microsoft:server:2012:rdp_through_gpo
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| microsoft:server:2012:rdp_through_gpo [2016/03/05 20:24] – rplecko | microsoft:server:2012:rdp_through_gpo [2016/03/06 17:52] (current) – rplecko | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ===Server 2012 Enable Remote Desktop (RDP) through Group Policy (GPO)=== | + | === Server 2012 Enable Remote Desktop (RDP) through Group Policy (GPO) === |
| - | [[http:// | + | Copied from [[http:// |
| I want to be able to remote onto all my computers but limit which users can remote onto these machines. The best way to do this is through a group policy that sets this up on all machines. | I want to be able to remote onto all my computers but limit which users can remote onto these machines. The best way to do this is through a group policy that sets this up on all machines. | ||
| Line 7: | Line 7: | ||
| My GPO will need to do the following: | My GPO will need to do the following: | ||
| - | * | + | * Enable Remote Desktop Service |
| - | * | + | * Open the Firewall to allow Remote Desktop |
| - | * | + | * Disallow local admins from making changes |
| - | * | + | * Only allow certain users to logon remotely. |
| **Create a Security Group** | **Create a Security Group** | ||
| Line 22: | Line 22: | ||
| - Give the group a name. I used “SG – Remote Desktop Users”. | - Give the group a name. I used “SG – Remote Desktop Users”. | ||
| - | {{ microsoft/server/2012/rdp_gpo/ss-01.png }} | + | [[http:// |
| **Create the GPO** | **Create the GPO** | ||
| Line 29: | Line 29: | ||
| - Log into your Domain Controller. | - Log into your Domain Controller. | ||
| - | - On the Start Screen type: gpmc.msc. This will pull up the Group Policy Management Console. | + | - On the Start Screen type: **gpmc.msc**. This will pull up the <fc # |
| - Right click on your domain and select “Create a GPO in this domain, and Link it here…”. I am creating this GPO at the root of my domain to allow access to all servers and computers in my domain. This might not be exactly what you want to do, if your situation is different then select the OU you want this policy to apply to instead of your domain. | - Right click on your domain and select “Create a GPO in this domain, and Link it here…”. I am creating this GPO at the root of my domain to allow access to all servers and computers in my domain. This might not be exactly what you want to do, if your situation is different then select the OU you want this policy to apply to instead of your domain. | ||
| - Name the GPO. I used “Enable RDP” to keep it simple. This will create a blank GPO and a link to it. | - Name the GPO. I used “Enable RDP” to keep it simple. This will create a blank GPO and a link to it. | ||
| - Right click the GPO or the Link and select “Edit…” | - Right click the GPO or the Link and select “Edit…” | ||
| - | - This will pull up a the Group Policy Editor. {{ microsoft/server/2012/rdp_gpo/ss-02.png }} | + | - This will pull up a the Group Policy Editor. |
| - We are only going to be modifying Computer Settings. We need to enable RDP, open the Firewall, and allow the security group members. Set the following: | - We are only going to be modifying Computer Settings. We need to enable RDP, open the Firewall, and allow the security group members. Set the following: | ||
| - | | + | |
| - | - Add Users or Group… | + | - Add Users or Group… |
| - | - Browse and search for your Security Group. In my case it was SG – Remote Desktop users | + | - Browse and search for your Security Group. In my case it was SG – Remote Desktop users |
| - | - Computer Configuration\Policies\Windows Settings\Security Settings\Restricted Groups | + | - Computer Configuration\Policies\Windows Settings\Security Settings\Restricted Groups |
| - | - Right Click in the blank area and select Add Group… | + | - Right Click in the blank area and select Add Group… |
| - | - Browse and find “Remote Desktop Users” | + | - Browse and find “Remote Desktop Users” |
| - | - Select OK | + | - Select OK |
| - | - Double Click Remote Desktop Users | + | - Double Click Remote Desktop Users |
| - | - Select Add for “Members of this Group” | + | - Select Add for “Members of this Group” |
| - | - Browse and find your Security group. | + | - Browse and find your Security group. |
| - | - //Computer Configuration\Administrative Templates\Network\Network Connections\Windows Firewall\Domain Profile\Windows Firewall: Allow Inbound Remote Desktop exceptions:// | + | - //<fc #6495ed>Computer Configuration |
| - | - //Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections\Allow user to connect remotely by using Remote Desktop Services:// **Enabled** | + | - //<fc #6495ed>Computer Configuration |
| - | - //Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security\Do not allow local administrators to customize permissions:// | + | - //Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security\Do not allow local administrators to customize permissions:// |
| - | - //Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security\Require user authentication for remote connections by using NLA:// **Disabled** | + | - //Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security\Require user authentication for remote connections by using NLA:// |
| - | {{ microsoft/server/2012/rdp_gpo/ss-03.png }} | + | [[http:// |
| - | {{ microsoft/server/2012/rdp_gpo/ss-04.png }} | + | |
| - | That should be it! Just wait for or force your computers to update Group Policy. Now any users that are a member of your security group can RDP to your computers. | + | [[http:// |
microsoft/server/2012/rdp_through_gpo.1457209451.txt.gz · Last modified: 2016/03/05 20:24 (external edit)