Allow non-administrators RDP Access to Domain Controller

By default, only the members of Domain Admins group have the remote RDP access to the Active Directory domain controllers‘ desktop. In this article we’ll show how to grant domain users (non-admin user accounts) RDP access to the domain controllers without granting administrative privileges.

Many can quite reasonably object why ordinary domain users should have access to the DC desktop. Indeed, in small or middle size infrastructures, when several administrators with the privileges of domain admins maintain them, you’ll hardly need this. However, in large corporate networks maintained by many administrators, it may become necessary to grant RDP access to the DC (usually to branch office DC’s or RODC) for different server administration groups, monitoring team, on-duty administrators, or other technical staffs. Also, sometimes some third-party services, not managed by the domain administrators, are deployed on the DC, and there’s a need to maintain these services.

After the server has been promoted to the domain controller, when you try to open Local Users and Groups (lusrmgr.msc) console, the following error returns:

As you can see, there are no local groups on the domain controller. Instead of the local group Remote Desktop Users, DC uses the built-in domain group Remote Desktop Users (located in the Builtin container). You can manage this group from the ADUC console or from the command prompt on the DC.

Display the members of the domain group Remote Desktop Users on the domain controller:

net localgroup "Remote Desktop Users"

As you can see, it is empty. Add a domain user it-pro to it. (In our example, it-pro is a standard domain user without administrative privileges.)

net localgroup "Remote Desktop Users" /add corp\it-pro

Make sure that the user is added to this group:

net localgroup "Remote Desktop Users"

You can also verify that the user is now a member of the Remote Desktop Users domain group using the ADUC snap-in.

However, after that a user still cannot connect to the DC using Remote Desktop.

The matter is that the possibility of the RDP connection in Windows is determined by Allow log on through Remote Desktop Services policy (In Windows 2003 or earlier this policy is called Allow log on through terminal services). After the server is promoted to the DC, only the Administrators group (these are domain administrators) remains in this policy.

To allow remote connection to the domain controllers for members of the Remote Desktop Users group you need to perform the following action for each of your DCs:

• Start Local Group Policy Editor (gpedit.msc)
• Go to the section Computer Configuration -> Windows settings -> Security Settings -> Local policies -> User Rights Assignment
• Find the policy Allow log on through Remote Desktop Services
• Edit the policy by adding the domain group Remote Desktop Users (like this: domainname\Remote Desktop Users), or directly the domain user, or a group (domain\somegroupname) to it
• Update local policies on the DC using the command gpupdate /force

Note that the required groups should not be present in the Deny log on through Remote Desktop Services policy, because it has a higher priority (see Restricting Network Access under local accounts).

It is better to create a new security group in the domain, for example, AllowLogonDC and add user accounts that need remote access to the DC to it. If you want to allow access to all AD domain controllers at once, instead of editing the local policy on each DC, it’s better to add a group of users to the Default Domain Controllers Policy via the GPMC.msc console (edit the policy settings in the same section: Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment -> Allow log on through Remote Desktop Services).

After these changes, the specified users and groups will be able to connect to the AD domain controllers over RDP. Try using RDP to connect to the DC under the user account. The user should see the domain controller’s desktop. You can grant non-administrators the right to start/stop certain services on the DC as follows.