How to create a user in Windows Server and allow RDP connection
This guide shows how to create a local user on Windows Server and grant that user access over Remote Desktop. The process has two parts: creating the account, then allowing it to connect remotely.
Creating a user
You can create a user through the graphical interface or with a single command. Both produce a standard local account.
Graphical interface
Open the Local Users and Groups snap-in. Press Win+R, type lusrmgr.msc and press OK.
Open the Users folder, right-click an empty area and choose New User.
Fill in the user name and a password that meets the security rules, set the password options you need, then press Create.
The new account now appears in the Users list.
Command line
Open Command Prompt or PowerShell as administrator and run a single command, replacing the name and password with your own:
net user newuser "StrongP@ssw0rd" /add
On modern systems you can use the PowerShell cmdlet instead of the older net user utility:
New-LocalUser -Name "newuser" -Password (ConvertTo-SecureString "StrongP@ssw0rd" -AsPlainText -Force) -Description "RDP user"
The password must meet the server password policy, otherwise the command returns a policy error. Use a strong password with upper and lower case letters, digits and symbols.
Allowing RDP connection
Creating the user is not enough on its own. Remote Desktop must be turned on at the server level, and the user must belong to the group that is permitted to connect.
Enable Remote Desktop on the server
Open System Properties. Press Win+R, type sysdm.cpl and press OK. Go to the Remote tab and select Allow remote connections to this computer.
On Windows Server 2022 and later you can also turn Remote Desktop on under Settings, System, Remote Desktop, the same way as on Windows 10 and 11. That screen lets you pick the allowed users in the same place. The sysdm.cpl method works on every supported version.
Keep the option Allow connections only from computers running Remote Desktop with Network Level Authentication enabled. It adds an authentication layer before the session starts and is the safer choice.
The same result can be achieved from PowerShell. Run it as administrator:
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -Value 0 Enable-NetFirewallRule -Name "RemoteDesktop-UserMode-In-TCP","RemoteDesktop-UserMode-In-UDP" Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'UserAuthentication' -Value 1
The first line turns Remote Desktop on, the second opens the firewall rules, and the third ensures that Network Level Authentication is enabled for the RDP listener.
The firewall rules are opened by their internal names rather than by display group. The display group name is translated on localised systems, while the names stay the same on a server in any language. Both the TCP and UDP rules are enabled here, which matches what the graphical method does. The UDP rule is optional, but it improves responsiveness over high-latency links.
Turning Remote Desktop on through the registry does not open the firewall by itself. The second command opens the Remote Desktop rules in Windows Firewall. When you use the graphical method instead, the firewall rules are opened for you automatically.
Check that Remote Desktop is enabled
To confirm the current state, run this command in PowerShell:
Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections'
If the value is 0, Remote Desktop is enabled.
Add the user to the Remote Desktop Users group
Local Administrators are allowed to connect through Remote Desktop by default. A standard user needs to be added to the Remote Desktop Users group. The quickest way is a single command, run as administrator:
net localgroup "Remote Desktop Users" newuser /add
To confirm that the user was added, list the members of the group:
net localgroup "Remote Desktop Users"
If you prefer the graphical interface, press Win+R, type lusrmgr.msc and press OK. Open Groups, double-click Remote Desktop Users, press Add, enter the user name, press Check Names and then OK.
On a localised Windows Server the group is named in the system language, for example Пользователи удаленного рабочего стола on a Russian system, and the command above returns System error 1376. Use the local name, or address the group by its language-independent SID, which is always S-1-5-32-555:
Get-LocalGroup -SID S-1-5-32-555 | Add-LocalGroupMember -Member "newuser"
The same principle applies to domain users. On a server joined to a domain, add the account in the form DOMAIN\user instead of a local name.
lusrmgr.msc opens the same Local Users and Groups snap-in directly, without adding it to a blank console by hand. It is the fastest route to the group settings.
Verify Remote Desktop logon rights
On domain controllers or servers with hardened policies, group membership alone may not be enough. Open the Local Security Policy. Press Win+R, type secpol.msc and press OK, then go to Local Policies, User Rights Assignment, and open Allow log on through Remote Desktop Services. The Remote Desktop Users group must be listed there.
On domain controllers this setting is managed through Group Policy rather than Local Security Policy. By default a domain controller does not let the Remote Desktop Users group sign in over RDP, so the group has to be added explicitly to Allow log on through Remote Desktop Services in the Default Domain Controllers Policy. This is a common reason why connecting to a domain controller fails even after the user is in the group.
Checking the connection
The user can now connect to the server over Remote Desktop with the new credentials. To test it, open the Remote Desktop client. Press Win+R, type mstsc.exe and press OK, then enter the connection details.
Server: IP address or hostname Username: newuser Password: the password specified during creation
A successful sign-in confirms that the account, the Remote Desktop setting and the group membership are all configured correctly.
