Group Policy | Enable Remote Desktop on PC's | Select allowed users.

Question

Group Policy | Enable Remote Desktop on PC's | Select allowed users.

Rudolf Amarlapudi 377

Hello,

We are running a Windows Server 2016 | Domain.

Using Group Policy, I need to accomplish the following:

Enable Remote Desktop access on an Organizational Unit containing multiple computers.
Allow Remote Desktop Access for a select Security Group for these computers.

Can you please furnish the settings for the required Group Policies.

Thanks in advance.

Regards,

Rudy

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Marcin Policht 102.7K MVP Volunteer Moderator

To accomplish your requirements using Group Policy on a Windows Server 2016 domain, you'll need to configure two separate Group Policy settings:

Enable Remote Desktop Access:

This setting will enable Remote Desktop on the computers within the specified Organizational Unit (OU).

Allow Remote Desktop Access for a Select Security Group:

  - This setting will allow members of the specified security group to connect via Remote Desktop to the computers within the OU.

Here's how to configure these settings:

Enable Remote Desktop Access:
Open Group Policy Management Console (GPMC) on your domain controller.
Create a new Group Policy Object (GPO) or edit an existing one linked to the OU containing the computers where you want to enable Remote Desktop.
Navigate to: Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Connections.
Double-click on the "Allow users to connect remotely using Remote Desktop Services" policy.
Select the "Enabled" option, and then click "OK" to save the changes.
Close the Group Policy Management Editor.
Allow Remote Desktop Access for a Select Security Group:
Still within the same Group Policy Object (GPO) as above, navigate to: Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Restricted Groups.
Right-click on "Restricted Groups" and choose "Add Group."
In the "Group" field, type the name of the security group you want to grant Remote Desktop access to, and then click "OK."
In the "This group is a member of" section, click "Add" and specify the group "Remote Desktop Users." This is the built-in group that grants Remote Desktop access.
Click "OK" to close the dialog.
Close the Group Policy Management Editor.

Apply the Group Policy:

Link the Group Policy Object (GPO) you configured to the Organizational Unit (OU) containing the target computers.
Optionally, force a Group Policy update on the target computers using the gpupdate /force command or wait for the next refresh interval.To accomplish your requirements using Group Policy on a Windows Server 2016 domain, you'll need to configure two separate Group Policy settings:
1. Enable Remote Desktop Access:
  - This setting will enable Remote Desktop on the computers within the specified Organizational Unit (OU).
2. Allow Remote Desktop Access for a Select Security Group:
  - This setting will allow members of the specified security group to connect via Remote Desktop to the computers within the OU.
Here's how to configure these settings:
1. Enable Remote Desktop Access:
2. Open Group Policy Management Console (GPMC) on your domain controller.
3. Create a new Group Policy Object (GPO) or edit an existing one linked to the OU containing the computers where you want to enable Remote Desktop.
4. Navigate to: Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Connections.
5. Double-click on the "Allow users to connect remotely using Remote Desktop Services" policy.
6. Select the "Enabled" option, and then click "OK" to save the changes.
7. Close the Group Policy Management Editor.
8. Allow Remote Desktop Access for a Select Security Group:
9. Still within the same Group Policy Object (GPO) as above, navigate to: Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Restricted Groups.
10. Right-click on "Restricted Groups" and choose "Add Group."
11. In the "Group" field, type the name of the security group you want to grant Remote Desktop access to, and then click "OK."
12. In the "This group is a member of" section, click "Add" and specify the group "Remote Desktop Users." This is the built-in group that grants Remote Desktop access.
13. Click "OK" to close the dialog.
14. Close the Group Policy Management Editor.
Apply the Group Policy:
1. Link the Group Policy Object (GPO) you configured to the Organizational Unit (OU) containing the target computers.
2. Optionally, force a Group Policy update on the target computers using the gpupdate /force command or wait for the next refresh interval.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Usman Zaman 5 Reputation points

2025-02-06T04:18:40.8733333+00:00

I have a Windows 2025 domain, following the steps, the switch to turn RDP off/on on endpoints and servers gets greyed out but RDP is set to off. Any idea why? This should have been a simple change.
Tim Bablick 0 Reputation points

2025-02-06T21:41:05.1666667+00:00

We have the same issue. All workstations worked fine until 24H2 was installed and that killed RDP. We had to set the "Allow users to connect remotely..." setting to "Not configured" then the RDP switch was no longer greyed out and we could manually switch it on.
Juan A. González Escobar 0 Reputation points

2025-09-15T06:09:23.9266667+00:00

I have the same issue... when I enable "Allow users to connect remotely..." the switch to turn on/off RDP on the affected computers gets greyed out. Please help!!
mhomeyer05 0 Reputation points

2025-10-01T15:25:00.1+00:00

I was able to get this working by changing the Allow users to connect remotely..." setting to "Not configured", and then adding a registry key in the same GPO to
Action: Update
Hive: HKEY_LOCAL_MACHINE
KeyPath: SYSTEM\CurrentControlSet\Control\Terminal Server
and setting the value data to 00000000
Ilias 0 Reputation points

2025-11-05T08:44:52.4733333+00:00

the following step is missing:

Allow users to connect remotely using Remote Desktop Services → Enabled

(Firewall): Computer Configuration → Policies → Administrative Templates → Network → Network Connections → Windows Defender Firewall → Domain Profile and Private Profile → Windows Defender Firewall: Allow inbound Remote Desktop exceptions → Enabled

2 additional answers

Usman Zaman 5 Reputation points

2025-02-06T04:18:40.8733333+00:00

I have a Windows 2025 domain, following the steps, the switch to turn RDP off/on on endpoints and servers gets greyed out but RDP is set to off. Any idea why? This should have been a simple change.
Tim Bablick 0 Reputation points

2025-02-06T21:41:05.1666667+00:00

We have the same issue. All workstations worked fine until 24H2 was installed and that killed RDP. We had to set the "Allow users to connect remotely..." setting to "Not configured" then the RDP switch was no longer greyed out and we could manually switch it on.
Juan A. González Escobar 0 Reputation points

2025-09-15T06:09:23.9266667+00:00

I have the same issue... when I enable "Allow users to connect remotely..." the switch to turn on/off RDP on the affected computers gets greyed out. Please help!!
mhomeyer05 0 Reputation points

2025-10-01T15:25:00.1+00:00

I was able to get this working by changing the Allow users to connect remotely..." setting to "Not configured", and then adding a registry key in the same GPO to
Action: Update
Hive: HKEY_LOCAL_MACHINE
KeyPath: SYSTEM\CurrentControlSet\Control\Terminal Server
and setting the value data to 00000000
Ilias 0 Reputation points

2025-11-05T08:44:52.4733333+00:00

the following step is missing:

Allow users to connect remotely using Remote Desktop Services → Enabled

(Firewall): Computer Configuration → Policies → Administrative Templates → Network → Network Connections → Windows Defender Firewall → Domain Profile and Private Profile → Windows Defender Firewall: Allow inbound Remote Desktop exceptions → Enabled

Answer 1

Ran into this exact issue myself, so figured I'd share what ended up working for me. One thing I'd add to the answer above: Restricted Groups actually wiped out local admin access on a few of my machines that already had other accounts sitting in Remote Desktop Users. So I switched over to Group Policy Preferences instead, Computer Configuration then Preferences then Control Panel Settings then Local Users and Groups then New Local Group, targeting "Remote Desktop Users" with the action set to "Update." Preferences just adds to the group instead of wiping it out, way safer if these aren't brand new machines. I also had to manually enable the firewall exception for RDP under Computer Configuration then Administrative Templates then Network then Network Connections then Windows Firewall then Domain Profile, since just enabling the RDS policy on its own didn't actually open the port for me. Side note, I'll sometimes reach for HelpWire instead when I want to skip all the RDP/firewall/GPO back-and-forth. It's free, doesn't need port forwarding or firewall changes, and you can still lock down access per user.

Answer 2

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more