Command enable Remote Desktop

Enter the command line below to modify for the fDenyTSConnections key to activate the remote desktop

Enter the following command to activate the remote desktop :

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

Problem
Allow or prohibit Remote Desktop connections to your Windows machine through Command Prompt or PowerShell.

tl;dr
Run the required command from shell with Administrative privileges.

To enable RDP:

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

To disable RDP:

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f

Solution
Sometimes, you may with to allow Remote Desktop Protocol so you can manage your computer or server remotely. Unfortunately, you may not be logged in to Windows itself, or do not have physical access to the desktop. For example, you are pre-configuring a build for deployment, you are repairing a system while in recovery mode, or you only have SSH access to your server, but no KVM. In these situations, it is still possible to enable [or disable] RDP by setting a registry value.

You must be logged in to a shell prompt [cmd or PowerShell] that has full administrative access to do so. Recovery mode prompt has admin access already. Command prompt inside Windows can be run as Administrator by right-clicking it and selecting "Run as Administrator." If you are using PowerShell, whether via SSH, or locally, run the following command to elevate your privileges:

Start-Process powershell -Verb runAs

Once you finally have Admin privileges, enter one of these two commands to modify the required registry key.

To enable RDP:

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

To disable RDP:

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f

Was this article helpful?
☹Dislike19 ☺Like30

Views: 83497

By default on a Windows Server Product Windows Remote Management [WinRM] is enabled, but Remote Desktop [RDP] is Disabled.  On workstation operating systems neither is enabled by default, so if you want to be able to accomplish the following you will need to enable WinRM on the workstations.

Enabling RDP remotely.

Method 1:  Command Line

To enable RDP with the Command Prompt, use the following steps.

1. Launch the Command Prompt as Administrator.
2. Type the following command:

Reg add “\\computername\HKLM\SYSTEM\CurentControlSet\Control\Terminal Server” /v fDenyTSConnections /t REG_DWORD /d 0 /f

Reg add “\\computername\HKLM\SYSTEM\CurentControlSet\Control\Terminal Server”  /v fDenyTSConnections /t REG_DWORD /d 0 /f

Note:  Computername is the name of the computer you wish to enable RDP on.

NOTE:  Enabling RDP through the Command Prompt will not configure the Windows Firewall with the appropriate ports to allow RDP connections.

NOTE:  By default the local Administrators group will be allowed to connect with RDP.  Also the user that is currently logged in will also be allowed to connect.

To disable RDP with the Command Prompt, use the following steps.

1. Launch the Command Prompt as Administrator.
2. Type the following command:

Reg add “\\computername\HKLM \SYSTEM\CurentControlSet\Control\Terminal Server” /v fDenyTSConnections /t REG_DWORD /d 1 /f

Reg add “\\computername\HKLM \SYSTEM\CurentControlSet\Control\Terminal Server”  /v fDenyTSConnections /t REG_DWORD /d 1 /f

Method 2:  Using PowerShell

To enable RDP with the PowerShell, use the following steps.

Option 1

To enable RDP:

1. Launch PowerShell as Administrator.
2. Type the following command and create a script block and use the Invoke-Command cmdlet:

Invoke-Command –Computername “server1”, “Server2” –ScriptBlock {Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" –Value 0}

Invoke-Command –Computername “server1”, “Server2” –ScriptBlock {Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" –Value 0}

NOTE:  Enabling RDP through PowerShell will not configure the Windows Firewall with the appropriate ports to allow RDP connections.

Type the following:

Invoke-Command –Computername “server1”, “Server2” –ScriptBlock {Enable-NetFirewallRule -DisplayGroup "Remote Desktop"}

Invoke-Command –Computername “server1”, “Server2” –ScriptBlock {Enable-NetFirewallRule -DisplayGroup "Remote Desktop"}

NOTE:  By default the local Administrators group will be allowed to connect with RDP.  Also the user that is currently logged in will also be allowed to connect.

To disable RDP with the PowerShell, use the following steps.

1. Launch PowerShell as Administrator.
2. Type the following command:

Invoke-Command –Computername “server1”, “Server2” –ScriptBlock {Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" –Value 1}

Invoke-Command –Computername “server1”, “Server2” –ScriptBlock {Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" –Value 1}

Option 2

To enable RDP RDP with the PowerShell, use the following steps.

1. Launch PowerShell as Administrator.
2. Create a PS Session with the desired target computer.
3. Type the following command once possession is established:

Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" –Value 0

Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" –Value 0

NOTE:  Enabling RDP through PowerShell will not configure the Windows Firewall with the appropriate ports to allow RDP connections.

Type the following:

Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

NOTE:  By default the local Administrators group will be allowed to connect with RDP.  Also the user that is currently logged in will also be allowed to connect.

To disable RDP RDP with the PowerShell, use the following steps.

1. Launch PowerShell as Administrator.
2. Create a PS Session with the desired target computer.
3. Type the following command once possession is established:

Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" –Value 1

Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" –Value 1

Method 3:  Use Group Policy

If you have numerous Servers and/or Workstations that you need to enable RDP on and they are in the same Organization Unit structure in Active Directory you should enable RDP through Group Policy.

To enable RDP Using Group Policy.

1. Launch the Group Policy Management Console [GPMC]
2. Either edit an existing Group Policy Object [GPO] or create a new GPO.
3. Navigate to the following GPO node:

Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections

1. In the Settings pane double click Allow users to connect remotely by using Remote Desktop Services.

1. Select the Enable Radial button select OK.

1. Close the GPO editor and link the GPO to the appropriate Organizational Unit.

NOTE:  Enabling RDP through GPO will configure the Windows Firewall with the appropriate ports to allow RDP connections.

Note:  In all the methods demonstrated in this blog any member of the local Remote Desktop Users group will be able to connect to the target computers.

Until next time – Ride Safe!

Rick Trader
Windows Server Instructor – Interface Technical Training
Phoenix, AZ

Subscribe to this author's posts feed via RSS