Home Windows To Sign In Remotely You Need the Right to Sign In Through Remote Desktop Services
Windows

To Sign In Remotely You Need the Right to Sign In Through Remote Desktop Services

written by Cyril Kardashevsky

So you’ve deployed a new server, but your staff is complaining that they cannot access it remotely because of the following errors:

To sign in remotely, you need the right to sign in through Remote Desktop Services. By default, members of the Administrators group have this right, or if the right has been removed from the Administrators group, you need to be granted this right manually.

to sign in remotely you need the right to sign in through remote desktop services

If the Network Level Authentication (NLA) is enabled on the remote machine, users will get this error instead:

The connection was denied because the user account is not authorized for remote login.

to sign in remotely you need the right

Both these errors clearly state the problem—The user is not authorized to log in to the Remote Desktop Services.

So who’s authorized to log in through Remote Desktop Services by default?

  • The members of the Administrators and Remote Desktop Users groups on servers and workstations.
  • The members of the Administrators group on domain controllers.
  • If configured, the users or groups added to the Allow the log on through Remote Desktop Services user rights assignment policy in a Group Policy Object (GPO)
  • User groups added to the Remote Desktop Services Collection.

This post will show how to allow individual users or group members the privilege to log in remotely on Windows computers.

Adding Users to the Remote Desktop Users Group

Every server, workstation, and domain controller has a built-in group called Remote Desktop Users. The members of this group are allowed to log in to the computer through the Remote Desktop Services.

Related post. How to Enable Remote Desktop (RDP) Remotely?

Using the Local Users and Groups Console on Servers and Workstations

  1. Open the Local Users and Groups console by running this command: 
    lusrmgr.msc

    to sign in remotely you need

  2. Click Groups, right-click the “Remote Desktop Users” group, and click “Add to Group…”
    to sign in remotely you need the right to sign in through remote desktop services by default members
  3. Click Add, specify the users or groups to add as members, and click OK and OK.
    how to fix to sign in remotely you need the right to sign in through remote desktop services

Using the Add-LocalGroupMember PowerShell Cmdlet on Servers and Workstations

  1. Open an elevated PowerShell session (run as admin).
  2. Run this command to list the current members of the Remote Desktop Users group. 
    Get-LocalGroupMember -Group 'Remote Desktop Users'

    The screenshot below shows that the Remote Desktop Users group is empty.
    to sign in remotely, you need the right to sign in through remote desktop services

  3. Now, let’s put all users and groups to add as members in an array. In this example, I’m adding one group and one user: 
    $rdsMembers = @(

'theitbros\dtaylor',

'theitbros\ca server admins'

)
  4. Run the Add-LocalGroupMember cmdlet to add the $rdsMembers to the Remote Desktop Users group. 
    Add-LocalGroupMember -Group 'Remote Desktop Users' -Member $rdsMembers

    This command does not return anything on the screen, which means the operation is successful.
    to sign in remotely you need the right to sign in through remote desktop services. by default

  5. Lastly, confirm that the new members are added to the Remote Desktop Users group. 
    Get-LocalGroupMember -Group 'Remote Desktop Users'

    you need the right to sign in through remote desktop services

Using the Active Directory Users and Computers on Domain Controllers

  1. On the domain controller, open the Active Directory Users and Computers console by running the dsa.msc command.
    Related post. Installing Active Directory Users and Computers Snap-in (ADUC) on Windows 11/10
  2. Select the “Builtin” container and double-click the “Remote Desktop Users” group.
    to sign remotely you need the right
  3. Switch to the Members tab, click Add, specify the groups and users to add, and click OK.
    to sing in remotely you need the right to sign in through remote desktop services
  4. Once the users and groups are added, click OK.
    hyper-v to sign in remotely you need

Using the Add-ADGroupMember PowerShell Cmdlet on Domain Controllers

  1. Open PowerShell on the domain controller.
  2. Import the Active Directory PowerShell module: 
    Import-Module ActiveDirectory

    Related. How to Install and Import PowerShell Active Directory Module?

  3. Run the following commands to add new members to the Remote Desktop Users group. Replace the values in the $rdsMembers array with your groups and users. 
    $rdsMembers = @(

'ebrown',

'FL Server Admins'

)Add-ADGroupMember -Identity 'Remote Desktop Users' -Members $rdsMembers

    to sign in remotely

  4. Confirm the new members by listing them: 
    Get-ADGroupMember -Identity 'Remote Desktop Users'

    to sign in remotely you need the right to sign in through

Granting Allow Log On Through Remote Desktop Services via GPO

For more centralized management, you can also allow users to connect to Remote Desktop Services using the Allow Log On Through Remote Desktop Services policy.

Related post. Managing “Logon As a Service” Permissions Using Group Policy or PowerShell

Configure the Allow Log On Through Remote Desktop Services Policy

  1. Run the gpedit.msc command on the domain controller.
    to sign in remotely you need the right through remote desktop services
  2. Edit an existing GPO or create a new one. In this example, we’ll edit the Default Domain Policy and Default Domain Controllers Policy.
    to sign in remotely you need the right to sign in through remote desktop services domain controller
  3. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Local policies → User Rights Assignment.
  4. Double-click the “Allow log on through Remote Desktop Services” policy.
    you need the right to sign in remotely
  5. Check the “Define these policy settings” box, click “Add User or Group…”, specify the users and groups to add, and click OK.
    to sign in remotely you need the right to sign in through remote desktop services intune
  6. Ensure that the “Deny log on through Remote Desktop Services” policy does not contain the same users or groups because this policy takes precedence.
    to sign in remotely, you need the right to sign in through remote desktop services.

Confirm the Policy Results

  1. Log in to a server or workstation.
  2. Open a CMD or PowerShell window.
  3. Run the gpupdate /force command to force the policy update.
    sign in through remote desktop services
  4. Run a group policy result HTML report: 
    GPResult /h gp_report.html /f
  5. Once the report is done, open it and confirm that the “Allow log on through Terminal Services” policy is configured.
    to sign in remotely, you need the rightOn domain controllers, the policy result will look like this:
    to sign in remotely you need the right to sign in through remote desktop

Allowing Users and Groups to the Remote Desktop Services Collection

If you’re logging in remotely to a Windows Server that’s part of a Remote Desktop Services Collection, you may get the following error, and your log-in fails.

to sign in remotely you need right to sign in through remote desktop services

This could happen if your user account or group is not listed in the RDS collection, and here’s how to fix this.

Using the Remote Desktop Services in Server Manager (GUI)

  1. Open the Server Manager on another server that lets you log in.
  2. Right-click on Servers and click Add Servers.
    allow logon through remote desktop services
  3. Add your RDS servers and click OK.
    right to sign in through remote desktop services
  4. Click Remote Desktop Services, select the RDS collection, and click Tasks → Edit Properties.
    right to sign in remote desktop services
  5. Click Add, specify the users or groups to allow, and click OK and OK.
    allow log on through remote desktop services powershell

Using the PowerShell RemoteDesktop Module

  1. Open PowerShell and run the following command to retrieve the RDS collection names. 
    # If running on the server with an RDS role

Get-RDSessionCollection# If running on the server without an RDS role

Get-RDSessionCollection -ConnectionBroker <RDS Server FQDN>

    In this example, there is only one RDS Collection.
    the sign in remotely you need

  2. Next, back up the current users and groups who are allowed to RDP into the RDS collection. 
    $rdsUserGroup = Get-RDSessionCollectionConfiguration -CollectionName <RDS Collection Name> -ConnectionBroker <RDS Server FQDN> -UserGroup

$rdsUserGroup.UserGroup

    As you can see, this RDS collection has two entries in the UserGroup property.
    to sign in remotely you need the right to remote desktop services

  3. Next, let’s combine the new and current user and group lists. In this example, we’re adding three new entries. 
    $newRdsUserGroup = $rdsUserGroup.UserGroup + @(

"THEITBROS\FL Server Admins",

"THEITBROS\LND Server Admins",

"THEITBROS\janderson"

)
  4. To add new users and groups who will be allowed to RDP into the RDS collection, run this command. Make sure to replace the collection name and specify the correct users and groups. 
    Set-RDSessionCollectionConfiguration -CollectionName "<RDS Collection Name>" -UserGroup $newRdsUserGroup -ConnectionBroker "<RDS Server FQDN>"

    The command does not return any result if the operation is successful.
    allow log on through remote desktop services

  5. Re-run the commands in Step 2 to list the new RDS collection users and groups.
    to sign in remotely you need the right to sign in

Disabling Enhanced Session Mode on Hyper-V Virtual Machines

Suppose you’re getting the “To sign in remotely, you need the right to sign in through Remote Desktop Services” error when connecting to a VM inside the Hyper-V Manager, you can use the previous methods in this post to troubleshoot.

the connection was denied because the user account is not authorized for remote login

This situation doesn’t happen if you’re connecting to the VM using the native Hyper-V bus. But when the Enhanced Session Mode is enabled, the VM’s connection is made through the Remote Desktop Services instead.

  • Connecting via Basic Mode = Using the native Hyper-V bus.
  • Connecting via Enhanced Session Mode = Using the Remote Desktop Services.

To disable the Enhanced Session Mode, click View and uncheck the Enhanced Session menu item.

local security policy allow logon through remote desktop services

Or click the Basic Session toolbar button.

remote desktop services local security policy

And once you’re logged in, you can perform the previous methods we discussed in this post. Once you’ve remedied the source of the “To sign in remotely, you need the right to sign in through Remote Desktop Services” error, it’s up to you to re-enable the Enhanced Session Mode or not.

Conclusion

We’ve learned the different ways to solve the “To sign in remotely, you need the right to sign in through Remote Desktop Services” error when remotely accessing Windows computers via RDP.

This post doesn’t aim to cover every possible cause of the error. Rather, provides you with the usual starting points for troubleshooting.

kardashevsky cyril

I enjoy technology and developing websites. Since 2012 I'm running a few of my own websites, and share useful content on gadgets, PC administration and website promotion.