[THIN] Completely stupid shadowing question

Ok it's been a while since I've setup shadowing but this is a PS4.0 farm.
The citrix policies are setup to allow help desk to shadow any explicit
user.  The policy is at the top of the priority list for policies.  Do I
need to give them shadow permission in the ICA-TCP properties as well?  I
simply can't remember.....

Other related posts: