> For the complete documentation index, see [llms.txt](https://security-notes.gitbook.io/security-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://security-notes.gitbook.io/security-notes/active-directory/enable-rdp.md).

# Enable RDP

## Enable RDP

Check the status of the deny connection flags

```
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections
```

If not present or set to 1 use the following command to change the key value to 0. This will also open the default RDP port (3389) and start the service.

```
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
```

Configure firewall

```
netsh firewall add portopening TCP 3389 "Remote Desktop"
```

If during connection the following error appears: "Account Restrictions are preventing this user from signing in." enable restricted admin mode on the server

```
reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f
```

## Enable RDP for users <a href="#enable-rdp-for-users" id="enable-rdp-for-users"></a>

**CMD**

```
net localgroup "Remote Desktop Users" <user> /add
net localgroup "Administrators" "<user>" /add #not necessary
```

**PS**

```
Add-LocalGroupMember -Group "Remote Desktop Users" -Member "<user>"
Add-LocalGroupMember -Group "Administrators" -Member "<user>" #not necessary
```