How to Enable Remote Desktop on Windows Server

The short answer: open Server Manager → Local Server, click the Remote Desktop value (it reads Disabled), and in the dialog that appears choose Allow remote connections to this computer with Network Level Authentication left ticked. Windows offers to open the firewall for you — accept it. That is the whole job for administrator access. To let non-admins in, add them to the Remote Desktop Users group; to connect, run mstsc from any Windows PC and enter the server's name or IP.

This guide covers the current release, Windows Server 2025, but the steps are effectively identical on Windows Server 2016, 2019 and 2022. The tools involved — Server Manager, System Properties and the Remote Desktop client — have behaved the same way for years. Where a detail differs by version we say so.

Before you start

• Sign in with an account that is a local administrator on the server you're enabling.
• Know how you'll reach the server — its computer name, its IP address, or a DNS name that resolves to it.
• Make sure the network profile is what you expect. Enabling Remote Desktop opens a firewall port; only do it on trusted networks, and never expose it straight to the internet.
• Confirm every account that will connect has a strong, unique password. Blank passwords cannot be used over Remote Desktop.

Method 1 — Server Manager (the fastest GUI route)

On a server with the desktop experience, Server Manager is usually the quickest place to flip Remote Desktop on.

1. Open the Start menu and launch Server Manager (it opens automatically at sign-in on a fresh install).
2. In the left pane, click Local Server.
3. In the Properties tile, find Remote Desktop. It reads Disabled — click that word.
4. The System Properties dialog opens on the Remote tab. Select Allow remote connections to this computer.
5. Leave Allow connections only from computers running Remote Desktop with Network Level Authentication (recommended) ticked.
6. If Windows warns that a power option might let the server sleep, that's a heads-up for laptops and workstations — servers normally stay awake, so you can dismiss it.
7. Click OK. Remote Desktop is now on, and Windows enables the matching firewall rule automatically.

Method 2 — System Properties directly (sysdm.cpl)

You can skip Server Manager and go straight to the same dialog. This also works on client editions of Windows 11 Pro, Enterprise and Education.

1. Press Windows + R, type sysdm.cpl and press Enter.
2. Switch to the Remote tab.
3. Under Remote Desktop, select Allow remote connections to this computer, keep the Network Level Authentication box ticked, and click OK.

On Windows Server 2025 and Windows 11 you can also use the modern Settings app: Settings → System → Remote Desktop, then toggle Enable Remote Desktop to On and confirm — the route set out in Microsoft's Enable Remote Desktop on your PC documentation, which also confirms that members of the Administrators group and any users you specify can then connect. The Settings toggle and the System Properties checkbox change the same underlying setting.

Method 3 — PowerShell (Server Core and scripting)

Server Core has no Server Manager GUI, and if you're building servers repeatably you'll want this scripted anyway. Run PowerShell as Administrator. Enabling Remote Desktop is one registry value; the firewall is a separate command.

Turn Remote Desktop on

Setting fDenyTSConnections to 0 allows incoming connections:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' `
  -Name "fDenyTSConnections" -Value 0

Open the firewall

Enable the built-in Remote Desktop rule group so port 3389 is allowed — the Enable-NetFirewallRule cmdlet reference documents the -DisplayGroup parameter used here:

Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

Keep Network Level Authentication on

NLA is enabled by default; this line makes sure of it by setting UserAuthentication to 1:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' `
  -Name "UserAuthentication" -Value 1

Add the users who are allowed to connect

Enabling Remote Desktop lets local administrators connect straight away. Anyone else must be a member of the Remote Desktop Users group. Being in that group grants remote sign-in only — it does not hand out administrative rights.

1. On the Remote tab of System Properties, click Select Users… (on newer builds it may read Remote Desktop users).
2. Click Add, type the account name — for a domain account use DOMAIN\username — then click Check Names and OK.
3. Repeat for each account, then click OK to close the dialogs.

From a command line you can do the same in one line (elevated):

net localgroup "Remote Desktop Users" DOMAIN\username /add

On a domain controller there is no local Remote Desktop Users group in the usual sense — manage the built-in group through Active Directory, and grant interactive/remote sign-in rights by policy rather than adding ordinary users to a DC.

Confirm the firewall rule

The GUI methods open the firewall for you, but it's worth confirming — especially on servers with a hardened or custom firewall policy. In Windows Defender Firewall with Advanced Security, check that the inbound rules in the Remote Desktop group are enabled. Or verify from PowerShell:

Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Select-Object DisplayName, Enabled, Profile

Make sure the rule is enabled for the network profile your server actually uses (Domain, Private or Public). A rule enabled only for the Domain profile won't help a workgroup server on a Private network.

Connect with the Remote Desktop client

With Remote Desktop enabled, connect from any Windows PC using the built-in client:

1. Press Windows + R, type mstsc and press Enter — or open Remote Desktop Connection from the Start menu.
2. In Computer, enter the server's name or IP address (for example SERVER01 or 10.0.0.20). To reach a non-default port, append it as 10.0.0.20:3390.
3. Click Connect, supply the credentials of an administrator or a Remote Desktop Users member, then click OK.
4. If prompted about the server's certificate on first connect, verify you're connecting to the right machine before accepting.

On Windows 11, Microsoft has been consolidating remote-connection clients under the newer Windows App, but the classic mstsc client remains available and is fine for a straightforward admin connection.

Multi-user RDS is a different thing entirely

Everything above sets up Remote Desktop for Administration — the free, built-in ability for up to two administrators to connect at once for managing the server. That is all most people enabling RDP actually need.

If your goal is to let many users run apps or full desktops on the server at the same time — a session-host or VDI scenario — that is Remote Desktop Services (RDS), and it is a separate build:

• You install the Remote Desktop Services role (Session Host, plus supporting roles like Connection Broker and Web Access for a full deployment).
• You must buy and deploy RD CALs (Remote Desktop client access licences) through an RD Licensing server. Without licensing, RDS runs only for a limited grace period and then stops accepting connections — Microsoft's RDS client access licence documentation puts that grace period at 120 days, after which clients need a valid RDS CAL issued by a license server.

Adding the RDS role follows the same wizard as any other server role — see our guide to adding roles and features in Windows Server for the mechanics, then choose the Remote Desktop Services installation path in the wizard for a full deployment.

Quick recap

For admin access, enabling Remote Desktop is three things: turn it on (Server Manager, System Properties or PowerShell), allow the right people (administrators automatically, plus anyone you add to Remote Desktop Users), and make sure the firewall is open for the correct profile. Keep Network Level Authentication on, keep RDP off the open internet, and connect with mstsc. Only reach for Remote Desktop Services and CALs when you genuinely need to host many concurrent users.