My account and my admins can remote into any machine on the network, but standard users get an "user not authorized" error. The only solution I've found is to manually add the users to the Approved Remote Users on the local machine. How can I do this server side?

I have everyone added to the Remote Desktop Users and the Remote Desktop Users enabled in the GPO Local Policy -> User Rights Assignment -> Allow terminal services (remote desktop) users. I figured this would be enough but the only way I have been able to make it work thus far, is to add these groups manually to the users machines.

When I go to remote in, I get a "the connection was denied because the user account is not authorized for remote login"

Remote desktop select users

2 Answers 2


As you said, you need to add the to the local Remote Desktop Users group. If you want to set it up "server side", the solution is to create an AD group, add the needed accounts to that group, then create a GPO setting "Restricted groups":


  • I'll give this a try this weekend and let you know the results.
    – tjcinnamon
    May 19, 2016 at 14:15
  • This worked perfect. On my non-DC and server policy I added a resricted group of Remote Desktop users and then needed to add that group to allow terminal services (Remote desktop) in User Rights Assignemtn
    – tjcinnamon
    May 21, 2016 at 16:51
  • Glad to hear it helped! :)
    – curropar
    May 23, 2016 at 8:30

The domain Remote Desktop Users group is for granting access to your Domain Controllers, not your RDS servers. You need to add your domain users and/or groups to the local Remote Desktop Users group on each of your RDS servers.

This article was written for Windows Server 2003 but is applicable as it relates to the usage and purpose of the domain Remote Desktop Users group:


  • Thanks for responding. I'm not looking for users to remote into servers. I want to sit at my and be able to login as them to their machines. We're a small shop so I have everyone's password. It's easier to maintain things than walking around to every machine. Does this still apply? I looked at the article and couldn't figure out how to make it local
    – tjcinnamon
    May 17, 2016 at 15:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .