How do I enable Remote Desktop to all domain users?

Allow Remote desktop for a domain user

Archived Forums

Windows Server 2012 General

• Question

• 
  

  0

  Sign in to vote

  Hi,

  I want to allow Remote Desktop Access for multiple users in windows server 2012 domain.

  All users are member of Domain Users and Remote Desktop Users groups in Active Directory.

  Remote desktop has been enabled on the all other servers in the same domain, and "Allow log on through Remote Desktop Services " is enabled for Administrator and Remote Desktop Users group.

  However users are still not able to connect and they are getting the following error:

  "The connection was denied because the user account is not authorized for remote login"

  If I add them the local Remote Desktop Service of every machine in the domain, the access will be granted.

  What I should configure to allow RDP for all users without adding them to the local Remote Desktop Users groups.

  Regards,

  Tarek

  Thursday, October 20, 2016 6:07 PM

Answers

• 
  

  1

  Sign in to vote

  Hi TarekF,

  For my understanding adding a user or group to builtin Remote Desktop Users group in Active Directory will give him access to all servers in the domain without adding this group again to the local Remote Desktop Users of every server.

  >>>I have tested for this. If I add user to the group, I cannot see the user in local Remote Desktop Users group.

  As I mentioned the users are members of Remote Desktop Users builtin domain group, and the this group is already added to all log on thought Remote Desktop Services GPO of the remote server (this setting is by Default).

  >>>As mentioned above, to allow those users could logon the computers remotely, if the computer is domain member, you just need the user to the local Remote Desktop Users group like below.

  If the computer is a domain controller, you need add the user to local remote desktop users group and give the user logon through remote desktop service in GPO.

  

  Best Regards,

  Jay

  ---

  Please remember to mark the replies as answers if they help and unmark them if they provide no help.
  If you have feedback for TechNet Subscriber Support, contact .

  • Proposed as answer by Jay Gu Monday, November 7, 2016 11:37 AM
  • Marked as answer by Jay Gu Thursday, November 10, 2016 1:20 AM

  Tuesday, November 1, 2016 2:50 AM

All replies

• 
  

  0

  Sign in to vote

  Hi Tarek,

  Remote desktop has been enabled on the all other servers in the same domain, and "Allow log on through Remote Desktop Services " is enabled for Administrator and Remote Desktop Users group.

  However users are still not able to connect and they are getting the following error:

  "The connection was denied because the user account is not authorized for remote login"

  If I add them the local Remote Desktop Service of every machine in the domain, the access will be granted.

  What I should configure to allow RDP for all users without adding them to the local Remote Desktop Users groups.

  >>>The error may occur when user is part of the Remote Desktop users group but that group is not present in the GPO for “Allow Logon through Terminal Services”.

  I suggest you configure GPO with Administrator and those specific users for the setting allow logon through remote desktop services.

  To allow domain users logon remotely domain member, we need delegate domain users with remote logon and logon right.

  In other word, we need add the user to remote desktop users group and delegate with allow logon through remote desktop service.

  For more information, please refer to the article below.

  “Allow Logon through Terminal Services” group policy and “Remote Desktop Users” group

  https://blogs.technet.microsoft.com/askperf/2011/09/09/allow-logon-through-terminal-services-group-policy-and-remote-desktop-users-group/

  Best Regards,

  Jay

  ---

  Please remember to mark the replies as answers if they help and unmark them if they provide no help.
  If you have feedback for TechNet Subscriber Support, contact .

  • Proposed as answer by Jay Gu Friday, October 21, 2016 1:26 AM
  • Unproposed as answer by TarekF Friday, October 21, 2016 3:57 PM

  Friday, October 21, 2016 1:26 AM

• 
  

  0

  Sign in to vote

  Hi Jay,

  Thank you for your reply.

  As I mentioned the users are members of Remote Desktop Users builtin domain group, and the this group is already added to all log on thought Remote Desktop Services GPO of the remote server (this setting is by Default).

  However,I am still facing the same issue.

  For my understanding adding a user or group to builtin Remote Desktop Users group in Active Directory will give him access to all servers in the domain without adding this group again to the local Remote Desktop Users of every server.

  Regards,

  Tarek

  
  
  
  • Edited by TarekF Friday, October 21, 2016 11:34 AM

  Friday, October 21, 2016 10:33 AM

• 
  

  1

  Sign in to vote

  Hi TarekF,

  For my understanding adding a user or group to builtin Remote Desktop Users group in Active Directory will give him access to all servers in the domain without adding this group again to the local Remote Desktop Users of every server.

  >>>I have tested for this. If I add user to the group, I cannot see the user in local Remote Desktop Users group.

  As I mentioned the users are members of Remote Desktop Users builtin domain group, and the this group is already added to all log on thought Remote Desktop Services GPO of the remote server (this setting is by Default).

  >>>As mentioned above, to allow those users could logon the computers remotely, if the computer is domain member, you just need the user to the local Remote Desktop Users group like below.

  If the computer is a domain controller, you need add the user to local remote desktop users group and give the user logon through remote desktop service in GPO.

  Best Regards,

  Jay

  ---

  Please remember to mark the replies as answers if they help and unmark them if they provide no help.
  If you have feedback for TechNet Subscriber Support, contact .

  • Proposed as answer by Jay Gu Monday, November 7, 2016 11:37 AM
  • Marked as answer by Jay Gu Thursday, November 10, 2016 1:20 AM

  Tuesday, November 1, 2016 2:50 AM

• 
  

  0

  Sign in to vote

  Hi,

  Are there any updates?

  If the replies have resolved your problem, please mark it as answer as it would be helpful to anyone who encounters the similar issue.

  Thank you.

  Best Regards,

  Jay

  ---

  Please remember to mark the replies as answers if they help.
  If you have feedback for TechNet Subscriber Support, contact .

  Monday, November 7, 2016 11:37 AM

• 
  

  0

  Sign in to vote

  No i tried cant add

  Wednesday, March 28, 2018 5:09 PM

• 
  

  0

  Sign in to vote

  Greetings Karthick. Did you ever get issue resolved? I have same identical issue. Running ADS on domain controller. Added member server i wish to RDC too. Only way I've found is to add users to RDC group in domain, then grant RDC locally on member server. Have read many articles on how to configure RDC, but nothing to help with this.

  Tuesday, October 16, 2018 2:50 AM

• 
  

  0

  Sign in to vote

  Actually there is a confusion here. If you need to allow regular users to acces DOMAIN CONTROLLER via RDP, use "remote Desktop Users" group and above gpo reference. If you need the user to access another device (server, workstation) on your network, you must create a different group and add this domain group "to the LOCAL Remote Desktop Users group on your device". This can be done via GPO: Computer Confguration -> Preferences->Control Panel Settings -> Local Users and Groups

  Tuesday, December 3, 2019 1:13 PM

• 
  

  0

  Sign in to vote

  Its works for me..

  Friday, July 24, 2020 5:57 PM

Allow Domain Users to Use Remote Desktop

I can't get get working RDP for users in domain...
Users added to "Remote Desktop Users":

And i'm still getting this error:

What i'm missing?

image.png (120.0 KiB)

image.png (15.5 KiB)

Comment

Comment Show 0

Comment

5 |1600 characters needed characters left characters exceeded

▼

• Visible to all users
• Visible to the original poster & Microsoft
• Viewable by moderators
• Viewable by moderators and the original poster
• Advanced visibility

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DSPatrick answered • Nov 8, '21 | KatherineMMoss-0910 commented • Nov 24, '21

Read on here.
https://techcommunity.microsoft.com/t5/ask-the-performance-team/8220-allow-logon-through-terminal-services-8221-group-policy-and/ba-p/374961

--please don't forget to upvote and Accept as answer if the reply is helpful--

Comment

Comment · Show 9

Comment

5 |1600 characters needed characters left characters exceeded

▼

• Visible to all users
• Visible to the original poster & Microsoft
• Viewable by moderators
• Viewable by moderators and the original poster
• Advanced visibility

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DangerD-9009 · Nov 08, 2021 at 09:21 PM

Permissions for the RDP-TCP listener can be set using the Tsconfig.msc - that's not available in Windows 2019

0 Votes 0 ·

image.png (52.5 KiB)

DSPatrick DangerD-9009 · Nov 08, 2021 at 10:46 PM

Also check they're not in Deny log on through Remote Desktop Services or Deny access to this computer from the network

0 Votes 0 ·

DangerD-9009 DSPatrick · Nov 08, 2021 at 11:17 PM

it's empty, it's a new windows installation

0 Votes 0 ·

KatherineMMoss-0910 DangerD-9009 · Nov 24, 2021 at 06:28 PM

I would recommend creating a specific group that has the user right of remote logon assigned and then adding your users to that group; it's better practice to create your own groups for AD rather than using the built in ones.

0 Votes 0 ·

DSPatrick answered • Nov 9, '21 | DangerD-9009 commented • Nov 10, '21

Maybe it's a AD dns issue, all pcs connected to one router which is using google dns 8.8.8.8

Please run;

Dcdiag /v /c /d /e /s:%computername% >C:\dcdiag.log
repadmin /showrepl >C:\repl.txt
ipconfig /all > C:\dc1.txt
ipconfig /all > C:\dc2.txt
ipconfig /all > C:\problemworkstation.txt

then put unzipped text files up on OneDrive and share a link.

Comment

Comment · Show 1

Comment

5 |1600 characters needed characters left characters exceeded

▼

• Visible to all users
• Visible to the original poster & Microsoft
• Viewable by moderators
• Viewable by moderators and the original poster
• Advanced visibility

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DangerD-9009 · Nov 10, 2021 at 11:50 AM

Done:
https://1drv.ms/u/s!AlsIiKKz7uaTjXlp2IrWlI5-DVFz?e=hzWySl

1 Vote 1 ·

DSPatrick answered • Nov 10, '21 | DangerD-9009 commented • Nov 18, '21

• srv3 is multi-homed, do not install the domain controller on hypervisor. Multi-homing a domain controller will always cause no end to grief for active directory DNS
  

• There may be an IPv6 DHCP server on network. IPv6 if not configured correctly will be problematic so I'd suggest turning off the router IPv6 DHCP server
  

• Domain controller and all members should have static ip address of DC listed for DNS and no others such as or public DNS (router?)
  

• I did not look further because these are all show stoppers.

  
  

--please don't forget to upvote and Accept as answer if the reply is helpful--

Comment

Comment · Show 2

Comment

5 |1600 characters needed characters left characters exceeded

▼

• Visible to all users
• Visible to the original poster & Microsoft
• Viewable by moderators
• Viewable by moderators and the original poster
• Advanced visibility

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DSPatrick · Nov 15, 2021 at 01:24 PM

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--

0 Votes 0 ·

DangerD-9009 · Nov 18, 2021 at 10:57 AM

srv3 is multi-homed, do not install the domain controller on hypervisor.

T

here may be an IPv6 DHCP server on network.

0 Votes 0 ·

DSPatrick answered • Nov 18, '21 | DSPatrick commented • Nov 24, '21

Please put up a new set of files to look at.
Dcdiag /v /c /d /e /s:%computername% >C:\dcdiag.log
repadmin /showrepl >C:\repl.txt
ipconfig /all > C:\dc1.txt
ipconfig /all > C:\dc2.txt
ipconfig /all > C:\problemworkstation.txt

then put unzipped text files up on OneDrive and share a link.

Comment

Comment · Show 4

Comment

5 |1600 characters needed characters left characters exceeded

▼

• Visible to all users
• Visible to the original poster & Microsoft
• Viewable by moderators
• Viewable by moderators and the original poster
• Advanced visibility

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DSPatrick · Nov 19, 2021 at 10:07 AM

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--

0 Votes 0 ·

DangerD-9009 DSPatrick · Nov 22, 2021 at 12:12 PM

I can't post link here...
https://1drv.ms/u/s!AlsIiKKz7uaTjgTnbhjuFSHKDWO8?e=bYJbEj

after posting some text i'm able to add link, that's a bug...

0 Votes 0 ·

DSPatrick DangerD-9009 · Nov 22, 2021 at 02:02 PM

srv3 is multi-homed. Multi-homing a domain controller will always cause no end to grief for active directory DNS (do not install active directory domain services on hypervisor)

Domain controller and all members must use the static ip address of DC listed for DNS and no others such as router or public DNS (remove google DNS)

I did not look further since these two are show stoppers.

--please don't forget to upvote and Accept as answer if the reply is helpful--

0 Votes 0 ·

piaudonn answered • Nov 23, '21

Note that "Remote Desktop Users" group in the AD console (since you have the windows-active-directory tag) is only used to give RDP access to the domain controllers.
Just make sure you keep this group empty. You don't want non-admin opening interactive sessions on your domain controllers (it's a no-no-no).

To allow a user to open an RDP session on a member server the user will need the "Allow log on through Remote Desktop Services" privilege on the target system. This is given by default on member server to the users member of the local group "Remote Desktop Users" (the group on the local server, not the AD group). Or you can specify your own through group policy. Everything is explained in the post @DSPatrick mentioned. I just tried it on my different labs, it works fine on Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016 and Windows Server 2019.

When Network Level Authentication is enabled (which should be the case by default, and stay that way), you will also need the privilege "Access this computer from the network" which is by default is given to the "Users" group (which by default contain the AD group "Domain Users" group, so everyone unless you played with that group in AD).

When you got the following error message, you should see on an event id 4625 on the the target server telling you why it failed (likely lack of the privileges aforementioned).

Comment

Comment Show 0

Comment

5 |1600 characters needed characters left characters exceeded

▼

• Visible to all users
• Visible to the original poster & Microsoft
• Viewable by moderators
• Viewable by moderators and the original poster
• Advanced visibility

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

5 Replies

· · ·

Habanero

OP

davidr4

This person is a verified professional.

Verify your account to enable IT peers to see that you are a professional.

ryanbrad wrote:

I have added the group "Domain Users" to the group "Remote Desktop Users" within AD users and computers.

3

· · ·

Pure Capsaicin

OP

Neally

This person is a verified professional.

Verify your account to enable IT peers to see that you are a professional.

Why I wonder about the reason...... as allowing everyone to remote in other machines is weird.....

Have you added them to the group here:

If they try to RDP, what's the error they are getting?

You might as well just add the RDP rights for 'Authenticated Users' if you really want anyone to RDP into any computer... Did you also set firewall rules to allow RDP and such?

6

· · ·

Mace

OP

Da_Schmoo

This person is a verified professional.

Verify your account to enable IT peers to see that you are a professional.

Active Directory & GPO expert

62 Best Answers

236 Helpful Votes

Sounds like you are confusing the local Remote Desktop Users group and the domain Remote Desktop Users group. If you are adding users to the domain group, you need to add that group to the local machine.

3

· · ·

Mace

OP

JitenSh

This person is a verified professional.

Verify your account to enable IT peers to see that you are a professional.

Active Directory & GPO expert

126 Best Answers

262 Helpful Votes

GPO option is good idea as you also need to enable RDP on all computers

http://www.dannyeckes.com/server-2012-enable-remote-desktop-rdp-group-policy-gpo/

0

· · ·

Pure Capsaicin

OP

dbeato

This person is a verified professional.

Verify your account to enable IT peers to see that you are a professional.

In addition to all the great ideas here (Not sure the purpose of enabling RDP to all computers). First you should create a separate GPO for only the OU of computers or users. Then I would like to recommend to lock down the users that have access to RDP (By Security Groups) as shown below:

http://www.itnotes.eu/?p=2224

Make sure you also enable RDP access through Windows Firewall

http://www.alexcomputerbubble.com/using-group-policy-settings-to-enable-remote-desktop/

0

This topic has been locked by an administrator and is no longer open for commenting.

To continue this discussion, please ask a new question.

What is Remote Desktop Group Policy

Almost all users who are interested in building safe connections between computers on the internet might have heard about RDP or VPN. RDP stands for the Remote Desktop Protocol. It is a network of communications protocol developed by Microsoft, to allow users to connect to another computer.

With RDP, one can connect to any computer that runs Windows. With RDP, you can connect to the remote PC, view the same display and interact as if you are working on that machine locally.

Some instances where you may need to use RDP include;

• When traveling or when on vacation and you need to access your work computer
• When you can’t go to your office due to certain reasons and you still need to fulfill your daily tasks
• When you are a system admin and you need to perform administrative duties on your PC such as computer troubleshooting, tune-up, ID protection setting, printer set-up, software installation, email setup, virus and spyware removal, among others.
• When you need to give a demo and you need to access data from a private device
• When you want to personalize your remote desktop on experiences such as resolution, connection setting, screen setting, toolbar, start menu, icons among others.

How to Enable Remote Desktop Remotely on Windows 10

The easiest way to enable Remote Desktop on the Windows operating system family is to use a Graphical User Interface (GUI). To do this, you need to;

Open the “System” control panel, go to “Remote Setting” and enable the “Allow remote connection to this computer” option in the Remote Desktop section.

However, performing the above process will need local access to the computer on which you want to enable the RD.

By default, remote desktop is disabled in both desktop versions of Windows and in Windows Server.

How to Enable Remote Desktop Remotely Using PowerShell

Suppose you want to remotely enable RDP on Windows Server 2012 R2/2016/2019. Here is the procedure to achieve the same;

1. On your computer, open the PowerShell console and run the following commands to connect to your remote server.Enter-PSSession -ComputerName server.domain.local -Credential domain\administrator.
2. You will have established a remote session with a computer and now you can execute PowerShell commands on it. To enable Remote Desktop, you need to change registry parameter fDenyTSConnections from 1 to 0 on the remote machine. Run the command;Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server'-name "fDenyTSConnections" -Value 0
3. When RDP is enabled this way (as opposed to GUI method) the rule that allows remote RDP connections is not enabled in the Windows Firewall rules.
4. To allow incoming RDP connections in Windows Firewall, run the command;Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
5. If for some reason the firewall rule is deleted, you can create it manually using the following commands.netsh advfirewall firewall add rule name="allow RemoteDesktop" dir=in protocol=TCP localport=3389 action=allow
6. In case you need to allow secure RDP authentication (NLA – Network Level Authentication) run the command;Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "UserAuthentication" -Value 1
7. Now from your computer, you can check the TCP 3389 port on the remote host to see if it has become available. To do so, run the command below’Test-NetConnection 192.168.1.11 -CommonTCPPort RDP.
8. If successful, you should get results similar to what is shown below’

The above results mean RDP on the remote host is enables and you can establish a remote desktop connection using mstsc client.

How to Enable/Disable Remote Desktop Using Group Policy

You can enable or disable remote desktop using group policy. To do so, perform the following steps

1. Search gpedit.msc in the Start menu. In the program list, click gpedit.msc as shown below;
   
2. After Local Group Policy Editor opens, expand Computer Configuration >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Connections.
3. On the right-side panel. Double-click on Allow users to connect remotely using Remote Desktop Services. See below;
   
4. Select Enabled and click Apply if you want to enable Remote Desktop. Select Disabled and click Apply if you need to disable it.

Now you will have enabled or disabled remote desktop using group policy

Network Level Authentication NLA on the remote RDP server

Network Level Authentication is a method used to enhance RD Session Host server security by requiring that a user be authenticated to RD session Host Server before a session can be created.

If you want to restrict who can access your PC, you can choose to allow access only with Network Level Authentication (NLA). NLA is an authentication tool used in RDP Server. When a user tries to establish a connection to a device that is NLA enabled, NLA will delegate the user’s credentials from the client-side Security Support Provider to the server for authentication, before creating a session.

The advantages of Network Level Authentication is;

• It requires fewer remote computer resources initially.
• It can provide better security by reducing the risk of denial of service attacks.

To configure Network Level Authentication for a connection, follow the steps below.

1. On the RD Session Host Server, open Remote Desktop Session Host Configuration. To do so, click Start>>Adminstrative Tools1>>Remote Desktop Services>> Remote Desktop Session Host Configuration.
2. Under Connections, right-click the name of the connection and then click Properties.
3. On the General tab, select Allow the connection only from computers running Remote Desktop with Network Level Authentication checkbox
4. Click OK

Note, under step 3, if the “Allow connections only from computers running a remote desktop with network-level authentication” checkbox is not enabled, the “Require user authentication for remote connections by using network-level authentication” Group Policy setting has to be enabled, and has been applied to the RD Session Host Server.