServer:category:TS_GP_NODE
<category displayName="$(string.TS_GP_NODE)" explainText="$(string.TS_User_Help)" name="TS_GP_NODE" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:WindowsComponents" />
    </category>
<strings><string id="Microsoft.Policies.TerminalServer:TS_GP_NODE">Remote Desktop Services</string><string id="Microsoft.Policies.TerminalServer:TS_User_Help">Controls configuration of Remote Desktop Services technologies that enable access to a server running Windows-based programs or the full Windows desktop</string></strings>
Microsoft.Policies.TerminalServer:category:TS_TERMINAL_SERVER
<category displayName="$(string.TS_TERMINAL_SERVER)" explainText="$(string.TS_TERMINAL_SERVER_Help)" name="TS_TERMINAL_SERVER" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.TerminalServer:TS_GP_NODE" />
    </category>
<strings><string id="Microsoft.Policies.TerminalServer:TS_TERMINAL_SERVER">Remote Desktop Session Host</string><string id="Microsoft.Policies.TerminalServer:TS_TERMINAL_SERVER_Help">Controls configuration of a Remote Desktop Session Host server</string></strings>
Microsoft.Policies.TerminalServer:definition:TS_SUPPORTED_ONLY_LEGACY
<definition displayName="$(string.TS_SUPPORTED_ONLY_LEGACY)" name="TS_SUPPORTED_ONLY_LEGACY" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
           <reference ref="Microsoft.Policies.Products:WindowsServer2008_R2" /> 
           <reference ref="Microsoft.Policies.Products:WindowsServer2008_RTM" />
           <reference ref="Microsoft.Policies.Products:MicrosoftWindowsServer2003" /> 
           <reference ref="Microsoft.Policies.Products:MicrosoftWindows7" />          
           <reference ref="Microsoft.Policies.Products:MicrosoftWindowsVista_RTM" />
          <reference ref="Microsoft.Policies.Products:MicrosoftWindowsXP" />
        </or>
      </definition>
<strings><string id="Microsoft.Policies.TerminalServer:TS_SUPPORTED_ONLY_LEGACY">Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, Windows 7, Windows Vista, and Windows XP</string></strings>
Microsoft.Policies.Windows:category:WindowsComponents
<category displayName="$(string.WindowsComponents)" explainText="$(string.WindowsComponents_Help)" name="WindowsComponents" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Windows:WindowsComponents">Windows Components</string><string id="Microsoft.Policies.Windows:WindowsComponents_Help">Contains settings for operating system components.</string></strings>