It was introduced in Windows Server 2003 and it is available on many versions of Windows. Shortly, this is a predecessor to mstsc utility and its /shadow parameter. In earlier versions of Windows, the shadow.exe file lets a user connect to a remote host using Remote Desktop Services Shadowing technique.

Since the legacy version of Remote Desktop Services Shadowing is incompatible with the latest one and there are several articles on system administrator’s websites and forums about it, I’m not going to describe the former one widely, just a few words as a historical note. It is called Remote Desktop Services Shadowing. Luckily, Windows-based systems have an awesome built-in feature (as part of Remote Desktop Protocol) that is unfairly ignored or forgotten. Moreover, these actions are too noisy and leave a lot of garbage on a remote host. on the market to achieve it, but it involves additional actions such as binary delivery, its installation and so on. There is a number of third-party software such as VNC, radmin, TeamViewer, etc. From time to time in certain situations one needs to have a possibility to view a customer’s user screen to make some proofed screenshots or to get access to an open GUI application window which contains secrets for lateral movement while the legitimate user is connected via RDP and you don’t want to kick them out of the session.

Terminal services local session manager