Can we disable the RDP Application/Connection when Entra ID authentication is used

Question

System is authenticating with Entra ID.
Want to disable the Remote Desktop Application / Connection or prohibit user to take a remote session of any system.

Answer 1

Hello @Mayank Suhane,

Thank you for posting your query on Microsoft Q&A.

Based on your description, it sounds like you're looking to disable Remote Desktop Connection or prevent users from initiating a remote session when they are logged into the system with Entra ID.

Here are the steps you can follow to disable Remote Desktop or prohibit remote sessions:

Method 1: Disable Remote Desktop through Group Policy

1. Open the Group Policy Editor (gpedit.msc) on a domain controller or a system with the Group Policy Management Console installed.
2. Navigate to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections.
3. Enable the policy "Allow users to connect remotely using Remote Desktop" and set it to "Disabled".
4. Apply the policy to the desired OU or domain.

Method 2: Disable Remote Desktop through Registry

1. Open the Registry Editor (regedit.exe) on the system you want to disable Remote Desktop on.
2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server.
3. Create a new DWORD (32-bit) value named "fDenyTSConnections" and set its value to 1.
4. Restart the system for the changes to take effect.

Method 3: Disable Remote Desktop through Intune

Go to Microsoft Intune admin center. Create a custom profile and deploy this profile to the device group you want.

Select Devices > Manage devices > Configuration > Create > New policy.

Platform: Choose the platform of your devices. Your options:

Profile type: Select Custom. Or, select Templates > Custom.

Name: Set a name for this profile.

• OMA-URI setting: ./Device/Vendor/MSFT/Policy/Config/RemoteDesktopServices/AllowUsersToConnectRemotely

Data Type: String

Value: <disabled />

Alternatively, you can create an administrative template with the setting "Require user authentication for remote connections by using Network Level Authentication" to disable remote access.

https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-remotedesktopservices#allowuserstoconnectremotely

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Thanks,
Raja Pothuraju.