How To Enable Remote Desktop Via Group Policy Objects (GPO)
Teams responsible for supporting physically distant computers and users need to use a tool that enables them to exercise remote access and control over a network. Microsoft’s Remote Desktop is a popular solution for accessing computers anywhere in the world.
In this article, we will look at how to enable Remote Desktop Group Policy on Windows 10 systems so it can be applied to all connected machines at a remote site.
Enable Remote Desktop via Group Policy
The first obstacle to overcome when setting up a Group Policy for Remote Desktop is obtaining the necessary permissions that enable you to modify a Group Policy Object (GPO). Getting these permissions is beyond the scope of this article, and we will presume that you have worked with your system administrators and have the necessary level of access.
How to create a firewall rule via Group Policy
-
Open the Group Policy Management Console (GPMC).
- Create a new Group Policy Object called Enable Remote Desktop.
-
Navigate through the following settings so you can create a new rule:
Computer Configuration -> Windows Settings -> Security Settings -> Windows Firewall with Advanced Security -> Windows Firewall with Advanced Security -> Inbound RulesNow choose to Create a New Rule. The screenshot below shows you where you should be in the Windows configuration screens.
- In the New Inbound Rule Wizard, select the Port parameter.
-
Make sure TCP is selected and the Specific local port parameter is set at 3389.
- Click Next and allow the Connection. Limit the connection to Domain and Private Profiles.
- Give the rule a meaningful name like – Inbound Rule for RDP Port 3389.
How to enable Remote Desktop Session Host policies
Once the local ports have been added, further Remote Desktop group policy settings need to be updated to enable the required Remote Desktop Session Host policies.
- Go to:
Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Connections - Enable the setting to Allow users to connect remotely by using Remote Desktop Services.
- Before we finish modifying Group Policy to allow Remote Desktop, we are going to enable Network Level Authentication. While this is not a necessary part of enabling RDP Group Policy, it is highly recommended as it provides enhanced security for your remote sessions.
- Navigate to:
Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Security. - Enable the Require user authentication for remote connections by using Network Level Authentication setting.
- The last step and arguably the most important is to apply the Group Policy Object we just created to an Organizational Unit. Without this step, the policy will exist but not be used for accessing any remote machines.
- Close the GPMC as you are finished. No more settings need to be modified to implement Remote Desktop using a Group Policy.