Understanding Default RDP Permissions
When Remote Desktop Services is enabled on a Windows machine, the system enforces strict access controls. The primary mechanism controlling who can log in remotely is the Remote Desktop Users local group. If a user account is not explicitly added to this group, they will be denied access even if they know the correct password. Furthermore, simply being an administrator does not automatically grant RDP access if the specific "Allow log on through Remote Desktop Services" right is restricted, though typically administrators are included by default.
The core issue arises when organizations want to provide remote access to standard users without granting them full administrative control over the operating system. Granting admin rights allows users to install software, change system settings, and potentially compromise system stability. Therefore, isolating RDP permissions to the specific local group is the recommended security practice.
Configuring the Remote Desktop Users Group
The most direct method to solve this problem involves manually managing the local groups via the Computer Management console. This process ensures that specific non-administrator accounts are granted the necessary authentication tokens to establish a remote connection.
- Open Computer Management: Press
Win + Xand select "Computer Management" from the context menu, or search for it in the Start menu. - Navigate to Local Users and Groups: In the left pane, expand "System Tools," then "Local Users and Groups," and finally click on "Groups."
- Edit the RDP Group: Locate the group named "Remote Desktop Users" in the middle pane. Right-click it and select "Add to Group."
- Select the User: Click "Add," type the username of the standard user you wish to grant access to, and verify the name resolves correctly. Click "OK" to save changes.
Once the user is added to this group, they can initiate an RDP session using their standard credentials. They will not receive a UAC prompt asking for elevation upon login, nor will they have administrative rights within the session unless specifically elevated later. For more details on troubleshooting connectivity issues after making these changes, you might find our guide on Remote Desktop Disconnects Randomly on One Machine helpful if connections fail to stabilize.
Enabling Remote Desktop via System Settings
Before permissions matter, the feature itself must be active. On modern versions of Windows 10 and 11, Remote Desktop is often disabled by default for security reasons. You can enable it through the System Properties dialog.
Right-click the Start button and select "System." Under the "Remote Desktop" section, toggle the switch to "On." Alternatively, you can press Win + R, type sysdm.cpl, and press Enter. Navigate to the "Remote" tab and check the box labeled "Allow remote connections to this computer." Ensure that "Allow connections only from computers running Remote Desktop with Network Level Authentication" is checked for enhanced security. NLA requires the user to authenticate before a full desktop session is established, which protects against certain types of network-based attacks.
Group Policy Configuration for Domain Environments
In corporate environments managed by Active Directory, local group modifications may be overwritten by domain policies. To enforce RDP access for non-administrators across multiple machines, use Group Policy Objects (GPO).
Open the Group Policy Management Console and edit the relevant GPO linked to your target computers. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment. Look for the policy "Allow log on through Remote Desktop Services." Add the desired user group (e.g., "Domain Users" or a custom security group) to this list. This overrides the local machine's default restrictions and ensures consistent access control across the fleet.
If you are experiencing connectivity issues specifically related to network routing or VPN interference after configuring these permissions, refer to our article on Troubleshooting RDC through VPN Not Working on a Specific Windows Computer.
Verifying Access and Troubleshooting
After applying these changes, test the configuration by attempting to connect from a client machine using mstsc.exe. Enter the IP address or hostname of the target machine and log in with the standard user credentials. If the connection is refused, verify that the Windows Firewall is allowing inbound traffic on TCP port 3389. You can check this by running netsh advfirewall firewall show rule name="Remote Desktop" in an elevated command prompt.
Additionally, ensure that the user account has a password set. Blank passwords are generally rejected by RDP for security reasons. If you need to adjust display quality or audio redirection settings to improve performance for these users, consider reviewing best practices for Seamless RDP Experience with Hyper-V Enhanced Session and Mouselag if virtualization is involved.
Frequently Asked Questions
Why can't I add a user to the Remote Desktop Users group?
This usually occurs if you are using a Microsoft Account instead of a local account, or if Group Policy restrictions prevent local group modifications. Switch to a local account or ensure your domain GPO does not restrict local group management. Verify that you are running the Computer Management tool with administrative privileges.
Does adding a user to Remote Desktop Users give them admin rights?
No, membership in the "Remote Desktop Users" group only grants the ability to log in remotely. It does not confer administrative privileges such as installing software or changing system configurations. The user will still be subject to standard user restrictions unless explicitly granted additional rights.
How do I disable Network Level Authentication (NLA) for RDP?
You can disable NLA by opening System Properties (sysdm.cpl), going to the Remote tab, and unchecking "Allow connections only from computers running Remote Desktop with Network Level Authentication." However, this reduces security and is not recommended for public-facing connections.
Can I use PowerShell to add users to the Remote Desktop Users group?
Yes, you can use the Add-LocalGroupMember cmdlet. Run the command Add-LocalGroupMember -Group "Remote Desktop Users" -Member "Username" in an elevated PowerShell window. This provides a scriptable alternative to using the GUI for bulk user provisioning.
What happens if I remove a user from the Remote Desktop Users group?
The user will immediately lose the ability to initiate new RDP sessions. Existing sessions may remain active depending on the timeout settings, but they will be disconnected once the current session ends. Re-adding the user restores access immediately.