How to enable RDP on Windows Server: Settings, sconfig and PowerShell

To enable RDP on Windows Server, open Settings → System → Remote Desktop and switch Remote Desktop on, or run two PowerShell commands as Administrator: one sets fDenyTSConnections to 0, the other enables the “Remote Desktop” firewall rules. Then make sure Network Level Authentication is required and that port 3389 answers from your own computer.

# 1. allow Remote Desktop connections
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 0

# 2. open the built-in firewall rules (TCP and UDP 3389)
Enable-NetFirewallRule -DisplayGroup 'Remote Desktop'

# 3. require Network Level Authentication
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 1

A fresh Windows Server installed from Microsoft’s own media has Remote Desktop switched off. Most Windows VPS images ship with it already on, because RDP is the way in; if RDP stopped answering on a VPS, a setting, a policy or a firewall change has probably turned it off, and you need the provider’s console to turn it back on. That case is covered in enabling RDP when you cannot log in over RDP.

Is RDP already enabled?

Check before you change anything. Three things must be true on the server, and a fourth from your own computer:

Replace 203.0.113.10 with the server’s IP address. On Linux, nc -vz -w 5 203.0.113.10 3389 does the last check; on a Mac, use -G 5 instead of -w 5. If the first three pass and the fourth fails, Remote Desktop is enabled and the block sits between you and the server; Remote Desktop can’t connect goes through that side.

No second computer at hand? The open port checker runs the fourth check from our server: enter the server’s IP address and port 3389.

How do I enable RDP in Settings or Server Manager?

On Windows Server with the Desktop Experience, any of these three routes does the same job. They normally switch on the matching firewall rules as well, which the registry route in the PowerShell section does not; the firewall line in the check table above confirms it either way.

1. 1Settings app (2019, 2022, 2025)

   Open Start → Settings → System → Remote Desktop, switch Remote Desktop (on some builds “Enable Remote Desktop”) to On and click Confirm. The NLA option sits on the same page or under Advanced settings, depending on the build; leave it ticked.

2. 2Server Manager

   In Server Manager → Local Server, click the word Disabled next to Remote Desktop. That opens the Remote tab of System Properties.

3. 3System Properties directly

   Press Win+R and run SystemPropertiesRemote.exe. Choose Allow remote connections to this computer, keep Allow connections only from computers running Remote Desktop with Network Level Authentication ticked, and click OK.

Members of the local Administrators group can connect straight away. Other accounts need to be added; see who is allowed to log in.

How do I enable RDP with sconfig?

On Server Core there is no Settings app. From Windows Server 2022, the Server Configuration tool (SConfig) starts on its own after you sign in; on 2019, or on a server with the Desktop Experience, type SConfig in a PowerShell window run as Administrator.

7   Remote desktop          (main menu, then Enter)
E   Enable                  (D would disable it)
1   Allow only clients with Network Level Authentication   ← choose this
2   Allow clients running any version of Remote Desktop    (less secure)

The main SConfig screen shows the new Remote desktop status straight away. Run the firewall check from the table above afterwards; it takes a moment and settles the question.

How do I enable RDP with PowerShell?

The PowerShell route works on every edition, including Server Core and a server you only reach through a console. Open PowerShell as Administrator and go through it in order:

$ts  = 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server'
$rdp = "$ts\WinStations\RDP-Tcp"

# allow connections and require NLA
Set-ItemProperty -Path $ts  -Name fDenyTSConnections -Value 0
Set-ItemProperty -Path $rdp -Name UserAuthentication -Value 1

# firewall: the built-in rule group (English display name)
Enable-NetFirewallRule -DisplayGroup 'Remote Desktop'
# the same group by its resource ID, which works in every Windows language;
# on a localized Windows the line above fails and this one does the job
Enable-NetFirewallRule -Group '@FirewallAPI.dll,-28752'

# the service must not be disabled (its default start type is Manual)
Get-Service TermService | Select-Object Status, StartType
Set-Service TermService -StartupType Manual
Start-Service TermService

Then confirm that Windows listens. If the first line below still finds nothing after a few seconds, restart the service; that drops any RDP session already open, which does not matter when you are working in a console:

Get-NetTCPConnection -LocalPort 3389 -State Listen
Restart-Service TermService -Force     # only if the line above found no listener

In a plain Command Prompt, the same two essentials are a reg and a netsh line. The firewall group name is the English one, so on a localized Windows use the PowerShell resource ID above instead:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
netsh advfirewall firewall set rule group="remote desktop" new enable=Yes

If RDP listens on a port other than 3389, the built-in rules do not cover it; you need a rule for your port. The Windows Firewall port guide has the commands for that.

Should Network Level Authentication be required?

Yes. With NLA, the client proves the password before Windows creates a session and draws a login screen. Without it, anyone who reaches port 3389 gets a Windows logon screen built for them, which costs the server resources and exposes more code to strangers. Every current client handles NLA: Remote Desktop Connection, Microsoft’s Windows App, FreeRDP and Remmina.

(Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').UserAuthentication
# 1 = NLA required, 0 = not required

Turn it off only for a moment and only from a console, for example when a very old client cannot connect or an expired password has to be changed at logon, and switch it back on afterwards. Why it matters, and the rest of the hardening, is in the RDP security checklist.

Who is allowed to log in over RDP?

Enabling Remote Desktop lets in members of Administrators and of Remote Desktop Users. To let a normal account in, add it to the second group, in Settings under Remote Desktop users or from PowerShell, with the account’s name in place of USERNAME. The SID works on every language version of Windows:

Add-LocalGroupMember -SID 'S-1-5-32-555' -Member 'USERNAME'     # Remote Desktop Users
Get-LocalGroupMember -SID 'S-1-5-32-555'

A user who still sees “the user account is not authorized for remote login” is blocked by a user-rights policy rather than by the group; secpol.msc → Local Policies → User Rights Assignment shows both the allow and the deny entry for Remote Desktop Services.

Why does RDP switch itself off again?

Because a Group Policy sets it. The policy Allow users to connect remotely by using Remote Desktop Services (Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Connections) overrides the normal setting and is written back at every policy refresh. Look for its registry value:

$pol = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
Get-ItemProperty $pol -ErrorAction SilentlyContinue | Select-Object fDenyTSConnections, UserAuthentication
gpresult /scope computer /v | Select-String 'Terminal Services' -Context 2,3

If fDenyTSConnections is 1 there, set the policy to Not configured or Enabled in gpedit.msc and run gpupdate /force. On a server in an Active Directory domain, the domain policy wins over anything local, so the change belongs in the domain GPO. A hardening script that wrote the value directly is the other common source; in that case remove the value and re-run the commands above.

How do I enable RDP when I cannot log in over RDP?

Use the out-of-band console your provider gives you: a VNC, KVM or serial view of the server’s screen that does not go through Windows networking. Console logons are local, so they work while Remote Desktop is off, the firewall blocks it or NLA refuses your client.

1. 1Open the console

   Open the server in your provider’s panel and start its console. Wait for the Windows lock screen; after a reinstall the first boot sets up the system and takes a few minutes.

2. 2Send Ctrl+Alt+Del and log in

   Use the console’s own Ctrl+Alt+Del button; pressing the keys on your keyboard reaches your own computer. Log in as Administrator.

3. 3Run the PowerShell block

   Right-click Start → Windows PowerShell (Admin) or Terminal (Admin), then run the commands from the PowerShell section. If the console has a paste field, it types the text in for you. Check the line before pressing Enter: quotes, colons and backslashes are the characters a keyboard-layout mismatch garbles.

4. 4Test from your own computer

   Run Test-NetConnection or nc against port 3389, then connect with your RDP client.

What should you do right after enabling RDP?

An open port 3389 is found by scanners quickly and then guessed at around the clock. Three steps take a few minutes and remove most of that risk:

• Allow only your own IP address. Scope the Remote Desktop rules with Set-NetFirewallRule -DisplayGroup 'Remote Desktop' -RemoteAddress YOUR_IP, with your public address in place of YOUR_IP. Do it from the console or keep the console open while you test, in case your address is not the one you expected.
• Keep NLA on and set an account lockout policy. net accounts /lockoutthreshold:10 /lockoutwindow:10 /lockoutduration:10 locks an account for ten minutes after ten wrong passwords within ten minutes; the built-in Administrator has a separate switch for it in secpol.msc, “Allow Administrator account lockout”. Do this after the firewall step, or bots on the open port can keep your own account locked. The Windows RDP security checklist explains both.
• Consider a different port. It does not stop a targeted attacker, but it cuts the noise in your logs. The guide to changing the RDP port shows how, including the firewall rule for the new port.

Does this work on Windows 10 and 11?

Yes, on the Pro, Enterprise and Education editions: the Settings path and the PowerShell commands are the same. Windows 10 and 11 Home cannot accept Remote Desktop connections at all; they can only connect out to other machines. A Home PC needs an upgrade to Pro before anyone can RDP into it.

Frequently asked