Create an RDP User on Windows Server: GUI and PowerShell
To give a colleague RDP access to a server, create a local account and add it to the Remote Desktop Users group — the user can then connect without gaining administrator rights. You can do this through the lusrmgr.msc console or with two PowerShell commands. Here are both methods.
The principle: least privilege
Do not hand ordinary users administrator rights just so they can use RDP. Membership of the Remote Desktop Users group is enough: it permits remote logon without access to system settings. This is a basic security rule.
Method 1. Through the graphical console
- Press Win + R, type
lusrmgr.mscand press Enter. - Open the Users folder, right-click → New User.
- Fill in User name and Password. Clear “User must change password at next logon” if you do not need it, and tick “Password never expires” if appropriate.
- Click Create.
- Double-click the new user → Member Of → Add tab, type
Remote Desktop Usersand click OK.
Done — the account can now connect over RDP.
Method 2. Through PowerShell
Run PowerShell as Administrator. Create the user with a password:
$password = Read-Host -AsSecureString "Enter password"
New-LocalUser -Name "jsmith" -Password $password -FullName "John Smith" -Description "RDP user"
Add them to the Remote Desktop Users group:
Add-LocalGroupMember -Group "Remote Desktop Users" -Member "jsmith"
Check the group membership:
Get-LocalGroupMember -Group "Remote Desktop Users"
Optional: a password that never expires
If the account is a service account and its password should not age:
Set-LocalUser -Name "jsmith" -PasswordNeverExpires $true
Testing the access
Make sure RDP is enabled on the server — otherwise even a correctly added user cannot log in. Then have the user connect from a client:
mstsc /v:203.0.113.10
and sign in as jsmith with the password you set.
Group roles: which one to pick
| Group | What it grants |
|---|---|
| Remote Desktop Users | Remote logon over RDP only |
| Administrators | Full access plus RDP |
| Users | Local logon, no RDP |
For regular staff, use Remote Desktop Users only.
Frequently asked questions
The user exists but gets “you must have remote logon rights”
The account is not in the Remote Desktop Users group. Add it with Add-LocalGroupMember -Group "Remote Desktop Users" -Member "name" and try connecting again.
How do I delete a user when the access is no longer needed?
Run Remove-LocalUser -Name "jsmith". To revoke RDP only, remove them from the group: Remove-LocalGroupMember -Group "Remote Desktop Users" -Member "jsmith".
Can I limit a user’s working hours or drive access?
Yes. Group Policy (gpedit.msc) and the RDS settings let you restrict logon hours, drive redirection and clipboard sharing. File permissions are set through NTFS.
Does an RDP user need to be an administrator?
No, and it is not recommended. Membership of Remote Desktop Users is enough to log in, and the lack of admin rights limits the damage if the account is compromised.
Building a server for a team with separate accounts? Look at a Windows VPS or the VPS hosting plans.