The IT Help Desk Administrator at CCH needs to shadow a user session for application troubleshooting purposes. Which two permissions need to be set in the environment? (Choose two.)

Wesley A.Feb 6, 2026

The correct answers are C and D. On my first attempt I picked A and B thinking "admin access plus group policy" was enough, and that burned me hard. What actually has to happen is that Remote Assistance itself needs to be enabled and configured through Microsoft Group Policy (option C), because without that GPO in place the feature is simply off at the OS level no matter what role you give anyone. Then on top of that, the Help Desk Administrator account needs the "Perform Remote Assistance on a machine" role permission inside the Citrix environment (option D), which is the gate that lets that specific role actually shadow a session rather than just having generic admin rights. Read-Only Administrator (A) is a Citrix role that gives visibility into the console but does not grant the ability to shadow, and the RDS Group Policy setting (B) is about Remote Desktop Services broadly, not the shadow/assistance feature specifically. Get both C and D together and you are good, miss either one and shadowing will fail even if everything else looks right.

Nina C.Jan 21, 2026

Honestly I kept second-guessing B because Group Policy for RDS sounds like it covers everything remote, but the key here is that shadowing a user session is specifically a Remote Assistance function, not a general RDS policy. You need the Microsoft Group Policy settings for Remote Assistance (C) to allow it at all, and the Perform Remote Assistance on a machine role permission (D) to actually grant the admin the right to do it, so the answer is C and D.

Ingrid P.Feb 23, 2026

C and D are correct, and this is a pairing worth drilling as one card because both must be present for shadowing to work. The GPO for Remote Assistance (C) enables the underlying Windows mechanism that allows one session to observe another, and without it the feature is simply unavailable at the OS level regardless of what Citrix permits. The "Perform Remote Assistance on a machine" role permission (D) is what Citrix Director checks before it lets the help desk admin initiate the shadow, so missing either one blocks the workflow at a different layer. Read-Only Administrator (A) is a common distractor because it sounds like a safe auditing role, but it grants no shadowing capability at all. The RDS GPO (B) is wrong because shadowing in this context routes through Remote Assistance policy, not Remote Desktop Services policy. I keep these two as a cloze card: "To shadow a session in a Citrix environment, configure [Remote Assistance GPO] and grant the [Perform Remote Assistance on a machine] role permission."

Giselle K.Feb 16, 2026

C and D, no question. When I sat this one I almost picked A out of reflex because "Read-Only Admin" sounds like it fits a passive monitoring role, but shadowing through Remote Assistance requires the GPO on the Windows side to permit the connection AND the Perform Remote Assistance machine role permission in Studio, and without both wired up together the session request just dies silently. Burned a few minutes second-guessing myself but the lab environment we had at work had broken shadowing once because someone forgot the GPO half, so that memory locked in C and D for me.