Need to RDP into a system that has RDP disabled? Use this trick to turn it on remotely in just a few steps.
When an administrator loses Remote Desktop (RDP) access to a Windows Server, it can be critical to re-enable it remotely without physical access. This guide shows multiple ways to enable Remote Desktop on a remote Windows Server 2022 machine using built-in tools. We assume the target is running Windows Server 2022. The methods cover both workgroup (peer-to-peer) and domain environments. Key factors to consider include:
- Firewall Settings: The remote server’s firewall must allow RDP (TCP/3389) or WinRM (TCP/5985/5986) traffic. If necessary, configure or open the firewall for these services.
- Domain vs. Workgroup: In a domain, Kerberos authentication handles trust. In a workgroup (P2P), you may need to add the remote server to the local machine’s TrustedHosts list.
- WinRM (PowerShell Remoting): PowerShell remoting (WinRM) is typically enabled by default on Windows Server platforms. Verify the WinRM service is running on the target. If it is not running, you must start or enable it before using PowerShell commands (see PsService section below).
Test Environment
For examples, assume two identical Windows Server 2022 hosts in a lab network: one as the “console” (the admin machine) and one as the “target” (remote server). In a workgroup setup, the console will use the local administrator account on the target. In a domain, a domain administrator account can be used. Replace hostnames and credentials accordingly in commands below.
Method 1: Enable RDP via PowerShell Remoting
Using PowerShell remoting (WinRM) is often the quickest method. On modern Windows Server 2022, WinRM is enabled by default and listening on TCP port 5985 for HTTP (unsecured). First, ensure the console can use PowerShell remoting to connect to the target:
1. Allow the target as a trusted host (if not domain-joined):
On the console machine, open PowerShell as Administrator and add the remote server to the TrustedHosts list (use its name or IP). For example:
# Add remote server to TrustedHosts (change name/IP as needed) Set-Item -Path WSMan:\localhost\Client\TrustedHosts -Value "TARGET-SERVER" -Force
This lets your console use HTTP remoting to the target. (If both machines are in the same domain, this step is not needed because Kerberos will trust the connection.)
2. Test WinRM connectivity:
Try to establish a PowerShell session:
Enter-PSSession -ComputerName TARGET-SERVER -Credential TARGET-SERVER\Administrator
Enter the appropriate local or domain administrator credentials when prompted. If you get a prompt or a remote session banner, WinRM is working. If the session fails (e.g. due to WinRM being stopped on the target), you must first start WinRM on the target (see Method 2 below).
3. Enable Remote Desktop in the remote session:
Once you have the interactive session (PS C:\Users\Administrator>TARGET-SERVER), run the following commands on the target to enable RDP and enforce Network Level Authentication (NLA):
# Allow Remote Desktop connections (enable RDP) Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Value 0 # Require NLA for RDP (enhanced security) Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "UserAuthentication" -Value 1 # Enable the Windows Firewall rules for Remote Desktop Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
These commands set the registry value fDenyTSConnections=0 (which allows RDP) and ensure RDP uses NLA. They then enable all firewall rules in the “Remote Desktop” group so that inbound RDP (default TCP/3389) is allowed. (The above steps match recommended Server 2022 configuration.)
4. Exit and verify:
Exit the remote session (Exit-PSSession) and back on the console, test the RDP connection port:
Test-NetConnection -ComputerName TARGET-SERVER -Port 3389
If TcpTestSucceeded is True, the target is now listening for RDP. You should now be able to use an RDP client to connect.
All of the above PowerShell steps can be done from a Windows PowerShell 5.x or PowerShell 7.x console. No special syntax changes are needed for PowerShell 7; WS-Man remoting uses the same Enter-PSSession and Set-ItemProperty cmdlets.
Method 2: Enable WinRM (and then RDP) via Sysinternals PsService
If WinRM is not running on the target and you cannot use PowerShell remoting initially, you can use the Sysinternals PsService utility to start the WinRM service remotely. PsService (part of the PsTools suite) lets you manage Windows services on a remote system by connecting to its Service Control Manager. Follow these steps:
1. Obtain PsTools: Download PsTools from Microsoft (https://learn.microsoft.com/sysinternals/downloads/pstools) and extract it, e.g. to C:\Tools.
PsService is one of the utilities included.
2. Use PsService to check WinRM: Open an elevated Command Prompt on the console (where PsTools is extracted). Run: cd C:\Tools psservice \\TARGET-SERVER -u TARGET-SERVER\Administrator -p YourPassword query WinRM
This will prompt to accept the license on first use. If WinRM is stopped, it will show as stopped.
3. Start WinRM service remotely: If it was stopped, run:
psservice \\TARGET-SERVER -u TARGET-SERVER\Administrator -p YourPassword start WinRM
PsService will remotely start the WinRM service on the target. (Note: PsService sends credentials in plaintext on the command line, so use this only on a secure network.)
4. Proceed with PowerShell Remoting: Once WinRM is started, repeat Method 1 from step 2 to remotely connect with Enter-PSSession and run the RDP-enabling PowerShell commands. Starting WinRM with PsService effectively allows you to use the same PowerShell approach described above.
In summary, PsService enables you to invoke Start-Service on the target without being logged in to it, letting you then configure RDP via PowerShell. (Usage of PsService is documented by Microsoft as: psservice [\\computer [-u user] [-p pwd]] <command>.)
Method 3: Enable RDP via Group Policy (Domain)
If the remote server is joined to an Active Directory domain and you have a domain controller or Group Policy Editor, you can enable RDP via a Group Policy Object (GPO):
1. Create or edit a GPO: On a domain controller (or any machine with GPMC), open the Group Policy Management Console and create a new GPO or edit an existing one linked to the OU containing the target server.
2. Allow remote connections: In the GPO editor, navigate to Computer Configuration → Policies → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Connections.
Enable the policy “Allow users to connect remotely by using Remote Desktop Services”. This sets the server to accept RDP connections.
3. Require NLA (recommended): Optionally, still under Administrative Templates, go to
Remote Desktop Services → Remote Desktop Session Host → Security, and enable “Require user authentication for remote connections by using Network Level Authentication”. This enforces NLA for better security.
(Note: Recent Windows versions have NLA enabled by default, but it’s good to ensure this policy is applied.)
4. Enable firewall rule via GPO: Ensure the firewall allows RDP on the domain network. You can do this in the same GPO by navigating to Computer Configuration → Policies → Administrative Templates → Network → Network Connections → Windows Defender Firewall → Domain Profile and enabling “Windows Defender Firewall: Allow inbound Remote Desktop exceptions”. Set this to Enabled and specify any IP filters (or use * to allow all).
Alternatively, under Windows Settings → Security Settings → Windows Defender Firewall → Inbound Rules, you can enable the built-in “Remote Desktop (TCP-In)” rules.
5. Apply the GPO: Link the GPO to the OU of the target server and run gpupdate /force on the target (or wait for policy refresh). The server will then allow RDP connections as configured by policy.
By using Group Policy, you centrally enable RDP for any domain-joined server. The settings above mirror what the PowerShell method does locally. For example, the step to “allow inbound RDP exceptions” corresponds to enabling the firewall rules for Remote Desktop.
Conclusion
Remote Desktop can be enabled on a Windows Server host without physically accessing it by using PowerShell or policy-based methods. If WinRM is available, PowerShell remoting allows you to set the appropriate registry keys and firewall rules as shown above. If WinRM is not initially running, Sysinternals PsService can start it remotely. In a domain, Group Policy provides a straightforward way to enable RDP for any server centrally. After performing these steps, the target server should accept RDP (TCP/3389) connections, restoring remote management capability.
