Manually Grant RDP Access to an Active Directory User

To grant Remote Desktop Protocol (RDP) access to an Active Directory (AD) user on a domain server for Windows servers, follow these steps:

Step 1: Add the User to the Remote Desktop Users Group

1. Open the Server: Log in to the Windows server where you want to grant RDP access.
2. Open Computer Management:
   • Right-click on This PC or Computer on the desktop or in File Explorer.
   • Select Manage to open the Computer Management console.
3. Navigate to Local Users and Groups:
   • Expand Local Users and Groups.
   • Click on Groups.
4. Edit Remote Desktop Users Group:
   • Double-click on the Remote Desktop Users group.
   • Click Add to open the "Select Users" dialog.
5. Add the AD User:
   • In the "Select Users" dialog, click on Locations and choose your domain to ensure you are searching in the right location.
   • Enter the AD username of the user you want to add.
   • Click Check Names to verify the user.
   • Click OK to add the user.
   • Click OK again to close the properties window.

Step 2: Configure RDP Settings in Group Policy (Optional)

If you need to configure RDP access for multiple users or servers, you can use Group Policy:

1. Open Group Policy Management:
   • Open the Start menu, type gpmc.msc, and press Enter to open the Group Policy Management Console.
2. Create or Edit a GPO:
   • Locate an existing GPO or create a new one by right-clicking on your domain or an organizational unit (OU) and selecting Create a GPO in this domain, and Link it here....
3. Edit the GPO:
   • Right-click on the GPO and select Edit.
4. Navigate to RDP Settings:
   • In the Group Policy Management Editor, go to Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Connections.
5. Enable RDP and Specify Users:
   • Enable the policy Allow users to connect remotely using Remote Desktop Services.
   • In Remote Desktop Session Host -> Security, enable Require user authentication for remote connections by using Network Level Authentication.
   • In Remote Desktop Session Host -> Remote Session Environment, enable Allow users to connect remotely using Remote Desktop Services.

Step 3: Ensure Network Level Authentication (NLA) is Enabled

1. Open System Properties:
   • Right-click on This PC or Computer and select Properties.
2. Remote Settings:
   • Click on Remote settings on the left.
3. Allow Remote Connections:
   • In the Remote Desktop section, ensure that Allow remote connections to this computer is selected.
   • Ensure that Allow connections only from computers running Remote Desktop with Network Level Authentication (recommended) is checked.

Step 4: Configure Firewall Settings

1. Open Windows Defender Firewall:
   • Open the Control Panel and navigate to System and Security -> Windows Defender Firewall.
2. Allow RDP Through Firewall:
   • Click on Allow an app or feature through Windows Defender Firewall.
   • Ensure Remote Desktop is checked for both Private and Public networks.

Step 5: Verify Access

1. Test RDP Access:
   • From a remote computer, open the Remote Desktop Connection client (mstsc).
   • Enter the server's hostname or IP address and click Connect.
   • Log in using the AD credentials of the user you added to the Remote Desktop Users group.

By following these steps, you can grant RDP access to an AD user on a domain server.