Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As the topic says I'd like to automate the process of running on all computer accounts in my domain and setting this option to enabled otherwise people are unable to log into the servers using RDP. Any idea if it can be done using a script? enter image description here

The image is not displayed well, you can click This Link to view the image.

share|improve this question
up vote 0 down vote accepted

Are you dealing with users from one trusted domain needing to RDP into computers in a trusting domain? That is my understanding of why you could possibly need what you are asking for.

I may be way off here, but it sounds like you would simply like to enable your all of your users to RDP into all of your computers/servers. If so, you should only need to populate the Remote Desktop Users group on each computer with the security principal of those you want to be able to RDP. So in your case, you would add Authenticated Users to Remote Desktop Users on each computer.

The easiest and most consistent way to do this is with Group Policy Restricted Groups. From

To add a domain group to the Remote Desktop Users group via Group Policy

  1. To open Group Policy Management Console, click Start, click Run, and then type GPMC.msc.
  2. Create and link a GPO named Restricted Groups to the terminal server OU.
  3. Right-click the Restricted Groups GPO linked to the terminal server OU, and then click Edit.
  4. You can configure the Restricted Groups setting in the following location in Group Policy Object Editor:
  5. Computer Configuration\Windows Settings\Security Settings\Restricted Groups\
  6. Right-click Restricted Groups and then click Add Group.
  7. Click Browse, click Locations, select the locations you want to browse, and then click OK.
  8. Type Remote Desktop Users in the Enter the object names to select text box and then click Check Names. Or, click Advanced, and then click Find Now to list all available groups.
  9. Click the Remote Desktop Users group and then click OK.
  10. Click OK in the Add Groups dialog box to close it. The Remote Desktop Users Properties dialog box is then displayed.
  11. Click Add in the Members of this group section of the dialog box.
  12. Click Browse.
  13. Type the name of the domain group in the Select Users or Groups dialog box. Click Check Names, and then click OK to close this dialog box.
  14. Click OK to close this dialog box to finish adding the domain group to the Remote Desktop Users group.
share|improve this answer
You understood me correctly mate, thanks for the solution. – Itai Ganot Dec 3 '12 at 8:43

Set-Acl should work for AD objects as well. See this Scripting Guy article.

share|improve this answer
Can you please be more specific? – Itai Ganot Oct 21 '12 at 15:26
About what? The section "Using the Active Directory Provider" describes how to use Get-Acl on AD objects, so Set-Acl should work as well. Is there something specific that you need clarified? – Ansgar Wiechers Oct 21 '12 at 20:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.