Adding a user to the Remote Desktop Users group grants them permission to connect to a Windows machine remotely via Remote Desktop Protocol (RDP). This is required for any user to log in through a remote desktop session.
The Remote Desktop Users group is a built-in local group on Windows systems. Membership allows access to the graphical desktop environment of a computer from another device. Without this assignment, even valid credentials fail to establish a remote session.
Administrators configure this setting using Local Users and Groups, Group Policy, or PowerShell. The process varies slightly between Windows 10/11, Windows Server, and domain environments. Misconfiguration leads to denied connections, even with correct passwords.
When a user attempts to connect via Remote Desktop Connection (mstsc.exe), the system checks their group memberships. If they're not in the Remote Desktop Users group, the connection is rejected with error 0x80004005 or "The user is not a member of the remote desktop group."
This check happens during authentication, before the desktop session initializes. Even if a user has administrative rights locally, they cannot use RDP unless explicitly added to the group.
Remote Desktop Services (RDS) on Windows Server adds additional layers. In those cases, the Remote Desktop Users group controls access to the RDP listener port (3389), and policies may restrict concurrent sessions or enforce network-level authentication (NLA).
There are three primary ways to assign Remote Desktop Users membership:
| Method | Best For | Access Level | Security Notes |
|---|---|---|---|
| Local Users and Groups (Lusrmgr.msc) | Single workstations, small offices | Local only | Manual, no central control |
| Group Policy (GPO) | Active Directory domains, enterprise networks | Domain-wide | Automated, auditable, scalable |
| PowerShell (Add-LocalGroupMember) | Automation, scripting, server provisioning | Local or remote | Scriptable, supports variables and logging |
For standalone machines, open Computer Management → Local Users and Groups → Groups → Remote Desktop Users. Right-click, select Add to Group, then enter the username or SID.
In domain environments, use Group Policy Preferences or Active Directory Users and Computers. Go through to the user's properties, go to the Member Of tab, and add them to the Remote Desktop Users group.
PowerShell commands offer consistency across multiple servers. Run:
Add-LocalGroupMember -Group "Remote Desktop Users" -Member "DOMAIN\username"Replace DOMAIN with the actual domain name. Use the full UPN format if connecting from outside the domain.
Many assume that being an administrator automatically enables RDP access. That's false. Local Administrator rights do not grant RDP access unless the user is also in the Remote Desktop Users group.
Another frequent error is confusing the Remote Desktop Users group with the Administrators group. While both allow elevated privileges, only Remote Desktop Users enables remote login. A user in Administrators but not in Remote Desktop Users cannot connect via RDP.
A non-obvious point: The Remote Desktop Users group does not control file or folder access. It only governs the ability to initiate a remote session. Once connected, standard Windows permissions apply to resources.
On Windows Server 2022, enabling RDP through the GUI doesn't automatically add users. You must manually assign group membership. According to Microsoft's official documentation, "Remote Desktop is disabled by default on Windows Server to reduce attack surface." See the official setup guide.
A help desk technician at a school district needed to troubleshoot a teacher's locked-out laptop remotely. The teacher had a local account named "MsJenkins" and was not in the Remote Desktop Users group.
The technician logged into the machine locally, opened Computer Management, navigated to Local Users and Groups → Groups → Remote Desktop Users, and added "MsJenkins" to the group. After saving, the technician reopened Remote Desktop Connection, entered the teacher's credentials, and successfully connected.
Without adding the user to the group, the connection failed despite correct password entry. The error message showed "The user is not a member of the remote desktop group," confirming the root cause.
After the fix, the team documented the procedure and created a PowerShell script to automate future requests. The script runs with elevated privileges and logs actions to a central audit file.
Limit membership to only those who require remote access. Over-permissioning increases risk of lateral movement in case of compromise.
Use Group Policy to manage access centrally in domain environments. This ensures consistency and simplifies audits.
Enable Network Level Authentication (NLA) on all RDP-enabled systems. NLA requires credential verification before establishing a session, reducing exposure to brute-force attacks.
Monitor event logs for failed RDP attempts. Event ID 4625 in Windows Security logs records failed logons. Use tools like Splunk or Windows Event Forwarding to detect suspicious activity.
As an IT professional, I've seen teams bypass proper procedures and add users directly to the Administrators group for convenience. This creates a higher-risk environment. Always use the Remote Desktop Users group for remote access, never the Administrators group.