1Y0-401 · Question #202
The IT Help Desk Administrator at CCH needs to shadow a user session for application troubleshooting purposes. Which two permissions need to be set in the environment? (Choose two.)
The correct answer is C. Microsoft Group Policy settings for Remote Assistance D. Perform Remote Assistance on a machine role permission. To enable an IT Help Desk Administrator to shadow a user session, both Microsoft Group Policy settings for Remote Assistance and the "Perform Remote Assistance on a machine" role permission must be configured.
Question
Options
- ARead-Only Administrator
- BMicrosoft Group Policy settings for RDS
- CMicrosoft Group Policy settings for Remote Assistance
- DPerform Remote Assistance on a machine role permission
How the community answered
(28 responses)- A7% (2)
- B21% (6)
- C71% (20)
Why each option
To enable an IT Help Desk Administrator to shadow a user session, both Microsoft Group Policy settings for Remote Assistance and the "Perform Remote Assistance on a machine" role permission must be configured.
A Read-Only Administrator role typically provides only viewing privileges and does not grant the interactive control or session shadowing capabilities required for troubleshooting via Remote Assistance.
While user sessions might run on RDS, the specific mechanism for "shadowing" as described, especially when paired with "Remote Assistance" options, relies on Remote Assistance Group Policy settings, not general RDS GPOs, which are for broader RDS host configuration.
Microsoft Group Policy settings for Remote Assistance must be configured to enable and define how Remote Assistance functions, including allowing unsolicited Remote Assistance and specifying the administrators who can offer help.
The "Perform Remote Assistance on a machine" role permission or similar user rights are necessary to grant the specific administrator the authority to initiate and control a Remote Assistance session on a target machine.
Concept tested: Configuring Windows Remote Assistance permissions via GPO
Source: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731818(v=ws.10)
Topics
Community Discussion
5
Kemal J.Apr 7, 2026C and D, and this is one of those questions where people overthink it and pick A because "Read-Only Admin" sounds like the safe observation role. The Perform Remote Assistance on a machine permission (D) is what actually grants the help desk admin the right to initiate a shadow session through Director, and without the Microsoft Group Policy settings for Remote Assistance (C) configured on the VDA side, Windows will block the underlying Remote Assistance handshake regardless of what Director thinks it can do. RDS Group Policy (B) is a red herring that trips people up because they conflate Remote Desktop Services config with Remote Assistance config, two different animals. Shadowing in this context rides on Windows Remote Assistance, not RDS session shadowing, so if your GPO is not explicitly enabling and configuring Remote Assistance on the target machines, you are getting nowhere, and no amount of rebooting the VDA fixes a missing policy.
Brenda K.Apr 18, 2026This one trips people up because B looks right the moment you see "RDS" and think remote sessions, but RDS Group Policy is about connection policies, not shadowing consent. You need C for the Microsoft Group Policy settings that actually govern Remote Assistance behavior, and D for the role permission that lets the admin initiate it on that machine, so lock in C and D and move on, this is a 30-second question.
Imani T.Apr 14, 2026C and D are right. Remote Assistance requires both the Group Policy settings to allow the feature on the network side and the Perform Remote Assistance role permission on the Citrix side, because neither alone gets you into an active user session for shadowing.
Viktor S.Apr 16, 2026Imani's got the pairing right, but worth flagging that the GP setting controlling solicited versus unsolicited assistance matters too, because unsolicited shadowing requires an additional policy that catches people off guard when it silently blocks the connection.
Viktor S.Apr 8, 2026The "two permissions" framing almost pulls you toward A because Read-Only sounds safe and passive, but shadowing a live session in a Citrix environment is not about your admin role level, it is about two specific gates: the Group Policy that enables Remote Assistance on the RDS side, and the role permission that actually lets the admin initiate the shadow. C and D are the right picks.