Multiple RDP sessions on Windows Server: two admins free, more needs RDS licences

Out of the box, Windows Server allows two simultaneous Remote Desktop sessions. They are meant for administering the server, need no extra licence, and any account in the Administrators or Remote Desktop Users group can use them. For more people at once you need the Remote Desktop Session Host (RDSH) role plus Remote Desktop client access licences (RDS CALs). After the role is installed there is a 120-day grace period, and then connections stop working without licences. Patching termsrv.dll to get around the limit is not an option: it breaks the licence terms and tends to break with the next Windows update.

This applies to Windows Server 2025, 2022 and 2019 alike. Below: how to give a second person access, how to let one account have two sessions, what to do about the “number of connections is limited” error, and what the licensed route to more sessions looks like.

What do I get by default?

• Two remote sessions at the same time, active or disconnected. This mode is called Remote Desktop for Administration.
• The console session on top of that: the screen you see in your provider’s web console, which does not use one of the two RDP slots.
• One session per account. If you connect again with the same user, you take over your existing session instead of opening a second one.
• Who may connect: members of Administrators, and members of Remote Desktop Users.

Microsoft’s licence terms allow these two connections for administering the server. Giving people a desktop to work in every day is what RDS CALs are for, even when two seats would technically be enough.

How do I add a user who can log in over RDP?

Create a local account and put it in the Remote Desktop Users group. Do not make it an administrator unless that person administers the server. Put the new account’s name in place of USERNAME:

net user USERNAME * /add
net localgroup "Remote Desktop Users" USERNAME /add

The * makes Windows ask for the password instead of leaving it in your command history. The same in PowerShell, plus a check of who is in the group:

$pw = Read-Host -AsSecureString "Password for USERNAME"
New-LocalUser -Name "USERNAME" -Password $pw
Add-LocalGroupMember -Group "Remote Desktop Users" -Member "USERNAME"
Get-LocalGroupMember -Group "Remote Desktop Users"

If you prefer the GUI, lusrmgr.msc manages users and groups, and SystemPropertiesRemote.exe → Select Users adds people to Remote Desktop Users. When a new user gets “the connection was denied because the user account is not authorized for remote login”, the group membership is missing or has not been picked up yet; sign out and connect again.

Can the same account log in twice at the same time?

Not by default. To allow it, open gpedit.msc and go to Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Connections. Set Restrict Remote Desktop Services users to a single Remote Desktop Services session to Disabled, then apply it:

gpupdate /force

Server Core has no gpedit.msc. There, or in a setup script, write the registry value behind the same policy and refresh policy the same way; 0 allows several sessions per account, 1 restores the default:

$ts = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
if (-not (Test-Path $ts)) { New-Item -Path $ts -Force | Out-Null }
New-ItemProperty -Path $ts -Name fSingleSessionPerUser -PropertyType DWord -Value 0 -Force | Out-Null
gpupdate /force

The next connection with the same account opens a new session instead of taking over the old one. Both still count towards the two. Keep in mind that the two sessions share one user profile, so programs that lock their settings or data folder, which includes many browsers and trading terminals, may refuse to start a second time.

Why do I get “The number of connections to this computer is limited”?

Because both slots are taken, and a disconnected session counts as taken. Closing the RDP window does not sign you out; it disconnects, and the session keeps running on the server with everything that was open in it. Two forgotten sessions are enough to lock everyone else out.

From any session on the server, list the sessions and sign out the ones nobody needs:

query user          # or quser: user, session ID, state (Active / Disc), idle time
query session       # or qwinsta: every session, including the console

logoff 3            # sign out session 3; programs running in it are closed

If you cannot get in over RDP at all, use your provider’s console. It opens the console session, which does not compete for the two RDP slots, and you can run the same commands there. If you get a different error, or none at all, see Remote Desktop can’t connect. Also check that nobody set Limit number of connections, in the same Connections folder as above, to 1.

To stop it from happening again, let Windows sign out sessions that have been disconnected for a while: in Remote Desktop Session Host → Session Time Limits, enable Set time limit for disconnected sessions and pick a time, for example one hour.

How do I get more than two sessions?

By turning the server into a Remote Desktop Session Host and licensing it. The steps, in short:

1. 1Install the Session Host role

   Install-WindowsFeature RDS-RD-Server -IncludeManagementTools -Restart

   Server Manager’s “Remote Desktop Services installation” wizard expects an Active Directory domain. On a stand-alone server, install the role service with PowerShell as shown and configure the rest through Group Policy.

2. 2Set up a licence server

   Install-WindowsFeature RDS-Licensing -IncludeManagementTools

   Open Remote Desktop Licensing Manager (licmgr.exe), activate the server, and install the RDS CALs you bought.

3. 3Point the Session Host at it

   In gpedit.msc, under Remote Desktop Session Host → Licensing, set Use the specified Remote Desktop license servers to the licence server (the server’s own name if it is the same machine) and Set the Remote Desktop licensing mode to Per User or Per Device, matching the CALs you own. RD Licensing Diagnoser (lsdiag.msc) then shows whether everything fits together.

   If this part is missing when the grace period ends, users are disconnected with “no Remote Desktop License Servers available”; the licensing section of Remote Desktop can’t connect covers that message.

A few facts about RDS CALs that save confusion:

• They are bought, not configured. RDS CALs come through Microsoft licensing, from a reseller or a licensing agreement. They are not part of any VPS price, and the 120-day grace period is not a licence.
• Per User or Per Device. One CAL covers either one person on any number of devices, or one device for any number of people. Per User CALs are tracked through Active Directory, so on a server outside a domain many setups use Per Device. Ask whoever sells you the CALs which mode fits your purchase.
• The version matters. The CALs must be for the same Windows Server version as the Session Host or a newer one: 2019 CALs do not cover a 2022 server.
• Rented hardware has its own rules. Whether licences you own may be used on a server you rent depends on the licence type, so ask before you buy. Which licence may I use on a rented server? covers the documented case.

What if my server runs on an evaluation licence?

Many hosted Windows servers, ours included, run on Microsoft’s evaluation edition: full Windows Server with a 180-day time limit. You can install the Session Host role on it and test with more than two users during the grace period. But the evaluation covers Windows Server itself, not RDS, and turning it into a licensed edition with your own key does not add CALs either. The two are separate purchases. slmgr /xpr shows when your evaluation ends. How long the evaluation lasts and how to convert it is in the Windows Server evaluation licence explained.

Is patching termsrv.dll allowed?

No. Tools and guides that patch termsrv.dll, or wrap it, remove the session limit by modifying the part of Windows that enforces the licence. That is exactly what the licence terms forbid. It also fails in practice: Windows updates replace the file regularly, after which the patch stops working or Remote Desktop stops working altogether, usually right after a patch day. And you are running a system file changed by a stranger’s tool on a server that is reachable from the internet. If you need more sessions, license them; if that is too expensive, give people separate servers.

Should several people share one Windows server at all?

Sometimes, for a small team using the same software. But each extra account is one more password that bots will try against your RDP port, and one more person whose mistakes affect everyone. If you do share, secure the RDP server first: RDP open only to known addresses, an account lockout policy, and nobody in Administrators who does not need to be.

For two or three people who each need their own desktop, one small server per person is often simpler than one big shared one: no CALs, no profile conflicts, and one person’s reboot does not end everyone’s work. RDP vs VPS explains the difference between a seat on a shared RDP box and a server of your own. A Windows RDP server or Windows VPS from VMHeaven is the second kind: a whole KVM machine with the Administrator account, where you decide who gets the two sessions, and the console in the panel still works when both are taken.

Frequently asked