How To Enable Remote Desktop Via Group Policy Objects (GPO)
How to Use Group Policy to Create a Firewall Rule
The following list of essential points outlines the steps necessary to update the Remote Desktop Group Policy to allow remote control to be implemented on the associated computers.
-
Open the Group Policy Management Console (GPMC).
-
Create a new Group Policy Object called Enable Remote Desktop.
-
Navigate through the following settings so you can create a new rule:
Computer Configuration -> Windows Settings -> Security Settings -> Windows Firewall with Advanced Security -> Windows Firewall with Advanced Security -> Inbound RulesNow choose to Create a New Rule. The screenshot below shows you where you should be in the Windows configuration screens.
-
In the New Inbound Rule Wizard, select the Port parameter.
-
Make sure TCP is selected and the Specific local port parameter is set at 3389.
-
Click Next and allow the Connection. Limit the connection to Domain and Private Profiles.
-
Give the rule a meaningful name like – Inbound Rule for RDP Port 3389.
1. Open Group Policy Editor: Press Windows + R, type gpedit.msc, and press Enter.
2. Expand: Computer Configuration → Policies.
3. Navigate to: Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Security.
4. Locate “Require user authentication for remote connections by using NLA” and ensure it is set to Enabled.
-
Go to:
Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Connections -
Enable the setting to Allow users to connect remotely by using Remote Desktop Services.
-
Before we finish modifying Group Policy to allow Remote Desktop, we are going to enable Network Level Authentication. While this is not a necessary part of enabling RDP Group Policy, it is highly recommended as it provides enhanced security for your remote sessions.
-
Navigate to:
Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Security. -
Enable the Require user authentication for remote connections by using Network Level Authentication setting.
-
The last step and arguably the most important is to apply the Group Policy Object we just created to an Organizational Unit. Without this step, the policy will exist but not be used for accessing any remote machines.
-
Close the GPMC as you are finished. No more settings need to be modified to implement Remote Desktop using a Group Policy.