How to Enable Remote Desktop (RDP) Remotely on Windows

7K

If you need to connect to the desktop of a remote computer, you can remotely enable Remote Desktop Protocol (RDP) and grant yourself access permissions. In this guide, we’ll look at several ways to remotely enable Remote Desktop on a Windows machine using Remote Registry, Command Prompt, PsExec, CIM, and PowerShell.

Security warning. Remote Desktop should not be exposed directly to the Internet. You should use VPN, RD Gateway, Conditional Access, firewall restrictions, or other access controls to limit RDP access.

Security best practice. Note that changing the default RDP port (3389) is generally not considered a strong security measure. Modern network scanners can easily discover Remote Desktop services running on non-standard ports. Instead, you should rely on network segmentation, Windows Defender Firewall rules, VPN access, RD Gateway, Conditional Access policies, and multi-factor authentication in order to restrict access to Remote Desktop services.

Enable RDP via Remote Registry and CMD

Note. This guide enables Remote Desktop access on existing Windows installations. Keep in mind that it does not install the Remote Desktop Services (RDS) role used for Remote Desktop Session Host deployments.

By default, Remote Desktop is disabled in Windows using the fDenyTSConnections registry parameter. You can manually change the value of this setting from 1 to 0 to enable RDP on the computer. Although Remote Registry can be used to enable RDP remotely, in modern enterprise environments you should prefer PowerShell Remoting, CIM, Microsoft Intune, or other centralized management tools.

To connect to the registry on a remote computer, you need to enable the Remote Registry service on it (which is stopped by default). To start this service remotely, open a command prompt and run:

sc \\wks11 config RemoteRegistry start= demand

sc \\wks11 start RemoteRegistry

Note. File and printer sharing must be enabled on the remote computer for successful connection.

Security note. Remote Registry is disabled by default on most modern Windows deployments and is often restricted by security baselines. In case you enable the service temporarily for troubleshooting/admin tasks, you should consider stopping and disabling it again after completing your work.

Connect to the remote computer’s registry over the network

Once the Remote Registry service is enabled, you can connect to the remote computer’s registry over the network.

1. Open the Registry Editor: press the Win + R and type regedit.exe > OK;
   
2. Select File > Connect Network Registry;
   
3. Type the DNS name or IP address of the remote computer. Enter the administrator credentials for the remote computer if prompted;
   
4. Navigate to the following reg key on the remote computer: HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server. Change the value of the fDenyTSConnections parameter (Type=REG_DWORD) from 1 to 0;

You can change this registry option on remote computer using the command:

reg add "\\wks11\HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

Now you need to enable Windows Defender Firewall rules that allow Remote Desktop connections (TCP port 3389). If PowerShell remoting is enabled on the remote computer, use the following command:

Invoke-Command -ComputerName wks11 -ScriptBlock {
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
}

Check that port 3389 is now open on the remote machine:

Test-NetConnection wks11 -Port 3389

If the command returns True, you can connect to Remote Desktop.

Use PsExec to Enable RDP on a Remote Computer

Note. PsExec remains a widely used admin tool, but many enterprise security solutions monitor/restrict its use because it is frequently abused during lateral movement attacks. In environments protected by Microsoft Defender for Endpoint, CrowdStrike, SentinelOne, or similar EDR platforms, PsExec activity may generate security alerts or be blocked by policy. If available, you should prefer PowerShell Remoting (WinRM), Intune, or other approved remote management tools.

You can use the PsExec cmd tool to enable RDP on a remote Windows device.

1. Download the PsExec from the Microsoft website and extract the PSTools.zip to a local folder;
2. Open a command prompt as an administrator and go to the PSTools directory:

   CD c:\PS\PStools

3. Run the following command to change the fDenyTSConnections value (this will enable RDP):

   PsExec.exe /accepteula \\RemoteComputerName_or_IP reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

4. Then open the RDP port in Windows Defender Firewall:

   PsExec.exe /accepteula \\RemoteComputerName_or_IP powershell Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

   If the remote computer is in a different domain or workgroup, you can provide a username to connect to the remote computer:

   PsExec.exe /accepteula \\RemoteComputerName_or_IP -u administrator reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

   

5. Then allow inbound connections to the RDP port (3389/TCP):

   PsExec.exe /accepteula \\RemoteComputerName_or_IP -u administrator netsh advfirewall firewall set rule group="remote desktop" new enable=Yes

Note. PowerShell firewall cmdlets such as Enable-NetFirewallRule are generally preferred on modern Windows versions, although netsh remains supported and you can use it.

Enable Remote Desktop Using PowerShell

You can also enable Remote Desktop on a remote computer using PowerShell. This requires the WinRM computer (Windows Remote Management) service to be enabled and configured on the remote.

Check that WinRM is enabled on the remote computer and that PSRemoting connections are allowed. Run the command:

Test-WsMan wks11

This response means that the WinRM service is configured on the remote computer, and you can proceed.

Open the PowerShell console and use the following command to interactively connect to the remote host:

Enter-PSSession -ComputerName server.domain.local -Credential domain\admin1

Then run the following PowerShell commands to enable RDP and required firewall rules:

Set-ItemProperty `
-Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' `
-Name 'fDenyTSConnections' `
-Value 0

Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

Network Level Authentication (NLA) is enabled by default on modern Windows versions and you should generally keep it enabled. If you need to verify/re-enable NLA on a machine where it has been disabled, use the following command:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "UserAuthentication" -Value 1

Note. NLA is considered a baseline security requirement for Remote Desktop and helps you to protect systems from unauthenticated connection attempts. We generally don’t recommend disabling NLA except for temporary compatibility troubleshooting with legacy clients.

Hint. If you need to enable RDP on several remote computers at once, you can use the following PowerShell script:

$comps = "Server1", "Server2", "Server3", "Server4"

Invoke-Command -Computername $comps -ScriptBlock {Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Value 0}

Invoke-Command -Computername $comps -ScriptBlock {Enable-NetFirewallRule -DisplayGroup "Remote Desktop"}

Change RD Users group membership remotely

By default, only members of the local Administrators group can connect via the RDP remotely. To allow RDP connections for non-admin users, just add domain user to Remote Desktop Group.

You can change RD Users group membership remotely using the Enter-PSSession. Use the following command to add the domain user ASmith to the local group:

net localgroup "Remote Desktop Users" "contoso\asmith" /add

Or you can use the Invoke-Command cmdlet instead of the Enter-PSSession interactive cmdlet:

Invoke-Command -Scriptblock {net localgroup "Remote Desktop Users" "contoso\asmith" /add} -Computer Server1.contoso.com

Tip. The Enter-PSSession and Invoke-Command cmdlets allow you to run PowerShell script on remote computer through WinRM.

How to Enable Remote Desktop Remotely via CIM and PowerShell

If interactive PowerShell remoting is not available, you can use CIM cmdlets or legacy WMI/DCOM-based management interfaces to remotely enable RDP. By default, CIM cmdlets use WSMan for remote communication. In environments where WSMan is unavailable, you can config CIM sessions to use DCOM.

Note. Modern Windows environments may restrict/harden DCOM communications due to Microsoft’s DCOM security updates. As a result, remote CIM/WMI operations that rely on DCOM may require additional config, elevated permissions, or firewall changes. When possible, you should prefer PowerShell Remoting (WinRM) as a remote management method.

To check if RDP access is enabled on the remote computer 192.168.1.90, run the command (see the value of the AllowTSConnections property):

Get-CimInstance `
-ClassName Win32_TerminalServiceSetting `
-Namespace root/CIMV2/TerminalServices `
-ComputerName 192.168.1.90

To enable RDP and add a Windows Firewall exception rule, run the following command:

Invoke-CimMethod `
-ComputerName 192.168.1.90 `
-Namespace root/CIMV2/TerminalServices `
-ClassName Win32_TerminalServiceSetting `
-MethodName SetAllowTSConnections `
-Arguments @{
AllowTSConnections = 1
ModifyFirewallException = 1
}

You can verify if Remote Desktop has been enabled by checking the value of the AllowTSConnections property. A value of 1 indicates that Remote Desktop is enabled, while 0 means it is disabled:

(Get-CimInstance `
-ClassName Win32_TerminalServiceSetting `
-Namespace root/CIMV2/TerminalServices `
-ComputerName 192.168.1.90).AllowTSConnections

Tip. In order to access the WMI namespace on the remote machine, TCP port 135 must be open, and the account must have WMI and DCOM permissions. In hardened environments, additional DCOM security restrictions/authentication requirements may prevent remote access even when the required ports are available.

Enable Remote Desktop with Group Policy

In AD environments, Group Policy is usually the preferred way to enable Remote Desktop on multiple machines. Instead of connecting to each device individually, you can centrally config Remote Desktop settings and firewall rules through a GPO. Follow the steps below:

1. Open the Group Policy Management Console (GPMC).
2. Create a new GPO or edit an existing one linked to the target OU.
3. Navigate to Computer Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections
4. Enable the policy Allow users to connect remotely by using Remote Desktop Services
5. To automatically allow RDP traffic through Windows Firewall, configure the predefined Remote Desktop inbound firewall rules or use Computer Configuration > Policies > Windows Settings > Security Settings > Windows Defender Firewall.
6. Now run gpupdate /force or wait for normal Group Policy refresh.

Note. Group Policy is generally the preferred method for enabling Remote Desktop across multiple domain-joined machines because it provides centralized management, auditing, and consistent config.

Enable Remote Desktop with Microsoft Intune

In case your organization manages devices with Microsoft Intune, you can enable Remote Desktop without using PowerShell, WMI, or registry changes. Follow the steps below:

1. Open the Microsoft Intune admin center.
2. Go to Devices > Configuration Profiles.
3. Create/edit a Windows Settings Catalog profile. In the Settings Catalog, you need to add the following settings:
   Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections > Allow users to connect remotely by using Remote Desktop Services (you need to set this policy to Enabled).
   Administrative Templates > Network > Network Connections > Windows Defender Firewall > Domain Profile > Windows Firewall: Allow inbound Remote Desktop exceptions (enable this setting if you also need to config the Windows Firewall rules through Intune).

When deploying Remote Desktop settings through Intune, you need to make sure the profile is assigned to the correct device groups. If multiple config profiles define conflicting Remote Desktop settings, Intune conflict resolution rules apply and you should verify the resulting config in the device policy reports.

After the policy is applied, Remote Desktop will be enabled automatically on the managed devices.

Note. In enterprise environments, you can use Microsoft Entra ID groups in order to scope Remote Desktop policies to specific device collections. Before broad deployment, you should review policy assignments, exclusions, and potential conflicts with other security baselines/endpoint hardening policies.

You can verify the result by checking the RDP status locally or remotely using PowerShell command:

Get-ItemProperty `
-Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' `
-Name fDenyTSConnections

Modern Enterprise Alternatives

In modern hybrid and cloud-managed environments, you can use management platforms instead of directly enabling RDP through registry changes, PowerShell, or WMI.

Here are the common alternatives:

• Windows Admin Center for centralized server and Windows device management;
• Microsoft Intune for policy-based Remote Desktop config;
• Azure Bastion for secure remote access to Azure virtual machines without exposing RDP ports to the Internet;
• Microsoft Entra ID-joined devices with Conditional Access policies for identity-based access control;
• RDP Shortpath in Azure Virtual Desktop deployments to improve RDP connectivity and performance.

These solutions can provide better security, auditing, and centralized management compared to traditional RDP admin methods.

Note. Intune-based config is commonly used in enterprise environments to enforce Remote Desktop settings consistently across large numbers of Windows devices.