How to Enable RDP on Windows Server: GUI and PowerShell

To enable RDP on Windows Server, open Server Manager → Local Server → Remote Desktop, choose “Allow remote connections”, and then enable the “Remote Desktop” rule in the firewall. A single PowerShell command achieves the same result. Below are both methods, with a check that the server is listening on port 3389.

What RDP is and why it needs configuring

Remote Desktop Protocol (RDP) is the built-in Windows protocol for reaching a server’s graphical desktop remotely. On a fresh Windows Server installation remote access is disabled and port 3389 is blocked by the firewall. Setup comes down to three steps: accept incoming connections, open the port, and if needed add users.

Method 1. Enabling RDP through the GUI (Server Manager)

Use this if you already reach the server through a KVM console or a local session.

1. Open Server Manager (it starts automatically at logon).
2. Select Local Server on the left.
3. Find the Remote Desktop row — it says Disabled by default. Click the word.
4. In the System Properties window that opens, select Allow remote connections to this computer.
5. Leave Allow connections only from computers running Remote Desktop with Network Level Authentication (NLA) checked — it is the safer option.
6. Click OK. Windows offers to enable the firewall rule automatically — accept.

The server now accepts RDP connections from administrators.

Method 2. Enabling RDP through PowerShell

Faster and better suited to automation. Run PowerShell as Administrator.

Allow incoming RDP connections (edits the registry):

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0

Require NLA (recommended):

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name "UserAuthentication" -Value 1

Open the port in Windows Firewall:

Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

Confirm the service is listening on port 3389:

Get-NetTCPConnection -LocalPort 3389 -State Listen

If the command returns a row with Listen, the server is ready to accept connections.

Checking the firewall rules

Make sure the required rules are active:

Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Select-Object DisplayName, Enabled, Direction

All three inbound rules (TCP and UDP) should show Enabled: True.

Port and connection settings

For extra security the port can be moved off 3389 — that is covered in a separate guide on changing the RDP port.

How to test the connection

From a Windows client, open mstsc, enter the server IP address and the administrator credentials. From PowerShell on the client you can check port availability quickly:

Test-NetConnection -ComputerName 203.0.113.10 -Port 3389

The line TcpTestSucceeded : True means the port is open and the server is reachable.

Frequently asked questions

RDP is enabled but the connection fails — why?

Most often port 3389 is blocked by an external firewall, or the account has no remote logon rights. Run Test-NetConnection ... -Port 3389 from the client and check that the account belongs to Remote Desktop Users or Administrators.

Is a reboot required after enabling RDP?

No. Changes made in System Properties or PowerShell apply immediately — the Remote Desktop service is already running in the system.

What is NLA and should it be disabled?

Network Level Authentication requires authentication before a session is created, which lowers load and blocks a class of attacks. Disabling it is not recommended — leave it on.

Can RDP access be limited to specific users?

Yes. Add the accounts to the local Remote Desktop Users group instead of Administrators. That grants access without extra privileges.

Need a server ready for remote desktop work? Take a Windows VPS with RDP access and a KVM console, or review the VPS hosting plans.