diff --git a/WebsitePanel/Database/update_db.sql b/WebsitePanel/Database/update_db.sql
index 8829cb8d..228701b7 100644
--- a/WebsitePanel/Database/update_db.sql
+++ b/WebsitePanel/Database/update_db.sql
@@ -9459,4 +9459,6 @@ BEGIN
 		(SELECT TOP 1 @item_type_id, @group_id, 'SharePointSiteCollection', TypeName, 100, CalculateDiskSpace, CalculateBandwidth, Suspendable, Disposable, Searchable, Importable, Backupable FROM [dbo].[ServiceItemTypes] WHERE DisplayName = 'SharePointFoundationSiteCollection')
 END
 
-GO
\ No newline at end of file
+GO
+
+UPDATE [dbo].[Quotas] SET GroupID = 45 WHERE QuotaName = 'EnterpriseStorage.DriveMaps'
\ No newline at end of file
diff --git a/WebsitePanel/Sources/WebsitePanel.EnterpriseServer.Client/RemoteDesktopServicesProxy.cs b/WebsitePanel/Sources/WebsitePanel.EnterpriseServer.Client/RemoteDesktopServicesProxy.cs
index d5b90304..f15a1b1c 100644
--- a/WebsitePanel/Sources/WebsitePanel.EnterpriseServer.Client/RemoteDesktopServicesProxy.cs
+++ b/WebsitePanel/Sources/WebsitePanel.EnterpriseServer.Client/RemoteDesktopServicesProxy.cs
@@ -20,8 +20,8 @@ namespace WebsitePanel.EnterpriseServer {
     using System.Diagnostics;
     using WebsitePanel.Providers.RemoteDesktopServices;
     using WebsitePanel.Providers.Common;
-    using WebsitePanel.Providers.HostedSolution;
     using WebsitePanel.EnterpriseServer.Base.RDS;
+    using WebsitePanel.Providers.HostedSolution;
     
     
     /// <remarks/>
@@ -137,6 +137,8 @@ namespace WebsitePanel.EnterpriseServer {
         
         private System.Threading.SendOrPostCallback UpdateRdsServerSettingsOperationCompleted;
         
+        private System.Threading.SendOrPostCallback ShadowSessionOperationCompleted;
+        
         /// <remarks/>
         public esRemoteDesktopServices() {
             this.Url = "http://localhost:9002/esRemoteDesktopServices.asmx";
@@ -301,6 +303,9 @@ namespace WebsitePanel.EnterpriseServer {
         /// <remarks/>
         public event UpdateRdsServerSettingsCompletedEventHandler UpdateRdsServerSettingsCompleted;
         
+        /// <remarks/>
+        public event ShadowSessionCompletedEventHandler ShadowSessionCompleted;
+        
         /// <remarks/>
         [System.Web.Services.Protocols.SoapDocumentMethodAttribute("http://smbsaas/websitepanel/enterpriseserver/GetRdsCollection", RequestNamespace="http://smbsaas/websitepanel/enterpriseserver", ResponseNamespace="http://smbsaas/websitepanel/enterpriseserver", Use=System.Web.Services.Description.SoapBindingUse.Literal, ParameterStyle=System.Web.Services.Protocols.SoapParameterStyle.Wrapped)]
         public RdsCollection GetRdsCollection(int collectionId) {
@@ -2671,6 +2676,53 @@ namespace WebsitePanel.EnterpriseServer {
             }
         }
         
+        /// <remarks/>
+        [System.Web.Services.Protocols.SoapDocumentMethodAttribute("http://smbsaas/websitepanel/enterpriseserver/ShadowSession", RequestNamespace="http://smbsaas/websitepanel/enterpriseserver", ResponseNamespace="http://smbsaas/websitepanel/enterpriseserver", Use=System.Web.Services.Description.SoapBindingUse.Literal, ParameterStyle=System.Web.Services.Protocols.SoapParameterStyle.Wrapped)]
+        public ResultObject ShadowSession(int itemId, string sessionId, bool control) {
+            object[] results = this.Invoke("ShadowSession", new object[] {
+                        itemId,
+                        sessionId,
+                        control});
+            return ((ResultObject)(results[0]));
+        }
+        
+        /// <remarks/>
+        public System.IAsyncResult BeginShadowSession(int itemId, string sessionId, bool control, System.AsyncCallback callback, object asyncState) {
+            return this.BeginInvoke("ShadowSession", new object[] {
+                        itemId,
+                        sessionId,
+                        control}, callback, asyncState);
+        }
+        
+        /// <remarks/>
+        public ResultObject EndShadowSession(System.IAsyncResult asyncResult) {
+            object[] results = this.EndInvoke(asyncResult);
+            return ((ResultObject)(results[0]));
+        }
+        
+        /// <remarks/>
+        public void ShadowSessionAsync(int itemId, string sessionId, bool control) {
+            this.ShadowSessionAsync(itemId, sessionId, control, null);
+        }
+        
+        /// <remarks/>
+        public void ShadowSessionAsync(int itemId, string sessionId, bool control, object userState) {
+            if ((this.ShadowSessionOperationCompleted == null)) {
+                this.ShadowSessionOperationCompleted = new System.Threading.SendOrPostCallback(this.OnShadowSessionOperationCompleted);
+            }
+            this.InvokeAsync("ShadowSession", new object[] {
+                        itemId,
+                        sessionId,
+                        control}, this.ShadowSessionOperationCompleted, userState);
+        }
+        
+        private void OnShadowSessionOperationCompleted(object arg) {
+            if ((this.ShadowSessionCompleted != null)) {
+                System.Web.Services.Protocols.InvokeCompletedEventArgs invokeArgs = ((System.Web.Services.Protocols.InvokeCompletedEventArgs)(arg));
+                this.ShadowSessionCompleted(this, new ShadowSessionCompletedEventArgs(invokeArgs.Results, invokeArgs.Error, invokeArgs.Cancelled, invokeArgs.UserState));
+            }
+        }
+        
         /// <remarks/>
         public new void CancelAsync(object userState) {
             base.CancelAsync(userState);
@@ -4054,4 +4106,30 @@ namespace WebsitePanel.EnterpriseServer {
             }
         }
     }
+    
+    /// <remarks/>
+    [System.CodeDom.Compiler.GeneratedCodeAttribute("wsdl", "2.0.50727.3038")]
+    public delegate void ShadowSessionCompletedEventHandler(object sender, ShadowSessionCompletedEventArgs e);
+    
+    /// <remarks/>
+    [System.CodeDom.Compiler.GeneratedCodeAttribute("wsdl", "2.0.50727.3038")]
+    [System.Diagnostics.DebuggerStepThroughAttribute()]
+    [System.ComponentModel.DesignerCategoryAttribute("code")]
+    public partial class ShadowSessionCompletedEventArgs : System.ComponentModel.AsyncCompletedEventArgs {
+        
+        private object[] results;
+        
+        internal ShadowSessionCompletedEventArgs(object[] results, System.Exception exception, bool cancelled, object userState) : 
+                base(exception, cancelled, userState) {
+            this.results = results;
+        }
+        
+        /// <remarks/>
+        public ResultObject Result {
+            get {
+                this.RaiseExceptionIfNecessary();
+                return ((ResultObject)(this.results[0]));
+            }
+        }
+    }
 }
diff --git a/WebsitePanel/Sources/WebsitePanel.EnterpriseServer.Code/RemoteDesktopServices/RemoteDesktopServicesController.cs b/WebsitePanel/Sources/WebsitePanel.EnterpriseServer.Code/RemoteDesktopServices/RemoteDesktopServicesController.cs
index 7d585e28..9595fbab 100644
--- a/WebsitePanel/Sources/WebsitePanel.EnterpriseServer.Code/RemoteDesktopServices/RemoteDesktopServicesController.cs
+++ b/WebsitePanel/Sources/WebsitePanel.EnterpriseServer.Code/RemoteDesktopServices/RemoteDesktopServicesController.cs
@@ -331,6 +331,49 @@ namespace WebsitePanel.EnterpriseServer
             return UpdateRdsServerSettingsInternal(serverId, settingsName, settings);
         }
 
+        public static ResultObject ShadowSession(int itemId, string sessionId, bool control)
+        {
+            return ShadowSessionInternal(itemId, sessionId, control);
+        }
+
+        private static ResultObject ShadowSessionInternal(int itemId, string sessionId, bool control)
+        {
+            var result = TaskManager.StartResultTask<ResultObject>("REMOTE_DESKTOP_SERVICES", "SHADOW_RDS_SESSION");
+
+            try
+            {
+                Organization org = OrganizationController.GetOrganization(itemId);
+
+                if (org == null)
+                {
+                    result.IsSuccess = false;
+                    result.AddError("SHADOW_RDS_SESSION", new NullReferenceException("Organization not found"));
+
+                    return result;
+                }
+
+                var rds = GetRemoteDesktopServices(GetRemoteDesktopServiceID(org.PackageId));
+                rds.ShadowSession(sessionId, control);
+            }
+            catch (Exception ex)
+            {
+                result.AddError("REMOTE_DESKTOP_SERVICES_SHADOW_RDS_SESSION", ex);
+            }
+            finally
+            {
+                if (!result.IsSuccess)
+                {
+                    TaskManager.CompleteResultTask(result);
+                }
+                else
+                {
+                    TaskManager.CompleteResultTask();
+                }
+            }
+
+            return result;
+        }
+
         private static RdsServerSettings GetRdsServerSettingsInternal(int serverId, string settingsName)
         {
             IDataReader reader = DataProvider.GetRdsServerSettings(serverId, settingsName);
@@ -363,7 +406,8 @@ namespace WebsitePanel.EnterpriseServer
             {                
                 var collection = ObjectUtils.FillObjectFromDataReader<RdsCollection>(DataProvider.GetRDSCollectionById(serverId));
                 var rds = GetRemoteDesktopServices(GetRdsServiceId(collection.ItemId));
-                rds.ApplyGPO(collection.Name, settings);
+                Organization org = OrganizationController.GetOrganization(collection.ItemId);
+                rds.ApplyGPO(org.OrganizationId, collection.Name, settings);
 
                 XmlDocument doc = new XmlDocument();
                 XmlElement nodeProps = doc.CreateElement("properties");
@@ -748,7 +792,7 @@ namespace WebsitePanel.EnterpriseServer
                 };                
 
                 rds.CreateCollection(org.OrganizationId, collection);
-                rds.ApplyGPO(collection.Name, GetDefaultGpoSettings());
+                rds.ApplyGPO(org.OrganizationId, collection.Name, GetDefaultGpoSettings());
                 collection.Id = DataProvider.AddRDSCollection(itemId, collection.Name, collection.Description, collection.DisplayName);                
                 
                 collection.Settings.RdsCollectionId = collection.Id;
diff --git a/WebsitePanel/Sources/WebsitePanel.EnterpriseServer/esRemoteDesktopServices.asmx.cs b/WebsitePanel/Sources/WebsitePanel.EnterpriseServer/esRemoteDesktopServices.asmx.cs
index 7b977052..b99ea321 100644
--- a/WebsitePanel/Sources/WebsitePanel.EnterpriseServer/esRemoteDesktopServices.asmx.cs
+++ b/WebsitePanel/Sources/WebsitePanel.EnterpriseServer/esRemoteDesktopServices.asmx.cs
@@ -380,5 +380,11 @@ namespace WebsitePanel.EnterpriseServer
         {
             return RemoteDesktopServicesController.UpdateRdsServerSettings(serverId, settingsName, settings);
         }
+
+        [WebMethod]
+        public ResultObject ShadowSession(int itemId, string sessionId, bool control)
+        {
+            return RemoteDesktopServicesController.ShadowSession(itemId, sessionId, control);
+        }
     }
 }
diff --git a/WebsitePanel/Sources/WebsitePanel.Providers.Base/RemoteDesktopServices/IRemoteDesktopServices.cs b/WebsitePanel/Sources/WebsitePanel.Providers.Base/RemoteDesktopServices/IRemoteDesktopServices.cs
index 1d5b04b4..a2113c2e 100644
--- a/WebsitePanel/Sources/WebsitePanel.Providers.Base/RemoteDesktopServices/IRemoteDesktopServices.cs
+++ b/WebsitePanel/Sources/WebsitePanel.Providers.Base/RemoteDesktopServices/IRemoteDesktopServices.cs
@@ -81,6 +81,7 @@ namespace WebsitePanel.Providers.RemoteDesktopServices
         void RemoveRdsServerFromTenantOU(string hostName, string organizationId);
         void InstallCertificate(byte[] certificate, string password, List<string> hostNames);
         void MoveSessionHostToRdsOU(string hostName);
-        void ApplyGPO(string collectionName, RdsServerSettings serverSettings);
+        void ApplyGPO(string organizationId, string collectionName, RdsServerSettings serverSettings);
+        void ShadowSession(string sessionId, bool control);
     }
 }
diff --git a/WebsitePanel/Sources/WebsitePanel.Providers.Base/RemoteDesktopServices/RdsServerSettings.cs b/WebsitePanel/Sources/WebsitePanel.Providers.Base/RemoteDesktopServices/RdsServerSettings.cs
index be32aaa8..beddb245 100644
--- a/WebsitePanel/Sources/WebsitePanel.Providers.Base/RemoteDesktopServices/RdsServerSettings.cs
+++ b/WebsitePanel/Sources/WebsitePanel.Providers.Base/RemoteDesktopServices/RdsServerSettings.cs
@@ -38,7 +38,13 @@ namespace WebsitePanel.EnterpriseServer.Base.RDS
         public const string CHANGE_DESKTOP_DISABLED_USERS = "ChangingDesktopDisabledUsers";
         public const string SCREEN_SAVER_DISABLED_ADMINISTRATORS = "ScreenSaverDisabledAdministrators";
         public const string SCREEN_SAVER_DISABLED_USERS = "ScreenSaverDisabledUsers";
-        public const string DRIVE_SPACE_THRESHOLD_VALUE = "DriveSpaceThresholdValue";        
+        public const string DRIVE_SPACE_THRESHOLD_VALUE = "DriveSpaceThresholdValue";
+        public const string RDS_VIEW_WITHOUT_PERMISSION = "RDSViewWithoutPermission";
+        public const string RDS_VIEW_WITHOUT_PERMISSION_ADMINISTRATORS = "RDSViewWithoutPermissionAdministrators";
+        public const string RDS_VIEW_WITHOUT_PERMISSION_Users = "RDSViewWithoutPermissionUsers";
+        public const string RDS_CONTROL_WITHOUT_PERMISSION = "RDSControlWithoutPermission";
+        public const string RDS_CONTROL_WITHOUT_PERMISSION_ADMINISTRATORS = "RDSControlWithoutPermissionAdministrators";
+        public const string RDS_CONTROL_WITHOUT_PERMISSION_Users = "RDSControlWithoutPermissionUsers";
 
         public string SettingsName { get; set; }
         public int ServerId { get; set; }
diff --git a/WebsitePanel/Sources/WebsitePanel.Providers.TerminalServices.Windows2012/Windows2012.cs b/WebsitePanel/Sources/WebsitePanel.Providers.TerminalServices.Windows2012/Windows2012.cs
index 58bc5ab0..1f3b46ce 100644
--- a/WebsitePanel/Sources/WebsitePanel.Providers.TerminalServices.Windows2012/Windows2012.cs
+++ b/WebsitePanel/Sources/WebsitePanel.Providers.TerminalServices.Windows2012/Windows2012.cs
@@ -93,6 +93,8 @@ namespace WebsitePanel.Providers.RemoteDesktopServices
         private const string DisableTaskManagerGpoValueName = "DisableTaskMgr";
         private const string HideCDriveGpoKey = @"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer";
         private const string HideCDriveGpoValueName = "NoDrives";
+        private const string RDSSessionGpoKey = @"HKCU\Software\Policies\Microsoft\Windows NT\Terminal Services";
+        private const string RDSSessionGpoValueName = "Shadow";
 
         #endregion
 
@@ -371,6 +373,7 @@ namespace WebsitePanel.Providers.RemoteDesktopServices
 
                 CreatePolicy(runSpace, organizationId, string.Format("{0}-administrators", collection.Name), new DirectoryEntry(GetGroupPath(organizationId, collection.Name, GetLocalAdminsGroupName(collection.Name))), collection.Name);
                 CreatePolicy(runSpace, organizationId, string.Format("{0}-users", collection.Name), new DirectoryEntry(GetUsersGroupPath(organizationId, collection.Name)), collection.Name);
+                CreateHelpDeskPolicy(runSpace, new DirectoryEntry(GetHelpDeskGroupPath(RDSHelpDeskGroup)), organizationId, collection.Name);
             }                   
             finally
             {
@@ -516,6 +519,7 @@ namespace WebsitePanel.Providers.RemoteDesktopServices
 
                 DeleteGpo(runSpace, string.Format("{0}-administrators", collectionName));
                 DeleteGpo(runSpace, string.Format("{0}-users", collectionName));
+                DeleteHelpDeskPolicy(runSpace, collectionName);
                 var capPolicyName = GetPolicyName(organizationId, collectionName, RdsPolicyTypes.RdCap);
                 var rapPolicyName = GetPolicyName(organizationId, collectionName, RdsPolicyTypes.RdRap);
 
@@ -1116,7 +1120,7 @@ namespace WebsitePanel.Providers.RemoteDesktopServices
 
         #region GPO   
      
-        public void ApplyGPO(string collectionName, RdsServerSettings serverSettings)
+        public void ApplyGPO(string organizationId, string collectionName, RdsServerSettings serverSettings)
         {
             string administratorsGpo = string.Format("{0}-administrators", collectionName);
             string usersGpo = string.Format("{0}-users", collectionName);
@@ -1126,6 +1130,7 @@ namespace WebsitePanel.Providers.RemoteDesktopServices
             {
                 runspace = OpenRunspace();
 
+                CreateHelpDeskPolicy(runspace, new DirectoryEntry(GetHelpDeskGroupPath(RDSHelpDeskGroup)), organizationId, collectionName);
                 RemoveRegistryValue(runspace, ScreenSaverGpoKey, administratorsGpo);
                 RemoveRegistryValue(runspace, ScreenSaverGpoKey, usersGpo);                
                 RemoveRegistryValue(runspace, RemoveRestartGpoKey, administratorsGpo);
@@ -1133,34 +1138,73 @@ namespace WebsitePanel.Providers.RemoteDesktopServices
                 RemoveRegistryValue(runspace, DisableTaskManagerGpoKey, administratorsGpo);
                 RemoveRegistryValue(runspace, DisableTaskManagerGpoKey, usersGpo);                
 
-                var setting = serverSettings.Settings.First(s => s.PropertyName.Equals(RdsServerSettings.SCREEN_SAVER_DISABLED));
-                SetRegistryValue(setting, runspace, ScreenSaverGpoKey, administratorsGpo, usersGpo, ScreenSaverValueName, "0", "string");                
+                var setting = serverSettings.Settings.FirstOrDefault(s => s.PropertyName.Equals(RdsServerSettings.SCREEN_SAVER_DISABLED));
+                SetRegistryValue(setting, runspace, ScreenSaverGpoKey, administratorsGpo, usersGpo, ScreenSaverValueName, "0", "string");
 
-                setting = serverSettings.Settings.First(s => s.PropertyName.Equals(RdsServerSettings.REMOVE_SHUTDOWN_RESTART));
-                SetRegistryValue(setting, runspace, RemoveRestartGpoKey, administratorsGpo, usersGpo, RemoveRestartGpoValueName, "1", "DWord");                                
+                setting = serverSettings.Settings.FirstOrDefault(s => s.PropertyName.Equals(RdsServerSettings.REMOVE_SHUTDOWN_RESTART));
+                SetRegistryValue(setting, runspace, RemoveRestartGpoKey, administratorsGpo, usersGpo, RemoveRestartGpoValueName, "1", "DWord");
 
-                setting = serverSettings.Settings.First(s => s.PropertyName.Equals(RdsServerSettings.REMOVE_RUN_COMMAND));
+                setting = serverSettings.Settings.FirstOrDefault(s => s.PropertyName.Equals(RdsServerSettings.REMOVE_RUN_COMMAND));
                 SetRegistryValue(setting, runspace, RemoveRunGpoKey, administratorsGpo, usersGpo, RemoveRunGpoValueName, "1", "DWord");
 
-                setting = serverSettings.Settings.First(s => s.PropertyName.Equals(RdsServerSettings.DISABLE_TASK_MANAGER));
+                setting = serverSettings.Settings.FirstOrDefault(s => s.PropertyName.Equals(RdsServerSettings.DISABLE_TASK_MANAGER));
                 SetRegistryValue(setting, runspace, DisableTaskManagerGpoKey, administratorsGpo, usersGpo, DisableTaskManagerGpoValueName, "1", "DWord");
 
-                setting = serverSettings.Settings.First(s => s.PropertyName.Equals(RdsServerSettings.HIDE_C_DRIVE));
-                SetRegistryValue(setting, runspace, HideCDriveGpoKey, administratorsGpo, usersGpo, HideCDriveGpoValueName, "4", "DWord");                
-                
-                setting = serverSettings.Settings.First(s => s.PropertyName.Equals(RdsServerSettings.LOCK_SCREEN_TIMEOUT));
+                setting = serverSettings.Settings.FirstOrDefault(s => s.PropertyName.Equals(RdsServerSettings.HIDE_C_DRIVE));
+                SetRegistryValue(setting, runspace, HideCDriveGpoKey, administratorsGpo, usersGpo, HideCDriveGpoValueName, "4", "DWord");
+
+                setting = serverSettings.Settings.FirstOrDefault(s => s.PropertyName.Equals(RdsServerSettings.LOCK_SCREEN_TIMEOUT));
                 double result;
 
-                if (!string.IsNullOrEmpty(setting.PropertyValue) && double.TryParse(setting.PropertyValue, out result))
+                if (setting != null && !string.IsNullOrEmpty(setting.PropertyValue) && double.TryParse(setting.PropertyValue, out result))
                 {                    
                     SetRegistryValue(setting, runspace, ScreenSaverTimeoutGpoKey, administratorsGpo, usersGpo, ScreenSaverTimeoutValueName, setting.PropertyValue, "string");                                    
                 }
+
+                SetRdsSessionHostPermissions(runspace, serverSettings, usersGpo, administratorsGpo);
             }
             finally
             {
                 CloseRunspace(runspace);
             }
-        }     
+        }
+
+        private void SetRdsSessionHostPermissions(Runspace runspace, RdsServerSettings settings, string usersGpo, string administratorsGpo)
+        {
+            var viewSetting = settings.Settings.FirstOrDefault(s => s.PropertyName.Equals(RdsServerSettings.RDS_VIEW_WITHOUT_PERMISSION));
+            var controlSetting = settings.Settings.FirstOrDefault(s => s.PropertyName.Equals(RdsServerSettings.RDS_CONTROL_WITHOUT_PERMISSION));
+
+            if (viewSetting == null || controlSetting == null)
+            {
+                return;
+            }
+
+            if (controlSetting.ApplyUsers)
+            {
+                SetRegistryValue(runspace, RDSSessionGpoKey, usersGpo, "2", RDSSessionGpoValueName, "DWord");
+            }
+            else if (viewSetting.ApplyUsers)
+            {
+                SetRegistryValue(runspace, RDSSessionGpoKey, usersGpo, "4", RDSSessionGpoValueName, "DWord");
+            }
+            else
+            {
+                SetRegistryValue(runspace, RDSSessionGpoKey, usersGpo, "3", RDSSessionGpoValueName, "DWord");
+            }
+
+            if (controlSetting.ApplyAdministrators)
+            {
+                SetRegistryValue(runspace, RDSSessionGpoKey, administratorsGpo, "2", RDSSessionGpoValueName, "DWord");
+            }
+            else if (viewSetting.ApplyAdministrators)
+            {
+                SetRegistryValue(runspace, RDSSessionGpoKey, administratorsGpo, "4", RDSSessionGpoValueName, "DWord");
+            }
+            else
+            {
+                SetRegistryValue(runspace, RDSSessionGpoKey, administratorsGpo, "3", RDSSessionGpoValueName, "DWord");
+            }
+        }
    
         private void RemoveRegistryValue(Runspace runspace, string key, string gpoName)
         {
@@ -1173,6 +1217,11 @@ namespace WebsitePanel.Providers.RemoteDesktopServices
 
         private void SetRegistryValue(RdsServerSetting setting, Runspace runspace, string key, string administratorsGpo, string usersGpo, string valueName, string value, string type)
         {
+            if (setting == null)
+            {
+                return;
+            }
+
             if (setting.ApplyAdministrators)
             {
                 SetRegistryValue(runspace, key, administratorsGpo, value, valueName, type);
@@ -1196,6 +1245,19 @@ namespace WebsitePanel.Providers.RemoteDesktopServices
             Collection<PSObject> result = ExecuteRemoteShellCommand(runspace, PrimaryDomainController, cmd);
         }
 
+        private void CreateHelpDeskPolicy(Runspace runspace, DirectoryEntry entry, string organizationId, string collectionName)
+        {
+            string gpoName = string.Format("{0}-HelpDesk", collectionName);
+            string gpoId = GetPolicyId(runspace, gpoName);
+
+            if (string.IsNullOrEmpty(gpoId))
+            {
+                gpoId = CreateAndLinkPolicy(runspace, gpoName, organizationId, collectionName);
+                SetPolicyPermissions(runspace, gpoName, entry);
+                SetRegistryValue(runspace, RDSSessionGpoKey, gpoName, "2", RDSSessionGpoValueName, "DWord");
+            }
+        }
+
         private string CreatePolicy(Runspace runspace, string organizationId, string gpoName, DirectoryEntry entry, string collectionName)
         {
             string gpoId = GetPolicyId(runspace, gpoName);
@@ -1209,6 +1271,12 @@ namespace WebsitePanel.Providers.RemoteDesktopServices
             return gpoId;
         }
 
+        private void DeleteHelpDeskPolicy(Runspace runspace, string collectionName)
+        {
+            string gpoName = string.Format("{0}-HelpDesk", collectionName);
+            DeleteGpo(runspace, gpoName);
+        }
+
         private void DeleteGpo(Runspace runspace, string gpoName)
         {
             Command cmd = new Command("Remove-GPO");
@@ -1235,7 +1303,7 @@ namespace WebsitePanel.Providers.RemoteDesktopServices
 
             try
             {
-                var entry = new DirectoryEntry(GetCollectionOUPath(organizationId, string.Format("{0}-OU", collectionName)));
+                var entry = new DirectoryEntry(GetOrganizationPath(organizationId));
                 var distinguishedName = string.Format("\"{0}\"", ActiveDirectoryUtils.GetADObjectProperty(entry, "DistinguishedName"));
 
                 Command cmd = new Command("New-GPO");
@@ -1294,6 +1362,32 @@ namespace WebsitePanel.Providers.RemoteDesktopServices
 
         #endregion
 
+        #region Shadow Session
+
+        public void ShadowSession(string sessionId, bool control)
+        {
+            Runspace runspace = null;
+
+            try
+            {
+                runspace = OpenRunspace();
+
+                var scripts = new List<string>
+                {
+                    string.Format("mstsc /Shadow:{0}{1}", sessionId, control ? " /Control" : "")
+                };
+
+                object[] errors = null;
+                ExecuteShellCommand(runspace, scripts, out errors);
+            }
+            finally
+            {
+                CloseRunspace(runspace);
+            }
+        }
+
+        #endregion
+
         #region RDS Help Desk
 
         private string GetHelpDeskGroupPath(string groupName)
diff --git a/WebsitePanel/Sources/WebsitePanel.Server.Client/RemoteDesktopServicesProxy.cs b/WebsitePanel/Sources/WebsitePanel.Server.Client/RemoteDesktopServicesProxy.cs
index fbb586a2..924cfa7d 100644
--- a/WebsitePanel/Sources/WebsitePanel.Server.Client/RemoteDesktopServicesProxy.cs
+++ b/WebsitePanel/Sources/WebsitePanel.Server.Client/RemoteDesktopServicesProxy.cs
@@ -104,6 +104,8 @@ namespace WebsitePanel.Providers.RemoteDesktopServices {
         
         private System.Threading.SendOrPostCallback ApplyGPOOperationCompleted;
         
+        private System.Threading.SendOrPostCallback ShadowSessionOperationCompleted;
+        
         /// <remarks/>
         public RemoteDesktopServices() {
             this.Url = "http://localhost:9003/RemoteDesktopServices.asmx";
@@ -220,6 +222,9 @@ namespace WebsitePanel.Providers.RemoteDesktopServices {
         /// <remarks/>
         public event ApplyGPOCompletedEventHandler ApplyGPOCompleted;
         
+        /// <remarks/>
+        public event ShadowSessionCompletedEventHandler ShadowSessionCompleted;
+        
         /// <remarks/>
         [System.Web.Services.Protocols.SoapHeaderAttribute("ServiceProviderSettingsSoapHeaderValue")]
         [System.Web.Services.Protocols.SoapDocumentMethodAttribute("http://smbsaas/websitepanel/server/CreateCollection", RequestNamespace="http://smbsaas/websitepanel/server/", ResponseNamespace="http://smbsaas/websitepanel/server/", Use=System.Web.Services.Description.SoapBindingUse.Literal, ParameterStyle=System.Web.Services.Protocols.SoapParameterStyle.Wrapped)]
@@ -1791,15 +1796,17 @@ namespace WebsitePanel.Providers.RemoteDesktopServices {
         /// <remarks/>
         [System.Web.Services.Protocols.SoapHeaderAttribute("ServiceProviderSettingsSoapHeaderValue")]
         [System.Web.Services.Protocols.SoapDocumentMethodAttribute("http://smbsaas/websitepanel/server/ApplyGPO", RequestNamespace="http://smbsaas/websitepanel/server/", ResponseNamespace="http://smbsaas/websitepanel/server/", Use=System.Web.Services.Description.SoapBindingUse.Literal, ParameterStyle=System.Web.Services.Protocols.SoapParameterStyle.Wrapped)]
-        public void ApplyGPO(string collectionName, RdsServerSettings serverSettings) {
+        public void ApplyGPO(string organizationId, string collectionName, RdsServerSettings serverSettings) {
             this.Invoke("ApplyGPO", new object[] {
+                        organizationId,
                         collectionName,
                         serverSettings});
         }
         
         /// <remarks/>
-        public System.IAsyncResult BeginApplyGPO(string collectionName, RdsServerSettings serverSettings, System.AsyncCallback callback, object asyncState) {
+        public System.IAsyncResult BeginApplyGPO(string organizationId, string collectionName, RdsServerSettings serverSettings, System.AsyncCallback callback, object asyncState) {
             return this.BeginInvoke("ApplyGPO", new object[] {
+                        organizationId,
                         collectionName,
                         serverSettings}, callback, asyncState);
         }
@@ -1810,16 +1817,17 @@ namespace WebsitePanel.Providers.RemoteDesktopServices {
         }
         
         /// <remarks/>
-        public void ApplyGPOAsync(string collectionName, RdsServerSettings serverSettings) {
-            this.ApplyGPOAsync(collectionName, serverSettings, null);
+        public void ApplyGPOAsync(string organizationId, string collectionName, RdsServerSettings serverSettings) {
+            this.ApplyGPOAsync(organizationId, collectionName, serverSettings, null);
         }
         
         /// <remarks/>
-        public void ApplyGPOAsync(string collectionName, RdsServerSettings serverSettings, object userState) {
+        public void ApplyGPOAsync(string organizationId, string collectionName, RdsServerSettings serverSettings, object userState) {
             if ((this.ApplyGPOOperationCompleted == null)) {
                 this.ApplyGPOOperationCompleted = new System.Threading.SendOrPostCallback(this.OnApplyGPOOperationCompleted);
             }
             this.InvokeAsync("ApplyGPO", new object[] {
+                        organizationId,
                         collectionName,
                         serverSettings}, this.ApplyGPOOperationCompleted, userState);
         }
@@ -1831,6 +1839,49 @@ namespace WebsitePanel.Providers.RemoteDesktopServices {
             }
         }
         
+        /// <remarks/>
+        [System.Web.Services.Protocols.SoapHeaderAttribute("ServiceProviderSettingsSoapHeaderValue")]
+        [System.Web.Services.Protocols.SoapDocumentMethodAttribute("http://smbsaas/websitepanel/server/ShadowSession", RequestNamespace="http://smbsaas/websitepanel/server/", ResponseNamespace="http://smbsaas/websitepanel/server/", Use=System.Web.Services.Description.SoapBindingUse.Literal, ParameterStyle=System.Web.Services.Protocols.SoapParameterStyle.Wrapped)]
+        public void ShadowSession(string sessionId, bool control) {
+            this.Invoke("ShadowSession", new object[] {
+                        sessionId,
+                        control});
+        }
+        
+        /// <remarks/>
+        public System.IAsyncResult BeginShadowSession(string sessionId, bool control, System.AsyncCallback callback, object asyncState) {
+            return this.BeginInvoke("ShadowSession", new object[] {
+                        sessionId,
+                        control}, callback, asyncState);
+        }
+        
+        /// <remarks/>
+        public void EndShadowSession(System.IAsyncResult asyncResult) {
+            this.EndInvoke(asyncResult);
+        }
+        
+        /// <remarks/>
+        public void ShadowSessionAsync(string sessionId, bool control) {
+            this.ShadowSessionAsync(sessionId, control, null);
+        }
+        
+        /// <remarks/>
+        public void ShadowSessionAsync(string sessionId, bool control, object userState) {
+            if ((this.ShadowSessionOperationCompleted == null)) {
+                this.ShadowSessionOperationCompleted = new System.Threading.SendOrPostCallback(this.OnShadowSessionOperationCompleted);
+            }
+            this.InvokeAsync("ShadowSession", new object[] {
+                        sessionId,
+                        control}, this.ShadowSessionOperationCompleted, userState);
+        }
+        
+        private void OnShadowSessionOperationCompleted(object arg) {
+            if ((this.ShadowSessionCompleted != null)) {
+                System.Web.Services.Protocols.InvokeCompletedEventArgs invokeArgs = ((System.Web.Services.Protocols.InvokeCompletedEventArgs)(arg));
+                this.ShadowSessionCompleted(this, new System.ComponentModel.AsyncCompletedEventArgs(invokeArgs.Error, invokeArgs.Cancelled, invokeArgs.UserState));
+            }
+        }
+        
         /// <remarks/>
         public new void CancelAsync(object userState) {
             base.CancelAsync(userState);
@@ -2468,4 +2519,8 @@ namespace WebsitePanel.Providers.RemoteDesktopServices {
     /// <remarks/>
     [System.CodeDom.Compiler.GeneratedCodeAttribute("wsdl", "2.0.50727.3038")]
     public delegate void ApplyGPOCompletedEventHandler(object sender, System.ComponentModel.AsyncCompletedEventArgs e);
+    
+    /// <remarks/>
+    [System.CodeDom.Compiler.GeneratedCodeAttribute("wsdl", "2.0.50727.3038")]
+    public delegate void ShadowSessionCompletedEventHandler(object sender, System.ComponentModel.AsyncCompletedEventArgs e);
 }
diff --git a/WebsitePanel/Sources/WebsitePanel.Server/RemoteDesktopServices.asmx.cs b/WebsitePanel/Sources/WebsitePanel.Server/RemoteDesktopServices.asmx.cs
index ff949699..c246e544 100644
--- a/WebsitePanel/Sources/WebsitePanel.Server/RemoteDesktopServices.asmx.cs
+++ b/WebsitePanel/Sources/WebsitePanel.Server/RemoteDesktopServices.asmx.cs
@@ -665,12 +665,12 @@ namespace WebsitePanel.Server
         }
 
         [WebMethod, SoapHeader("settings")]
-        public void ApplyGPO(string collectionName, RdsServerSettings serverSettings)
+        public void ApplyGPO(string organizationId, string collectionName, RdsServerSettings serverSettings)
         {
             try
             {
                 Log.WriteStart("'{0}' ApplyGPO", ProviderSettings.ProviderName);
-                RDSProvider.ApplyGPO(collectionName, serverSettings);
+                RDSProvider.ApplyGPO(organizationId, collectionName, serverSettings);
                 Log.WriteEnd("'{0}' ApplyGPO", ProviderSettings.ProviderName);
             }
             catch (Exception ex)
@@ -679,5 +679,21 @@ namespace WebsitePanel.Server
                 throw;
             }
         }
+
+        [WebMethod, SoapHeader("settings")]
+        public void ShadowSession(string sessionId, bool control)
+        {
+            try
+            {
+                Log.WriteStart("'{0}' ShadowSession", ProviderSettings.ProviderName);
+                RDSProvider.ShadowSession(sessionId, control);
+                Log.WriteEnd("'{0}' ShadowSession", ProviderSettings.ProviderName);
+            }
+            catch (Exception ex)
+            {
+                Log.WriteError(String.Format("'{0}' ShadowSession", ProviderSettings.ProviderName), ex);
+                throw;
+            }
+        }
     }
 }
diff --git a/WebsitePanel/Sources/WebsitePanel.WebPortal/App_GlobalResources/WebsitePanel_SharedResources.ascx.resx b/WebsitePanel/Sources/WebsitePanel.WebPortal/App_GlobalResources/WebsitePanel_SharedResources.ascx.resx
index cbff0b24..937e6e43 100644
--- a/WebsitePanel/Sources/WebsitePanel.WebPortal/App_GlobalResources/WebsitePanel_SharedResources.ascx.resx
+++ b/WebsitePanel/Sources/WebsitePanel.WebPortal/App_GlobalResources/WebsitePanel_SharedResources.ascx.resx
@@ -5702,6 +5702,12 @@
   <data name="ERROR.REMOTE_DESKTOP_SERVICES_LOG_OFF_USER" xml:space="preserve">
     <value>RDS User logging off error</value>
   </data>
+  <data name="ERROR.REMOTE_DESKTOP_SERVICES_VIEW_SESSION" xml:space="preserve">
+    <value>View session error</value>
+  </data>
+    <data name="ERROR.REMOTE_DESKTOP_SERVICES_CONTROL_SESSION" xml:space="preserve">
+    <value>Control session error</value>
+  </data>
   <data name="ERROR.REMOTE_DESKTOP_SERVICES_USER_SESSIONS" xml:space="preserve">
     <value>Getting RDS User sessions error</value>
   </data>
diff --git a/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/App_LocalResources/SettingsRdsPolicy.ascx.resx b/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/App_LocalResources/SettingsRdsPolicy.ascx.resx
index 6f342a55..837eae3e 100644
--- a/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/App_LocalResources/SettingsRdsPolicy.ascx.resx
+++ b/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/App_LocalResources/SettingsRdsPolicy.ascx.resx
@@ -123,6 +123,12 @@
   <data name="cbUsers.Text" xml:space="preserve">
     <value>Users</value>
   </data>
+  <data name="secChangeDesktop.Text" xml:space="preserve">
+    <value>Changing Desktop Disabled</value>
+  </data>
+  <data name="secControlSession.Text" xml:space="preserve">
+    <value>Control RDS Session without Users's Permission</value>
+  </data>
   <data name="secDriveSpace.Text" xml:space="preserve">
     <value>Drive Space Threshold</value>
   </data>
@@ -147,7 +153,7 @@
   <data name="secTimeout.Text" xml:space="preserve">
     <value>Lock Screen Timeout (sec.)</value>
   </data>
-  <data name="sekChangeDesktop.Text" xml:space="preserve">
-    <value>Changing Desktop Disabled</value>
+  <data name="secViewSession.Text" xml:space="preserve">
+    <value>View RDS Session without Users's Permission</value>
   </data>
 </root>
\ No newline at end of file
diff --git a/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/App_LocalResources/RDSEditUserExperience.ascx.resx b/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/App_LocalResources/RDSEditUserExperience.ascx.resx
index 91b50033..a6355f92 100644
--- a/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/App_LocalResources/RDSEditUserExperience.ascx.resx
+++ b/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/App_LocalResources/RDSEditUserExperience.ascx.resx
@@ -123,6 +123,12 @@
   <data name="cbUsers.Text" xml:space="preserve">
     <value>Users</value>
   </data>
+  <data name="secChangeDesktop.Text" xml:space="preserve">
+    <value>Changing Desktop Disabled</value>
+  </data>
+  <data name="secControlSession.Text" xml:space="preserve">
+    <value>Control RDS Session without Users's Permission</value>
+  </data>
   <data name="secDriveSpace.Text" xml:space="preserve">
     <value>Drive Space Threshold</value>
   </data>
@@ -147,7 +153,7 @@
   <data name="secTimeout.Text" xml:space="preserve">
     <value>Lock Screen Timeout</value>
   </data>
-  <data name="sekChangeDesktop.Text" xml:space="preserve">
-    <value>Changing Desktop Disabled</value>
+  <data name="secViewSession.Text" xml:space="preserve">
+    <value>View RDS Session without Users's Permission</value>
   </data>
 </root>
\ No newline at end of file
diff --git a/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/App_LocalResources/RDSUserSessions.ascx.resx b/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/App_LocalResources/RDSUserSessions.ascx.resx
index e8f7f85d..54e311d7 100644
--- a/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/App_LocalResources/RDSUserSessions.ascx.resx
+++ b/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/App_LocalResources/RDSUserSessions.ascx.resx
@@ -150,4 +150,16 @@
   <data name="btnRefresh.Text" xml:space="preserve">
     <value>Refresh</value>
   </data>
+  <data name="cmdControlSession.Text" xml:space="preserve">
+    <value>Control</value>
+  </data>
+  <data name="cmdControlSession.ToolTip" xml:space="preserve">
+    <value>Control Session</value>
+  </data>
+  <data name="cmdViewSession.Text" xml:space="preserve">
+    <value>View</value>
+  </data>
+  <data name="cmdViewSession.ToolTip" xml:space="preserve">
+    <value>View Session</value>
+  </data>
 </root>
\ No newline at end of file
diff --git a/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/RDSEditUserExperience.ascx b/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/RDSEditUserExperience.ascx
index ff6065a3..44b5384b 100644
--- a/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/RDSEditUserExperience.ascx
+++ b/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/RDSEditUserExperience.ascx
@@ -162,6 +162,34 @@
                         </table>
                         <br />
                     </asp:Panel>
+                    <wsp:CollapsiblePanel id="secViewSession" runat="server" TargetControlID="viewSessionPanel" meta:resourcekey="secViewSession" Text="View RDS Session without Users's Permission"/>
+                    <asp:Panel ID="viewSessionPanel" runat="server" Height="0" style="overflow:hidden;">
+                        <table>
+                            <tr>
+                                <td>
+                                    <asp:CheckBox runat="server" Text="Users" ID="cbViewSessionUsers" meta:resourcekey="cbUsers" Checked="false" />
+                                </td>
+                                <td>
+                                    <asp:CheckBox runat="server" Text="Administrators" meta:resourcekey="cbAdministrators" ID="cbViewSessionAdministrators" Checked="false" />
+                                </td>           
+                            </tr>        
+                        </table>
+                        <br />
+                    </asp:Panel>
+                    <wsp:CollapsiblePanel id="secControlSession" runat="server" TargetControlID="controlSessionPanel" meta:resourcekey="secControlSession" Text="Control RDS Session without Users's Permission"/>
+                    <asp:Panel ID="controlSessionPanel" runat="server" Height="0" style="overflow:hidden;">
+                        <table>
+                            <tr>
+                                <td>
+                                    <asp:CheckBox runat="server" Text="Users" ID="cbControlSessionUsers" meta:resourcekey="cbUsers" Checked="false" />
+                                </td>
+                                <td>
+                                    <asp:CheckBox runat="server" Text="Administrators" meta:resourcekey="cbAdministrators" ID="cbControlSessionAdministrators" Checked="false" />
+                                </td>           
+                            </tr>
+                        </table>
+                        <br />
+                    </asp:Panel>
                     <div class="FormFooterClean">
                         <wsp:ItemButtonPanel id="buttonPanel" runat="server" ValidationGroup="SaveRDSCollection" 
                             OnSaveClick="btnSave_Click" OnSaveExitClick="btnSaveExit_Click" />
diff --git a/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/RDSEditUserExperience.ascx.cs b/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/RDSEditUserExperience.ascx.cs
index cfe4ba23..6fc1f396 100644
--- a/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/RDSEditUserExperience.ascx.cs
+++ b/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/RDSEditUserExperience.ascx.cs
@@ -45,45 +45,97 @@ namespace WebsitePanel.Portal.RDS
         private void BindSettings(RdsServerSettings settings)
         {
             var setting = GetServerSetting(settings, RdsServerSettings.LOCK_SCREEN_TIMEOUT);
-            ddTimeout.SelectedValue = setting.PropertyValue;
-            cbTimeoutAdministrators.Checked = setting.ApplyAdministrators;
-            cbTimeoutUsers.Checked = setting.ApplyUsers;
+
+            if (setting != null)
+            {
+                ddTimeout.SelectedValue = setting.PropertyValue;
+                cbTimeoutAdministrators.Checked = setting.ApplyAdministrators;
+                cbTimeoutUsers.Checked = setting.ApplyUsers;
+            }
 
             setting = GetServerSetting(settings, RdsServerSettings.REMOVE_RUN_COMMAND);
-            cbRunCommandAdministrators.Checked = setting.ApplyAdministrators;
-            cbRunCommandUsers.Checked = setting.ApplyUsers;
+
+            if (setting != null)
+            {
+                cbRunCommandAdministrators.Checked = setting.ApplyAdministrators;
+                cbRunCommandUsers.Checked = setting.ApplyUsers;
+            }
 
             setting = GetServerSetting(settings, RdsServerSettings.REMOVE_POWERSHELL_COMMAND);
-            cbPowershellAdministrators.Checked = setting.ApplyAdministrators;
-            cbPowershellUsers.Checked = setting.ApplyUsers;
+
+            if (setting != null)
+            {
+                cbPowershellAdministrators.Checked = setting.ApplyAdministrators;
+                cbPowershellUsers.Checked = setting.ApplyUsers;
+            }
 
             setting = GetServerSetting(settings, RdsServerSettings.HIDE_C_DRIVE);
-            cbHideCDriveAdministrators.Checked = setting.ApplyAdministrators;
-            cbHideCDriveUsers.Checked = setting.ApplyUsers;
 
+            if (setting != null)
+            {
+                cbHideCDriveAdministrators.Checked = setting.ApplyAdministrators;
+                cbHideCDriveUsers.Checked = setting.ApplyUsers;
+            }
+            
             setting = GetServerSetting(settings, RdsServerSettings.REMOVE_SHUTDOWN_RESTART);
-            cbShutdownAdministrators.Checked = setting.ApplyAdministrators;
-            cbShutdownUsers.Checked = setting.ApplyUsers;
+
+            if (setting != null)
+            {
+                cbShutdownAdministrators.Checked = setting.ApplyAdministrators;
+                cbShutdownUsers.Checked = setting.ApplyUsers;
+            }
 
             setting = GetServerSetting(settings, RdsServerSettings.DISABLE_TASK_MANAGER);
-            cbTaskManagerAdministrators.Checked = setting.ApplyAdministrators;
-            cbTaskManagerUsers.Checked = setting.ApplyUsers;
+
+            if (setting != null)
+            {
+                cbTaskManagerAdministrators.Checked = setting.ApplyAdministrators;
+                cbTaskManagerUsers.Checked = setting.ApplyUsers;
+            }
 
             setting = GetServerSetting(settings, RdsServerSettings.CHANGE_DESKTOP_DISABLED);
-            cbDesktopAdministrators.Checked = setting.ApplyAdministrators;
-            cbDesktopUsers.Checked = setting.ApplyUsers;
+
+            if (setting != null)
+            {
+                cbDesktopAdministrators.Checked = setting.ApplyAdministrators;
+                cbDesktopUsers.Checked = setting.ApplyUsers;
+            }
 
             setting = GetServerSetting(settings, RdsServerSettings.SCREEN_SAVER_DISABLED);
-            cbScreenSaverAdministrators.Checked = setting.ApplyAdministrators;
-            cbScreenSaverUsers.Checked = setting.ApplyUsers;
+
+            if (setting != null)
+            {
+                cbScreenSaverAdministrators.Checked = setting.ApplyAdministrators;
+                cbViewSessionUsers.Checked = setting.ApplyUsers;
+            }
+
+            setting = GetServerSetting(settings, RdsServerSettings.RDS_VIEW_WITHOUT_PERMISSION);
+
+            if (setting != null)
+            {
+                cbViewSessionAdministrators.Checked = setting.ApplyAdministrators;
+                cbScreenSaverUsers.Checked = setting.ApplyUsers;
+            }
+
+            setting = GetServerSetting(settings, RdsServerSettings.RDS_CONTROL_WITHOUT_PERMISSION);
+
+            if (setting != null)
+            {
+                cbControlSessionAdministrators.Checked = setting.ApplyAdministrators;
+                cbControlSessionUsers.Checked = setting.ApplyUsers;
+            }
 
             setting = GetServerSetting(settings, RdsServerSettings.DRIVE_SPACE_THRESHOLD);
-            ddTreshold.SelectedValue = setting.PropertyValue;
+
+            if (setting != null)
+            {
+                ddTreshold.SelectedValue = setting.PropertyValue;
+            }
         }
 
         private RdsServerSetting GetServerSetting(RdsServerSettings settings, string propertyName)
         {
-            return settings.Settings.First(s => s.PropertyName.Equals(propertyName));
+            return settings.Settings.FirstOrDefault(s => s.PropertyName.Equals(propertyName));
         }
 
         private RdsServerSettings GetSettings()
@@ -162,6 +214,22 @@ namespace WebsitePanel.Portal.RDS
                 ApplyUsers = true
             });
 
+            settings.Settings.Add(new RdsServerSetting
+            {
+                PropertyName = RdsServerSettings.RDS_VIEW_WITHOUT_PERMISSION,
+                PropertyValue = "",
+                ApplyAdministrators = cbViewSessionAdministrators.Checked,
+                ApplyUsers = cbViewSessionUsers.Checked
+            });
+
+            settings.Settings.Add(new RdsServerSetting
+            {
+                PropertyName = RdsServerSettings.RDS_CONTROL_WITHOUT_PERMISSION,
+                PropertyValue = "",
+                ApplyAdministrators = cbControlSessionAdministrators.Checked,
+                ApplyUsers = cbControlSessionUsers.Checked
+            });
+
             return settings;
         }
 
@@ -192,6 +260,11 @@ namespace WebsitePanel.Portal.RDS
             cbScreenSaverAdministrators.Checked = Convert.ToBoolean(settings[RdsServerSettings.SCREEN_SAVER_DISABLED_ADMINISTRATORS]);
             cbScreenSaverUsers.Checked = Convert.ToBoolean(settings[RdsServerSettings.SCREEN_SAVER_DISABLED_USERS]);
 
+            cbViewSessionAdministrators.Checked = Convert.ToBoolean(settings[RdsServerSettings.RDS_VIEW_WITHOUT_PERMISSION_ADMINISTRATORS]);
+            cbViewSessionUsers.Checked = Convert.ToBoolean(settings[RdsServerSettings.RDS_VIEW_WITHOUT_PERMISSION_Users]);
+            cbControlSessionAdministrators.Checked = Convert.ToBoolean(settings[RdsServerSettings.RDS_CONTROL_WITHOUT_PERMISSION_ADMINISTRATORS]);
+            cbControlSessionUsers.Checked = Convert.ToBoolean(settings[RdsServerSettings.RDS_CONTROL_WITHOUT_PERMISSION_Users]);
+
             ddTreshold.SelectedValue = settings[RdsServerSettings.DRIVE_SPACE_THRESHOLD_VALUE];
         }
 
diff --git a/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/RDSEditUserExperience.ascx.designer.cs b/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/RDSEditUserExperience.ascx.designer.cs
index ced85d01..953e340e 100644
--- a/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/RDSEditUserExperience.ascx.designer.cs
+++ b/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/RDSEditUserExperience.ascx.designer.cs
@@ -390,6 +390,78 @@ namespace WebsitePanel.Portal.RDS {
         /// </remarks>
         protected global::System.Web.UI.WebControls.DropDownList ddTreshold;
         
+        /// <summary>
+        /// secViewSession control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::WebsitePanel.Portal.CollapsiblePanel secViewSession;
+        
+        /// <summary>
+        /// viewSessionPanel control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::System.Web.UI.WebControls.Panel viewSessionPanel;
+        
+        /// <summary>
+        /// cbViewSessionUsers control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::System.Web.UI.WebControls.CheckBox cbViewSessionUsers;
+        
+        /// <summary>
+        /// cbViewSessionAdministrators control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::System.Web.UI.WebControls.CheckBox cbViewSessionAdministrators;
+        
+        /// <summary>
+        /// secControlSession control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::WebsitePanel.Portal.CollapsiblePanel secControlSession;
+        
+        /// <summary>
+        /// controlSessionPanel control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::System.Web.UI.WebControls.Panel controlSessionPanel;
+        
+        /// <summary>
+        /// cbControlSessionUsers control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::System.Web.UI.WebControls.CheckBox cbControlSessionUsers;
+        
+        /// <summary>
+        /// cbControlSessionAdministrators control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::System.Web.UI.WebControls.CheckBox cbControlSessionAdministrators;
+        
         /// <summary>
         /// buttonPanel control.
         /// </summary>
diff --git a/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/RDSUserSessions.ascx b/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/RDSUserSessions.ascx
index 9afc8a5b..15d0ef9e 100644
--- a/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/RDSUserSessions.ascx
+++ b/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/RDSUserSessions.ascx
@@ -40,7 +40,7 @@
                                         OnRowCommand="gvRDSCollections_RowCommand" AllowPaging="True" AllowSorting="True">
                                         <Columns>                                            
                                             <asp:TemplateField meta:resourcekey="gvUserName" HeaderText="gvUserName">
-                                                <ItemStyle Width="30%" Wrap="false"/>
+                                                <ItemStyle Width="25%" Wrap="false"/>
                                                 <ItemTemplate>
                                                     <asp:Image ID="vipImage" runat="server" ImageUrl='<%# GetAccountImage(Convert.ToBoolean(Eval("IsVip"))) %>' ImageAlign="AbsMiddle"/>
                                                     <asp:Literal ID="litUserName" runat="server" Text='<%# Eval("UserName") %>'/>
@@ -48,17 +48,29 @@
                                                 </ItemTemplate>
                                             </asp:TemplateField>
                                             <asp:TemplateField meta:resourcekey="gvHostServer" HeaderText="gvHostServer">
-                                                <ItemStyle Width="30%" Wrap="false"/>
+                                                <ItemStyle Width="25%" Wrap="false"/>
                                                 <ItemTemplate>
                                                     <asp:Literal ID="litHostServer" runat="server" Text='<%# Eval("HostServer") %>'/>
                                                 </ItemTemplate>
                                             </asp:TemplateField>
                                             <asp:TemplateField meta:resourcekey="gvSessionState" HeaderText="gvSessionState">
-                                                <ItemStyle Width="30%" Wrap="false"/>
+                                                <ItemStyle Width="25%" Wrap="false"/>
                                                 <ItemTemplate>
                                                     <asp:Literal ID="litSessionState" runat="server" Text='<%# Eval("SessionState") %>'/>
                                                 </ItemTemplate>
                                             </asp:TemplateField>
+                                            <asp:TemplateField>
+                                                <ItemTemplate>                                            
+                                                    <asp:LinkButton ID="lnkViewSession" runat="server" Text="View" CommandName="View" CommandArgument='<%# Eval("UnifiedSessionId") %>'
+                                                        meta:resourcekey="cmdViewSession"></asp:LinkButton>
+                                                </ItemTemplate>
+                                            </asp:TemplateField>
+                                            <asp:TemplateField>
+                                                <ItemTemplate>                                            
+                                                    <asp:LinkButton ID="lnkControlSession" runat="server" Text="Control" CommandName="Control" CommandArgument='<%# Eval("UnifiedSessionId") %>'
+                                                        meta:resourcekey="cmdControlSession"></asp:LinkButton>
+                                                </ItemTemplate>
+                                            </asp:TemplateField>
                                             <asp:TemplateField>
                                                 <ItemTemplate>                                            
                                                     <asp:LinkButton ID="lnkLogOff" runat="server" Text="Log Off" CommandName="LogOff" CommandArgument='<%# Eval("UnifiedSessionId") + ";" + Eval("HostServer") %>'
diff --git a/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/RDSUserSessions.ascx.cs b/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/RDSUserSessions.ascx.cs
index 9938e16e..bd4d5e20 100644
--- a/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/RDSUserSessions.ascx.cs
+++ b/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/RDS/RDSUserSessions.ascx.cs
@@ -44,6 +44,28 @@ namespace WebsitePanel.Portal.RDS
                     ShowErrorMessage("REMOTE_DESKTOP_SERVICES_LOG_OFF_USER", ex);
                 }
             }
+            else if (e.CommandName == "View")
+            {
+                try
+                {
+                    ES.Services.RDS.ShadowSession(PanelRequest.ItemID, e.CommandArgument.ToString(), false);                    
+                }
+                catch (Exception ex)
+                {
+                    ShowErrorMessage("REMOTE_DESKTOP_SERVICES_VIEW_SESSION", ex);
+                }
+            }
+            else if (e.CommandName == "Control")
+            {
+                try
+                {
+                    ES.Services.RDS.ShadowSession(PanelRequest.ItemID, e.CommandArgument.ToString(), true);
+                }
+                catch (Exception ex)
+                {
+                    ShowErrorMessage("REMOTE_DESKTOP_SERVICES_CONTROL_SESSION", ex);
+                }
+            }
         }
 
         protected void btnSave_Click(object sender, EventArgs e)
diff --git a/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/SettingsRdsPolicy.ascx b/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/SettingsRdsPolicy.ascx
index 8e0a1ea6..4d22c2e1 100644
--- a/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/SettingsRdsPolicy.ascx
+++ b/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/SettingsRdsPolicy.ascx
@@ -138,4 +138,32 @@
         </tr>        
     </table>
     <br />
+</asp:Panel>
+<wsp:CollapsiblePanel id="secViewSession" runat="server" TargetControlID="viewSessionPanel" meta:resourcekey="secViewSession" Text="View RDS Session without Users's Permission"/>
+<asp:Panel ID="viewSessionPanel" runat="server" Height="0" style="overflow:hidden;">
+    <table>
+        <tr>
+            <td>
+                <asp:CheckBox runat="server" Text="Users" ID="cbViewSessionUsers" meta:resourcekey="cbUsers" Checked="false" />
+            </td>
+            <td>
+                <asp:CheckBox runat="server" Text="Administrators" meta:resourcekey="cbAdministrators" ID="cbViewSessionAdministrators" Checked="false" />
+            </td>           
+        </tr>        
+    </table>
+    <br />
+</asp:Panel>
+<wsp:CollapsiblePanel id="secControlSession" runat="server" TargetControlID="controlSessionPanel" meta:resourcekey="secControlSession" Text="Control RDS Session without Users's Permission"/>
+<asp:Panel ID="controlSessionPanel" runat="server" Height="0" style="overflow:hidden;">
+    <table>
+        <tr>
+            <td>
+                <asp:CheckBox runat="server" Text="Users" ID="cbControlSessionUsers" meta:resourcekey="cbUsers" Checked="false" />
+            </td>
+            <td>
+                <asp:CheckBox runat="server" Text="Administrators" meta:resourcekey="cbAdministrators" ID="cbControlSessionAdministrators" Checked="false" />
+            </td>           
+        </tr>        
+    </table>
+    <br />
 </asp:Panel>
\ No newline at end of file
diff --git a/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/SettingsRdsPolicy.ascx.cs b/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/SettingsRdsPolicy.ascx.cs
index cdbd2821..ed9bab8c 100644
--- a/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/SettingsRdsPolicy.ascx.cs
+++ b/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/SettingsRdsPolicy.ascx.cs
@@ -44,6 +44,11 @@ namespace WebsitePanel.Portal
             cbScreenSaverAdministrators.Checked = Convert.ToBoolean(settings[RdsServerSettings.SCREEN_SAVER_DISABLED_ADMINISTRATORS]);
             cbScreenSaverUsers.Checked = Convert.ToBoolean(settings[RdsServerSettings.SCREEN_SAVER_DISABLED_USERS]);
 
+            cbViewSessionAdministrators.Checked = Convert.ToBoolean(settings[RdsServerSettings.RDS_VIEW_WITHOUT_PERMISSION_ADMINISTRATORS]);
+            cbViewSessionUsers.Checked = Convert.ToBoolean(settings[RdsServerSettings.RDS_VIEW_WITHOUT_PERMISSION_Users]);
+            cbControlSessionAdministrators.Checked = Convert.ToBoolean(settings[RdsServerSettings.RDS_CONTROL_WITHOUT_PERMISSION_ADMINISTRATORS]);
+            cbControlSessionUsers.Checked = Convert.ToBoolean(settings[RdsServerSettings.RDS_CONTROL_WITHOUT_PERMISSION_Users]);
+
             ddTreshold.SelectedValue = settings[RdsServerSettings.DRIVE_SPACE_THRESHOLD_VALUE];
         }
 
diff --git a/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/SettingsRdsPolicy.ascx.designer.cs b/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/SettingsRdsPolicy.ascx.designer.cs
index 4c962af4..2b120670 100644
--- a/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/SettingsRdsPolicy.ascx.designer.cs
+++ b/WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/SettingsRdsPolicy.ascx.designer.cs
@@ -335,5 +335,77 @@ namespace WebsitePanel.Portal {
         /// To modify move field declaration from designer file to code-behind file.
         /// </remarks>
         protected global::System.Web.UI.WebControls.DropDownList ddTreshold;
+        
+        /// <summary>
+        /// secViewSession control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::WebsitePanel.Portal.CollapsiblePanel secViewSession;
+        
+        /// <summary>
+        /// viewSessionPanel control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::System.Web.UI.WebControls.Panel viewSessionPanel;
+        
+        /// <summary>
+        /// cbViewSessionUsers control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::System.Web.UI.WebControls.CheckBox cbViewSessionUsers;
+        
+        /// <summary>
+        /// cbViewSessionAdministrators control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::System.Web.UI.WebControls.CheckBox cbViewSessionAdministrators;
+        
+        /// <summary>
+        /// secControlSession control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::WebsitePanel.Portal.CollapsiblePanel secControlSession;
+        
+        /// <summary>
+        /// controlSessionPanel control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::System.Web.UI.WebControls.Panel controlSessionPanel;
+        
+        /// <summary>
+        /// cbControlSessionUsers control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::System.Web.UI.WebControls.CheckBox cbControlSessionUsers;
+        
+        /// <summary>
+        /// cbControlSessionAdministrators control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::System.Web.UI.WebControls.CheckBox cbControlSessionAdministrators;
     }
 }