Dec 19, 2025, 07:03 PM
To see how to "Shadow" a user (watch their screen in real-time without kicking them off), please Like or Reply to this thread!
The "Shadowing" Alternative
If you have the proper Group Policy permissions, you can use the "Shadow" mode to monitor a user invisibly:
DOS
mstsc /shadow:2 /control /noConsentPrompt
- /shadow:2
: Target session ID.
- /control
: Allows mouse/keyboard interaction.
- /noConsentPrompt
: Prevents the victim from seeing a "Permission required" popup.
Administrators should configure Group Policy to automatically log off disconnected sessions after a short period (e.g., 5 minutes). This prevents dormant high-privilege sessions from being hijacked.
Detection of RDP session hijacking using tscon.exe
This video demonstrates how security teams monitor and detect the specific commands used in this hijacking technique.
[/hide]

![[Image: 1dvIfsk.gif]](https://i.imgur.com/1dvIfsk.gif)