How do I allow remote desktop connection remotely?

We’ve all been there – we’ve finished at a customer’s site, and need to quickly remote in later on to finish/fix something. Trouble is, Windows doesn’t enable Remote Desktop Protocol by default.

There are four steps needed toremotelyenable RDP connections in Windows 10.

1. Open ports in the Windows firewall
2. Edit the registry
3. Start the Remote Desktop service
4. Connect

This guide relies on you being on the same LAN as the remote PC you wish to access – you may already have RDP’ed into another server on that LAN. You must also have Windows administrativeprivilegesfor the remote computer. These instructions work well in a domain environment.

Note: If you have access to the computer, you can follow the standard procedure for enabling Remote Desktop.

How to allow remote connections on Windows 10

The Remote Desktop app is easy to use to connect to other devices. However, the configuration you need will depend on whether you're trying to connect in the local network or through the internet.

Enable remote connections on Windows 10

When trying to start a remote connection from within the local area network (LAN), you only need to make sure the computer you're trying to access has the option to allow remote desktop connections enabled.

Control Panel

To enable remote connections on Windows 10, use these steps:

1. Open Control Panel.
2. Click on System and Security.

3. Under the "System" section, click the Allow remote access option..

   Source: Windows Central

4. Click the Remote tab.

5. Under the "Remote Desktop" section, check the Allow remote connections to this computer option.

   Source: Windows Central

6. Check the Allow connections only from computers running Remote Desktop with Network Level Authentication option.
7. Click the OK button.
8. Click the Apply button.
9. Click the OK button.

Once you complete the steps, remote desktop connections will be allowed on the device. Windows 10 will even add the necessary rules in the built-in Microsoft Defender Firewall, but you may need to configure the rules manually if you have a third-party firewall.

Settings app

You can also enable the Remote Desktop feature using the Settings app with these steps:

1. Open Settings.
2. Click on System.
3. Click on Remote Desktop.

4. Turn on the Enable Remote Desktop toggle switch.

   Source: Windows Central

5. Click the Confirm button.

If you're setting up a remote desktop using an internet connection, continue with the steps below. If you're trying to connect to another device within the local network, you can skip to the steps below, and continue with the start a remote desktop connection instructions.

Enable remote connections on router

If you have to access the computer over the internet, you will also have to configure the router (modem) to allow the remote connection. A process that also requires knowing the public address to contact the remote computer.

Configure static IP address on Windows 10

Computers usually get assigned dynamic IP addresses from the DHCP server (router), which means they can always change. If you plan to use remote desktop often, you may want to configure a static IP address to avoid reconfiguring port forwarding on the router when the computer gets a new address.

To set a permanent IP address configuration, use these steps:

1. Open Control Panel.
2. Click on Network and Internet.

3. Click on Network and Sharing Center.

   Source: Windows Central

4. Click the Change adapter settings option from the left navigation pane.

   Source: Windows Central

5. Right-click the active adapter and select the Properties option.

   Source: Windows Central

6. Select the Internet Protocol Version 4 (TCP/IPv4) option.

7. Click the Properties button.

   Source: Windows Central

8. Click the General tab.
9. Select the Use the following IP address option.

10. Specify a valid local IP address outside the local DHCP scope to prevent address conflicts. For example, 10.1.4.201.

    Source: Windows Central

    Quick tip: Typically, you'll find this information on the router inside the DHCP settings section. The routers' interface is always different per manufacturer, which means that you may need to consult your manufacturer support website for more specific details. If you're unsure of the configuration you have to use, you can use your current TCP/IP configuration as a reference, which you can find running the ipconfig /all command in Command Prompt.

11. Specify a subnet mask for the network (for example, 255.255.255.0), but the system usually fills this infomration for you based on the "IP address" you entered earlier.
12. Specify the default gateway address, which is the router's address—for example, 10.1.4.1.

13. Under the "Use the following DNS server addresses" section, in the "Preferred DNS server" field, specify the IP address of your DNS server, which in most cases is also the address of the router —for example, 10.1.4.1.

    Quick tip: If you can't connect to the internet, you may also want to try using one of the Google Public DNS addresses (such as 8.8.8.8) for the "Alternate DNS server" option.

14. Click the OK button.
15. Click the Close button.

After you complete the steps, the new network configuration will apply, and the IP settings will never change.

Some routers include a feature to make the current TCP/IP configuration static. If you want to use this option instead, you can consult your manufacturer support website for specific steps on how to complete this task.

Determine network public IP address

You'll also need the remote network's public IP address to contact the device over the internet.

To find the IP address assigned by the Internet Service Provider (ISP), use these steps:

1. Open web browser.
2. Visit Bing.com or Google.com.
3. Search for "What's my IP."

4. Confirm your public IP address in the first result.

   Source: Windows Central

Usually, for residential customers, internet providers also offer dynamic public IP addresses, which means that your public IP address may change from time to time.

If you need a more reliable solution, there are "Dynamic Domain Name System" (DDNS) services (such as DynDNS, OpenDNS, No-IP, Asus.com (for Asus routers)), which can track the public IP changes. Alternatively, you can also contact your ISP to request a static IP address, but it might costs you additional since this is typically a feature reserved for business.

Forward port on router

You must also forward the TCP port 3389 on the router to allow a remote connection over the internet to the computer in the local network.

Quick note: The interface to change the router settings are different per manufacturer, and sometimes even per model. However, you can use the following instructions as a reference to configure your router. You can always check the manufacturer support website for more specific details.

To forward a port on your router, use these steps:

1. Open Start.
2. Search for Command Prompt and click the top result to open the console.

3. Type the following command to view the current TCP/IP configuration and press Enter:

   ipconfig

4. Under the "IPv4 Address" field, confirm the device address. For example, 10.1.4.100.

5. Under the "Default Gateway" field, confirm the device gateway address (the router address)—for example, 10.1.4.1.

   Source: Windows Central

6. Open web browser.
7. Type the IP address of the router (Default Gateway) in the address bar and press Enter.

8. Sign in to the router using the correct username and password.

   Quick tip: If you have never done this, and you are using the router provided by the ISP, you can find the information on a sticker attached to the device.

9. Browse to the Port Forwarding settings page.
10. Confirm that the Port Forwarding service is enabled (if applicable).

11. Under the port forwarding list, click (in this case) the Add profile button.

    Source: Windows Central

12. Create a new port forward with the required information. For example:

    • Service name: Specify the reference name for the service. For instance, OfficePC Remote (optional).
    • Protocol: TCP.
    • External Port: 3389.
    • Internal Port: 3389.
    • Internal IP Address: Specify the IP address of the computer you're trying to connect. For instance, 10.1.4.100
    Source: Windows Central

13. Click the OK button.

Once you complete the steps, the port will open on the router, allowing remote desktop connections through the internet to that specific computer.

Allow Remote Desktop via Group Policy ^

The easiest way certainly is to enable RDP access via Group Policy:Allow users to connect remotely using Remote Desktop Services

You can find the policy here:

Computer Configuration > Administrative Templates > Windows Components >Remote Desktop Services > Remote Desktop Session Host > Connections.

Allow users to connect remotely by using Remote Desktop Services

You will also have to allow RDP in the Windows Firewall on the remote Windows 10 computer:

Computer Configuration > Policies > Administrative Templates > Network > Network Connections > Windows Firewall > Domain Profile

Allow inbound Remote Desktop connections via Group Policy

The only problem is that Group Policy is sluggish, and if you want to log in quickly to a remote machine, it is often not an option. By contrast, on a PowerShell console, you can essentially get the job done with a single command.

Enable Remote Desktop via PowerShell ^

However, there is a catch—actually, two. Windows Firewall might get in your way, and if PowerShell remoting is not enabled on the machine, things can get a bit tricky. I know of two methods to enable Remote Desktop remotely via PowerShell. Which method you use mostly depends on your Windows Firewall configuration.

Let's assume first that PowerShell remoting is enabled on the remote machine. If so, you can simply enable Remote Desktop by modifying a registry key on the remote machine:

We are using Invoke-Command to execute the Set-ItemProperty remotely, which changes the value fDenyTSConnections to 0.

Most likely, Windows Firewall blocks RDP on the remote machine. To open the Remote Desktop port, you can use this PowerShell command:

We are using PowerShell remoting again to execute Enable-NetFirewallRule remotely.