Remote Desktop users and sessions on Windows Server

A new Windows server comes with one administrator account. As soon as more than one person works on it, give everyone their own login: you can see who changed what, revoke access for one person and set rights that fit each job. This guide shows how, and how Remote Desktop sessions behave.

Before you start

• Sign in as an administrator over Remote Desktop; see first steps on a Windows server.
• Open PowerShell as administrator (right-click Start, then Terminal (Admin) or Windows PowerShell (Admin)).

Step 1: Create a user

Create the account with a password you type at the prompt (it is not shown and not stored in your history):

$Password = Read-Host -AsSecureString
New-LocalUser -Name "alex" -Password $Password -FullName "Alex Doe" -Description "Developer"

User names can have up to 20 characters. Use a long, unique password for every account.

Step 2: Allow Remote Desktop

Choose the rights the person needs:

Add-LocalGroupMember -Group "Remote Desktop Users" -Member "alex"

Add-LocalGroupMember -Group "Administrators" -Member "alex"

The same setting is in System Properties (sysdm.cpl) › Remote › Select Users…, which adds users to Remote Desktop Users.

Verify:

Get-LocalGroupMember -Group "Remote Desktop Users"

Then sign in as the new user from another Remote Desktop window.

Step 3: Understand sessions

Each sign-in gets its own session with its own desktop and programs. Two rules matter in daily work:

• Disconnect keeps programs running. Closing the Remote Desktop window (or Disconnect) leaves the session and its programs running on the server. Use this for software that must stay online, such as trading platforms or long jobs.
• Sign out ends everything. Sign out from the Start menu closes all programs of that session.

Windows Server allows two administrative sessions at the same time. A third person gets a message that the number of connections is limited and can disconnect someone; see Remote Desktop connection problems.

See who is connected, and end a session that is no longer needed:

query user
logoff 3

query user lists each session with its ID, its STATE (Active or Disc for disconnected) and its idle time. logoff followed by the ID ends that session; unsaved work in it is lost.

Step 4: Limit idle and disconnected sessions (optional)

Disconnected sessions stay open indefinitely by default and keep using memory. To end them automatically, open the Local Group Policy Editor (gpedit.msc) and go to Computer Configuration › Administrative Templates › Windows Components › Remote Desktop Services › Remote Desktop Session Host › Session Time Limits. Set Set time limit for disconnected sessions to the time you want.

Step 5: Remove access

When someone leaves the team, disable or remove the account:

Disable-LocalUser -Name "alex"
Remove-LocalGroupMember -Group "Remote Desktop Users" -Member "alex"

Verify: Get-LocalUser -Name "alex" shows Enabled: False.

Troubleshooting

"The connection was denied because the user account is not authorized for remote login". The user is in neither Remote Desktop Users nor Administrators. Add them as in Step 2.

"The number of connections to this computer is limited". Two sessions are already open. Ask a colleague to sign out, or end an old session with query user and logoff.

A program closed although I only disconnected. A session time limit ended the session, or Windows restarted for updates. Check Step 4 and the update settings in fix Windows Update problems.

The new user cannot sign in with the password. Check the keyboard layout of your Remote Desktop client and that the account is enabled: Get-LocalUser -Name "alex".

Next steps

• Lock the server down: secure a new Windows Server.
• Fewer login attempts: change the Remote Desktop port.