How to manage Remote Desktop policy and permissions

By default, remote desktop access is only granted to Administrators and only if Remote Desktop is enabled on the target machine. To grant access to other users, or change the users or groups with remote desktop permission follow the steps below.

If permissions aren't properly granted, you may receive one of the error messages outlined in the logon access policy and permission errors topic.

Grant terminal services log on permission

To grant log on permission for a user, perform the following steps:

1. Run gpedit.msc to open the Group Policy editor
2. Navigate to the following location: Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment
3. Double-click the "Allow logon through Terminal Services" item
4. Add the account in question to the list of allowed users

Enable remote desktop for user

To add a user to the remote desktop allowed user list, perform the following steps:

1. Open the System Properties control panel applet
2. Select the Remote tab
3. Click the Select Users button
4. Click the Add button in the dialog that appears
5. Select the user and click the OK button

Enable remote desktop access for a machine

If you have physical access to a machine, you can enable remote desktop access by performing the following steps:

1. Open the System Properties control panel applet
2. Select the Remote tab
3. Select the radio button to enable Remote Desktop

If you don't have physical access, you can follow the steps outlined in the remotely enable Remote Desktop topic.