Group Policy | Enable Remote Desktop on PC's | Select allowed users.

Question

Hello,

We are running a Windows Server 2016 | Domain.

Using Group Policy, I need to accomplish the following:

1. Enable Remote Desktop access on an Organizational Unit containing multiple computers.
2. Allow Remote Desktop Access for a select Security Group for these computers.

Can you please furnish the settings for the required Group Policies.

Thanks in advance.

Regards,

Rudy

Answer 1

To accomplish your requirements using Group Policy on a Windows Server 2016 domain, you'll need to configure two separate Group Policy settings:

Enable Remote Desktop Access:

• This setting will enable Remote Desktop on the computers within the specified Organizational Unit (OU).

Allow Remote Desktop Access for a Select Security Group:

  - This setting will allow members of the specified security group to connect via Remote Desktop to the computers within the OU.
  

Here's how to configure these settings:

1. Enable Remote Desktop Access:
2. Open Group Policy Management Console (GPMC) on your domain controller.
3. Create a new Group Policy Object (GPO) or edit an existing one linked to the OU containing the computers where you want to enable Remote Desktop.
4. Navigate to: Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Connections.
5. Double-click on the "Allow users to connect remotely using Remote Desktop Services" policy.
6. Select the "Enabled" option, and then click "OK" to save the changes.
7. Close the Group Policy Management Editor.
8. Allow Remote Desktop Access for a Select Security Group:
9. Still within the same Group Policy Object (GPO) as above, navigate to: Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Restricted Groups.
10. Right-click on "Restricted Groups" and choose "Add Group."
11. In the "Group" field, type the name of the security group you want to grant Remote Desktop access to, and then click "OK."
12. In the "This group is a member of" section, click "Add" and specify the group "Remote Desktop Users." This is the built-in group that grants Remote Desktop access.
13. Click "OK" to close the dialog.
14. Close the Group Policy Management Editor.

Apply the Group Policy:

1. Link the Group Policy Object (GPO) you configured to the Organizational Unit (OU) containing the target computers.
2. Optionally, force a Group Policy update on the target computers using the gpupdate /force command or wait for the next refresh interval.To accomplish your requirements using Group Policy on a Windows Server 2016 domain, you'll need to configure two separate Group Policy settings:
   1. Enable Remote Desktop Access:
      • This setting will enable Remote Desktop on the computers within the specified Organizational Unit (OU).
   2. Allow Remote Desktop Access for a Select Security Group:
      • This setting will allow members of the specified security group to connect via Remote Desktop to the computers within the OU.
   Here's how to configure these settings:
   1. Enable Remote Desktop Access:
   2. Open Group Policy Management Console (GPMC) on your domain controller.
   3. Create a new Group Policy Object (GPO) or edit an existing one linked to the OU containing the computers where you want to enable Remote Desktop.
   4. Navigate to: Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Connections.
   5. Double-click on the "Allow users to connect remotely using Remote Desktop Services" policy.
   6. Select the "Enabled" option, and then click "OK" to save the changes.
   7. Close the Group Policy Management Editor.
   8. Allow Remote Desktop Access for a Select Security Group:
   9. Still within the same Group Policy Object (GPO) as above, navigate to: Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Restricted Groups.
   10. Right-click on "Restricted Groups" and choose "Add Group."
   11. In the "Group" field, type the name of the security group you want to grant Remote Desktop access to, and then click "OK."
   12. In the "This group is a member of" section, click "Add" and specify the group "Remote Desktop Users." This is the built-in group that grants Remote Desktop access.
   13. Click "OK" to close the dialog.
   14. Close the Group Policy Management Editor.
   Apply the Group Policy:
   1. Link the Group Policy Object (GPO) you configured to the Organizational Unit (OU) containing the target computers.
   2. Optionally, force a Group Policy update on the target computers using the gpupdate /force command or wait for the next refresh interval.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Answer 2

I have a Windows 2025 domain, following the steps, the switch to turn RDP off/on on endpoints and servers gets greyed out but RDP is set to off. Any idea why? This should have been a simple change.