Is there a possibility to disable the Windows XP SP2 Remote Desktop feature with a .bat file? I already tried to find a service and just stop and start it but I had no luck.

The background is that I have to run time critical tests on a remote pc, and I have to make sure that nobody is logging in while a test is running. The PC needs a network connection so I need something Remote Desktop specific.


Disable Remote Desktop:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d "1" /f

Enable Remote Desktop:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d "0" /f

It's worth noting that if you're using Group Policy to enable Remote Desktop, you should just use Group Policy to disable it. Else, you will need to tickle this key/value instead :

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\fDenyTSConnections

  • Will that terminate existing sessions though? Apr 1 '11 at 13:12
  • 1
    @Steve No, it only disables Remote Desktop, as per OP's question. If disconnecting active session is also a requirement, they should update their question's details.
    – jscott
    Apr 1 '11 at 13:19
  • @JScott - do either/both of those registry changes require restarting Windows to take effect?
    – mfinni
    Apr 1 '11 at 13:41
  • 1
    @mfinni No restart required, changing the value will immediately enable/disable Remote Desktop access.
    – jscott
    Apr 1 '11 at 13:45
  • 1
    There are two nice command line utilities exists with Windows 2000+: qwinsta.exe and rwinsta.exe (Query WIndows STAtion and Reset WNdows STAtion respectively). First one query Terminal Services/Remote Desktop Server and enumerates sessions, the second one allows to terminate session by session ID. I think using together it with REG cmd to disable Remote Desktop as specified above by jscott - i'ts a complete solution
    – Sergey
    Apr 1 '11 at 14:48

It seems like the following script is exactly what you need.

   REM ** Disable new logons
   change logon /disable
   REM ** Throw out all existing sessions by resetting the listener session
   for /f "tokens=2" %%i in ('qwinsta ^| find /i "listen"') do echo y | rwinsta %%i
   REM ** Maintenance jobs like backup comes here
   REM ** start /wait ensures that this job waits until the command
   REM ** is executed completely before going on to the next command
   start /wait <your maintenance command comes here>
   REM ** Maintenance is finished. Let users in again
   change logon /enable


  • That's nice too.
    – mfinni
    Apr 1 '11 at 15:04

OK, I was wrong on this point:

You can't, AFAIK. There is no service for this.

But this one still holds true.

You could block the RDP listening port, default is 3389.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.