Attempt to shadow the session fails with the error:

Invite file cannot be downloaded from Director.
Event viewer on the Director server shows the error:
An unexpected error occurred when accessing the data source 'The broker service reported an error. See the event log for more information.' ('http://DDC_FQDN/Citrix/BrokerAdminService/v2'). User: 'DOMAIN\ADMIN' Console operation: 'Starting remote assistance for desktop…' Additional information: 'The request channel timed out while waiting for a reply after 00:00:20. Increase the timeout value passed to the call to Request or increase the SendTimeout value on the Binding. The time allotted to this operation may have been a portion of a longer timeout.'
On the VDA (inside the ICA session); Windows Remote Assistance window appears:

Event viewer on the VDA shows the event:
The error message: Either the folder does not exist or you do not have permission to write to this location.
Verify that you can create a file in the specified path, and then try again. has been shown to the user.
Attempt to save the invite file on the VDA also fails with the same message.
This can be tested by running (from Start > Run or cmd.exe):
msra /saveasfile Test 12345678910
(Test is the name of the file and 12345678910 is the password).
The default list of permissions has been modified.
Make sure that users have Read/Write access to the Public Documents folder on the VDA (C:\Users\Public\Documents)
Default list of permissions (sufficient if not modified):
The purpose of this article is to help customers to identify and resolve the issue with shadowing.
This only applies to the environments patched with the latest updates mentioned in the article: https://support.citrix.com/external/article/CTX695983
Policies are configured correctly as per: https://support.citrix.com/external/article/CTX696597/citrix-director-unable-to-shadow-sessio.html
The invite file is by default stored in the Public Documents folder.