How to Add User to Remote Desktop Group?

In this blog post, we will discuss how to add Active Directory users to the remote desktop users group using Group Policy Object (GPO) and PowerShell.

Create a Security Group for RDP Users

Let’s first create a security group that will be added as a member. This way, you can create multiple groups if needed and organize user access more efficiently.

Option 1: Using the Active Directory Users and Computers Console

1. Log in to the domain controller and open the Active Directory Users and Computers (ADUC) console.
   

   

2. Navigate to the Active Directory OU container where you want to create the new security group. In this example, we’ll select the Users OU.
3. Click the New Group button.
4. On the New Object > Group window, type the group name, select the group scope, select Security as the group type, and click OK.
   

   

5. Once the security group is created, you can add the members (users and groups) to it. These members are the intended Remote Desktop Access users.
   

   

6. After adding users and groups as members, click OK to save the changes and close the group properties window.
   

   

Option 2: Using PowerShell

To create the Allow RDP Users group using PowerShell:

1. Log in to the server and open an elevated PowerShell session.
2. Run the following command to create the security group. This command creates the security group named Allow RDP Users inside the Users OU:
   

   New-ADGroup -Name 'Allow RDP Users' -GroupScope Global -Path "OU=Groups,DC=domain,DC=com" 
   
   Get-ADGroup -Identity 'Allow RDP Users'

   Note. In single-domain environments, a Global security group is usually sufficient for managing Remote Desktop access. In larger multi-domain environments, you may want to follow the AGDLP model (Accounts → Global Groups → Domain Local Groups → Permissions) and use Domain Local groups in order to assign resource access.
   
3. Lastly, let’s add a user to the group:
   

   Add-ADGroupMember -Identity 'Allow RDP Users' -Members grant.gabriel 
   
   Get-ADGroupMember -Identity 'Allow RDP Users'

Using Group Policy Preferences (Recommended Method)

While Restricted Groups is a supported and commonly used method, you can also prefer to manage local group membership using Group Policy Preferences (GPP). Unlike Restricted Groups, Group Policy Preferences allows you to add/remove members without replacing the entire group membership.

This method helps you to prevent accidental removal of existing local admins, service accounts, or other users that may already belong to the local group.

To add an AD security group to the local Remote Desktop Users group using Group Policy Preferences, follow the steps below:

1. Open the Group Policy Management Console (GPMC).
2. Create a new GPO or edit an existing one.
3. Go to Computer Configuration → Preferences → Control Panel Settings → Local Users and Groups.
4. Here right-click Local Users and Groups and select New > Local Group.
5. Select Update as the action.
6. Choose Remote Desktop Users (built-in) as the group name.
7. Under Members, click Add.
8. Add your AD security group (for example, Allow RDP Users).
9. Save the policy and allow it to replicate.

After Group Policy refresh, members of the specified AD group will be added to the local Remote Desktop Users group without affecting existing group members.

Note. Unlike Restricted Groups, the Group Policy Preferences method does not enforce an exact group membership list. Existing members remain unchanged unless explicitly modified by the policy.

Add AD Group to the Remote Desktop Users Local Group using GPO

Group Policy Object (GPO) is a powerful tool that allows administrators to manage settings for multiple users and computers in an organization. One of the settings that can be controlled using GPO is the remote desktop users group membership.

We’ll configure the Remote Desktop Users policy item in this example using the GUI.

1. Open the Group Policy Management Console (GPMC) on the domain controller by running the command:
   

   gpmc.msc

2. Right-click the domain and click Create a GPO in this domain, and Link it here.
   Note. You can also create and link the new GPO in a specific OU.
   

   

3. Type Remote Desktop Users Policy as the policy name and click OK.
   

   

4. Right-click the new policy and click Edit.
   

   

5. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings.
6. Right-click on Restricted Groups and click Add Group.
   

   

7. On the Add Group dialog box, type Remote Desktop Users and click OK.
   Note. Do not click Browse. You will not see the Remote Desktop Users in the Active Directory because it is a local group on each computer.
   

   

   Important note. Keep in mind that the Restricted Groups policy enforces the exact membership of the group. It means that any existing members that are not listed in the policy will be deleted from the group after policy refresh.
8. The Remote Desktop Users Properties window opens. Under the Members of this group property, click Add.
9. Browse for the security group you created earlier (Allow RDP Users) and save it as a member of the Remote Desktop Users group.
   

   

   Note. You can also add domain users to the Remote Desktop Group.
10. Click OK on the Remote Desktop Users Properties to save the changes.
    

    

11. Close the Group Policy Editor and the Group Policy Management window.
    

    

12. After the GPO has replicated between DCs, the target machines will apply the policy during their normal Group Policy refresh cycle. On client machines and member servers, this normally occurs every 90 minutes with a random offset of up to 30 minutes. You can apply the policy immediately by running the following command:
    

    gpupdate /force

    Note. Adding users to the Remote Desktop Users group does not enable Remote Desktop itself. You need to ensure that Remote Desktop is enabled on the target machines and that Windows Firewall allows RDP traffic. You can enable Remote Desktop through Group Policy under Computer Configuration → Policies → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Connections → Allow users to connect remotely by using Remote Desktop Services.
13. Verify the group membership:
    Option 1. PowerShell Remoting
    Let’s check on one of the computers if the Allow RDP Users group is now a local Remote Desktop Users group member. If PowerShell Remoting (WinRM) is enabled, connect to the computer using:
    

    Enter-PSSession -ComputerName PC1

    Then run:
    

    Get-LocalGroupMember -Group 'Remote Desktop Users'

    Option 2. Invoke-Command
    Alternatively, you can query the group membership remotely without entering an interactive session:
    

    Invoke-Command -ComputerName PC1 -ScriptBlock {
    Get-LocalGroupMember -Group 'Remote Desktop Users'
    }

    Option 3: Run locally
    You can list the Remote Desktop Users group members on PC1 using the Get-LocalGroupMember cmdlet:
    

    Get-LocalGroupMember -Group 'Remote Desktop Users'

Note. If users are members of the Remote Desktop Users group but still cannot connect through RDP, you need to check Allow log on through Remote Desktop Services user right assignment. You can config this setting through Group Policy under Computer Configuration → Windows Settings → Security Settings → Local Policies → User Rights Assignment.

Also don’t forget to check the Deny log on through Remote Desktop Services policy. In case a user/any group they belong to is included in this policy, the user will be denied RDP access even if they are a member of the Remote Desktop Users group. You should remove the user or group from the Deny log on through Remote Desktop Services policy if appropriate.

That’s it! The policy is now configured.

At this point, all Allow RDP Users security group members can log on through RDP, provided that Remote Desktop is enabled on the target machine, Windows Firewall allows RDP traffic, and the user is allowed to log on through Remote Desktop Services. If a user who isn’t a Remote Desktop Users group member tries to RDP, they will get a message like the one below.

So an administrator has to add the user as a member of the Remote Desktop Users through the Allow RDP Users security group.

Special Considerations for DCs

The methods described above are primarily intended for workstations and member servers. On AD Domain Controllers, Remote Desktop access is handled differently. DCs do not maintain a separate local SAM database, and the Remote Desktop Users group is stored in AD rather than as a local computer group.

If you plan to grant RDP access to DCs, you need to make sure you also review the settings located here Computer Configuration → Windows Settings → Security Settings → Local Policies → User Rights Assignment → Allow log on through Remote Desktop Services.

Note that membership in the Remote Desktop Users group alone may not be sufficient to allow RDP access to a DC if this user right assignment is restricted.

You should always test Domain Controller RDP access carefully and review any GPOs linked to the Domain Controllers OU before modifying Remote Desktop permissions.

Add Users to the Remote Desktop Users Group using PowerShell

You can also add users to Remote Desktop Users using PowerShell using the Add-LocalGroupMember cmdlet.

Run the command below to add a user to the Remote Desktop Group locally on a computer.

Add-LocalGroupMember -Group 'Remote Desktop Users' -Member 'DOMAIN\USERNAME'

To add a user to the Remote Desktop Group locally on a remote computer, you can use PowerShell remoting with Enter-PSSession.

Enter-PSSession -ComputerName <remote_computer> 
Add-LocalGroupMember -Group 'Remote Desktop Users' -Member 'DOMAIN\USERNAME'

Or you can also run the Invoke-Command cmdlet to run the Add-LocalGroupMember command remotely.

Invoke-Command -ComputerName PC1 -ScriptBlock { 
Add-LocalGroupMember -Group 'Remote Desktop Users' -Member 'DOMAIN\USERNAME' 
}

Note. A GPO configured for Remote Desktop Users will automatically overwrite the Remote Desktop Users’ group membership every time the computer updates the group policy. Only use this method if the RDP access is needed temporarily or if no GPO is configured for Remote Desktop Users.

Wrapping up

Managing user access is an important task for system administrators, and adding Active Directory users to the remote desktop users group is just one aspect of this task. By using GPO and PowerShell, administrators can easily manage user access to remote desktops.

By following best practices and regularly reviewing access, you can ensure their environments are secure and only authorized users have access.

For enterprise environments, using an AD security group together with Group Policy Preferences provides you with a scalable and centralized way to manage Remote Desktop access.

gpupdate /force