Shadowing a user fails with “Error 5 – Access denied” for a Citrix administrator when shadowing using the Management Console.
Configure both the Windows and Citrix policies.
Windows 2003 Group Policy Configuration
1. For the Organizational Unit containing the Citrix administrators, create a new or edit an existing Group Policy Object.
2. Navigate to User Configuration > Administrative Templates > Windows Components > Terminal Services and set the policy Sets rules for remote control of Terminal Services user sessions to the desired shadowing settings.
Citrix Policy Configuration
1. Create a new policy in the Management Console and set Assign Shadowing Permissions and Configure User Shadowing to enable the Citrix administrators to shadow:
Assign Shadowing Permissions: Add the Citrix administrators and apply the setting
Configure User Shadowing: Allow shadowing
2. Assign this newly created policy to the users or groups you want to shadow.
There may also be a permission problem caused by the presence of the debug utility Process Dump, or Userdump.exe, on the server.