I have a MF 3.0 Server with all of the latest hot fixes installed. It is running on 2003 standard server. The problem I am having is that I have several non-administrative users that need shadowing rights and I'm not sure what I'm missing as I've set this up time after time on other server farms without a problem. I have a Citrix policy that is applied to the group of users to be shadowed. It is configured as Configuration enabled, Allow Shadowing, Prohibit Shadowing without notification and the permissions are set as enabled and the group of users that need to do the shadowing is added below. If I do a resultant set of policy in group policy it is configured as follows: Computer / Administrative / Windows Components / Terminal Services * Allow users to connect remotely - enabled * Automatic reconnection - enabled * Keep-alive connections - enabled - interval 1 * Restrict to single session - disabled * Sets rules - enabled - Full control with user's permission Computer / Administrative / Windows Components / Terminal Services/Sessions * Allow reconnection from original client only - disabled So I thought that perhaps it was security settings or something on the individual servers... so I took the group that contains all of the users that should have the full rights to shadow as defined in the Citrix policy as well and configured them manually on each of the terminal server's ICA connections to be "Special" which is the combination of full, user access and guest access along with logoff I believe it was (basically everything under the advanced options.) The users are able to logon now and go into MF Admin, right click on a user and the only options that they get are: Disconnect Send Message Reset Status Logoff And if they happen to be running MF Admin from the same server as the user they are allowed the connect option. (See problem #2 below.) I'm not sure what I'm missing... ideally this select group of people need to be able to shadow a set group of users no matter what server they are on, be able to connect to their disconnects, etc as well. I'm just out of permission places to look that I can think of. PS... as a regular administrator (outside of the group above) I am able to shadow any user on any server. Problem #2... As the domain admin and any of my admin accounts for that matter... I am only able to connect to connections that are on the same TS as MF Admin is running from and then MF Admin will not allow me to do anything to a disconnected session other than reset it or log it off. I would like to be able to connect to them. This is a new server farm so this is all probably based on something that I missed somewhere in the config. Problem #3... perhaps related... I have some users who will be disconnected from a session and the server shows the session as disconnected, but when they attempt to reconnect they are told they already have an instance of the application running and it won't reconnect the session. Sessions are set to allow reconnect from any device, so again no clue as to why its not working. Thanks in advance for any help or direction that anyone can provide. John Hardwick President nXio, LLC. 913-754-8120 x125 www.nxio.net