What does NTSTATUS 0xC00A002A (STATUS_CTX_SHADOW_DENIED) mean?

STATUS_CTX_SHADOW_DENIED

Shadowing was rejected after the target was selected

STATUS_CTX_SHADOW_DENIED concerns Remote Desktop Services remote control, often called shadowing. The operation reached a session that is a possible control target but was denied by the effective authorization or consent decision.

This differs from an invalid shadow target. A valid session can still require user permission or be restricted by Remote Control policy. Disabling consent globally merely to make a test pass changes the security model and should not be the first diagnostic action.

Useful evidence

• Record the controller and target session IDs, the requested view/control mode, the user-consent prompt result, and the effective Remote Control policy on the host.
• Verify that the controller uses the intended RDS remote-control path and has the required administrative or delegated authority.
• Test policy changes only in an approved scope; preserve the distinction between a user declining consent and an administrator's policy denial.

References

• Microsoft Open Specifications: NTSTATUS values
• Microsoft: Remote Desktop Services API functions
• Microsoft: shadow a Terminal Server session