By default only administrators can shadow other user’s sessions. If you want to give permission to all of your users to shadow other users, do the following:

Step 1:

On Xenapp server, open terminal services configuration, double click on ICA-tcp(on right hand side), security tab, select remote desktop users group, advanced, choose remote desktop users group, click edit, and check the box remote control.

Step 2:

Create a policy, open the policy properties, select User Workspace\Shadowing. At the configuration node, Enable the option and allow shadowing. At the permissions node, Enable it and click configure option and select the group for which you need to give shadowing permissions. If you want to give shadow permissions to all users, select for domain users group and allow it. If you want to give shadow permissions to all helpdesk team, add your helpdesk group name and allow it.

Finally, run gpupdate /force command in command prompt.

Done. Both Step 1 and Step 2 are mandatory.