Shadowing error: The Terminal Server security layer detected an error in the protocol stream and has disconnected the client.

In addition to an earlier blogpost about troubleshooting shadowing (remote controlling) sessions; http://microsoftplatform.blogspot.com/2011/04/troubleshooting-remote-control-session.html

Microsoft released KB2533983 yesterday. This is about shadowing remote session in which Aero is enabled. This is not supported and could raise the following error:

The Terminal Server security layer detected an error in the protocol stream and has disconnected the client.

How do you know Aero is enabled for a user? The existence of the Dwm.exe process in the user session indicates that Aero is enabled for that session.

In addition the following events are raised:

Log Name: System
Source: TermDD
Date: 4/5/2011 1:14:24 PM
Event ID: 50
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: computername.domain.com
Description:
The RDP protocol component WD detected an error in the protocol stream and has disconnected the client.
Log Name: System
Source: TermDD
Date: 4/5/2011 1:14:24 PM
Event ID: 56
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: computername.domain.com
Description:
The Terminal Server security layer detected an error in the protocol stream and has disconnected the client. Client IP: fe80:0000:0000:0000:e499:f014:83ea:8221.

Source: http://support.microsoft.com/kb/2533983/en-us?sd=rss&spid=14134