Block Non-Admins from Remote Desktop Using Regedit

This guide explains how Windows administrators can configure the local registry using Regedit to restrict Remote Desktop Protocol (RDP) access strictly to members of the local Administrators group. By modifying the Remote Desktop listener settings and registry-level permissions, you can prevent standard, non-administrative user accounts from initiating remote sessions.

Prerequisites

• Administrative privileges on the target Windows machine.
• Access to the Windows Registry Editor (regedit.exe).

Step 1: Open the Registry Editor

1. Press Win + R to open the Run dialog.
2. Type regedit and press Enter.
3. If prompted by User Account Control (UAC), click Yes to run the Registry Editor as an administrator.

Step 2: Navigate to the Terminal Server WinStations Key

In the Registry Editor address bar, navigate to the following path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

Step 3: Modify Permissions on the RDP-Tcp Listener

By default, the Remote Desktop Users group is granted access to the RDP listener. Removing this group’s permissions directly via the registry restricts access solely to Administrators:

1. Right-click the RDP-Tcp key in the left navigation pane.
2. Select Permissions… from the context menu.
3. In the Group or user names section, select Remote Desktop Users.
4. Click Remove.
5. Ensure the Administrators group remains in the list with Full Control and Read permissions allowed.
6. Click Apply, then click OK.

Step 4: Verify Remote Desktop is Active

Ensure Remote Desktop is enabled for administrators by checking the following value:

1. In the left pane, click on: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
2. In the right pane, locate the DWORD value named fDenyTSConnections.
3. Double-click fDenyTSConnections and set its Value data to 0 (Enabled).
4. Click OK.

Step 5: Restart the Remote Desktop Service

To apply the permission changes immediately, restart the Remote Desktop service:

1. Press Win + X and select Terminal (Admin) or PowerShell (Admin).

2. Run the following command:

   Restart-Service -Name TermService -Force

Non-administrative users attempting to log in via Remote Desktop will now receive an error stating they do not have permission to sign in remotely.