# Remote Desktop users and sessions on Windows Server > Give each person their own Remote Desktop login, choose administrator or standard rights, know the two-session limit and keep programs running after disconnect. Difficulty: Beginner A new Windows server comes with one administrator account. As soon as more than one person works on it, give everyone their own login: you can see who changed what, revoke access for one person and set rights that fit each job. This guide shows how, and how Remote Desktop sessions behave. ## Before you start - Sign in as an administrator over Remote Desktop; see [first steps on a Windows server](/guides/windows-server-first-steps-rdp). - Open PowerShell as administrator (right-click **Start**, then **Terminal (Admin)** or **Windows PowerShell (Admin)**). ## Step 1: Create a user Create the account with a password you type at the prompt (it is not shown and not stored in your history): ```powershell $Password = Read-Host -AsSecureString New-LocalUser -Name "alex" -Password $Password -FullName "Alex Doe" -Description "Developer" ``` User names can have up to 20 characters. Use a long, unique password for every account. ## Step 2: Allow Remote Desktop Choose the rights the person needs: **Standard user** Members of **Remote Desktop Users** may sign in over Remote Desktop but cannot change system settings: ```powershell Add-LocalGroupMember -Group "Remote Desktop Users" -Member "alex" ``` **Administrator** Members of **Administrators** may sign in over Remote Desktop and manage the whole server: ```powershell Add-LocalGroupMember -Group "Administrators" -Member "alex" ``` The same setting is in **System Properties** (`sysdm.cpl`) › **Remote** › **Select Users…**, which adds users to **Remote Desktop Users**. **Verify:** ```powershell Get-LocalGroupMember -Group "Remote Desktop Users" ``` Then sign in as the new user from another Remote Desktop window. ## Step 3: Understand sessions Each sign-in gets its own session with its own desktop and programs. Two rules matter in daily work: - **Disconnect keeps programs running.** Closing the Remote Desktop window (or **Disconnect**) leaves the session and its programs running on the server. Use this for software that must stay online, such as trading platforms or long jobs. - **Sign out ends everything.** **Sign out** from the Start menu closes all programs of that session. Windows Server allows **two** administrative sessions at the same time. A third person gets a message that the number of connections is limited and can disconnect someone; see [Remote Desktop connection problems](/guides/rdp-connection-problems). See who is connected, and end a session that is no longer needed: ```powershell query user logoff 3 ``` `query user` lists each session with its **ID**, its **STATE** (`Active` or `Disc` for disconnected) and its idle time. `logoff` followed by the ID ends that session; unsaved work in it is lost. ## Step 4: Limit idle and disconnected sessions (optional) Disconnected sessions stay open indefinitely by default and keep using memory. To end them automatically, open the Local Group Policy Editor (`gpedit.msc`) and go to **Computer Configuration › Administrative Templates › Windows Components › Remote Desktop Services › Remote Desktop Session Host › Session Time Limits**. Set **Set time limit for disconnected sessions** to the time you want. > **Warning** > > Do not set this limit on servers that must keep a program running in a disconnected session, such as a MetaTrader terminal. The program closes when the session ends. ## Step 5: Remove access When someone leaves the team, disable or remove the account: ```powershell Disable-LocalUser -Name "alex" Remove-LocalGroupMember -Group "Remote Desktop Users" -Member "alex" ``` **Verify:** `Get-LocalUser -Name "alex"` shows `Enabled: False`. ## Troubleshooting **"The connection was denied because the user account is not authorized for remote login".** The user is in neither **Remote Desktop Users** nor **Administrators**. Add them as in Step 2. **"The number of connections to this computer is limited".** Two sessions are already open. Ask a colleague to sign out, or end an old session with `query user` and `logoff`. **A program closed although I only disconnected.** A session time limit ended the session, or Windows restarted for updates. Check Step 4 and the update settings in [fix Windows Update problems](/guides/fix-windows-update-problems). **The new user cannot sign in with the password.** Check the keyboard layout of your Remote Desktop client and that the account is enabled: `Get-LocalUser -Name "alex"`. ## Next steps - Lock the server down: [secure a new Windows Server](/guides/secure-windows-server). - Fewer login attempts: [change the Remote Desktop port](/guides/change-rdp-port). ## Frequently asked questions ### How many people can use Remote Desktop at the same time? Windows Server includes two simultaneous Remote Desktop sessions for administration. If more people must work on the server at the same time, the server needs the Remote Desktop Session Host role. ### Should everyone use the Administrator account? No. Give every person their own account, so you can see who did what and remove access without changing everybody's password. Make only those who manage the server administrators. ### Does closing the Remote Desktop window stop my programs? No. Closing the window disconnects the session, and programs keep running. Signing out from the Start menu ends the session and closes every program in it. ### Can I see who is connected right now? Yes. Run query user in a command prompt or PowerShell; it lists every session with its ID, state and idle time. --- Source: \ Updated: 2026-10-15