Enable RDP via Intune

Johannes Ebner 236

Hi,

I have 4 AzureAD joined Clients in a network. I want to enable RDP connection for my Admin Account to the Clients.
Myself will connect via VPN to the Network with the Clients.

How could I achieve this?

Br,
Johannes

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
0xjoe 15 Reputation points

2024-01-04T21:26:14.0533333+00:00

Hi Jatin,

Thanks for the tip on the Settings Catalog. I followed the guide, and all seemed to be going well. The configuration profile was successfully deployed to the endpoints. I also noticed that on the hosts, the Remote Desktop Settings indicate that "Some settings are managed by your organization," which is a good sign. The problem is that the Remote Desktop Setting toggle on the endpoint is set to Off and greyed out. On the configuration profile, I have it set to "Enabled" to Allow users to connect remotely by using RDP. I'm not sure what the problem is. I hope you can share some insight.
JamesCFI 1 Reputation point

2024-06-18T20:19:58.6833333+00:00

So i have this same issue, I have the policy configured

control panel says "Remote Desktop OFF" and managed by my organization (which is me im the admin trying to fix this for some users).

MDM logs says otherwise

The only thing that sort of caught my eye was Remote Desktop - User Mode (UDP-In) & Remote Desktop - User Mode (TCP-In) were both set to disabled.

I enabled those firewall policies on the target endpoint and then i enabled "Use a web account to sign in to the remote computer" option in the Advanced tab of the remote desktop settings connectoid.

Decided to test this and BOOM, connected... do I know why? no clue.. don't care it "works" for now and it at least is a work around, pretty sure it wont be temporary eh... eh? 😔

Is this right? no clue, again dont care the policy technically has this enforced to on for everyone so at most im "fixing" the problem, maybe MS should make it easier to trouble shoot intune policies because rsop dont work, gpresult don't work, a bunch of 3rd party bots are on the other top answers telling people "oh gee this product over here has the thing you need wink wink"

Some notes

must use the name of the endpoint, im assuming because of certs, and the username is your o365 user or AzureAD\email, lock screen doesnt work you instead get disconnected.

And im assuming you must still enable "Allow users to connect remotely by using Remote Desktop Services" in intune even though it shows off in the panel.

other info: https://learn.microsoft.com/en-us/windows/client-management/client-tools/connect-to-remote-aadj-pc

hopefully the next person that finds this post figures out the rest of whatever is going on

windows 11 latest update as of the posting with AADJ device up in entra using e3 azure/entra, yes intune license and yes other intune device settings work, the "Allow users to connect remotely by using Remote Desktop Services" is only showing set to the user and not the device in the console but the MDM report shows its on the device

again no clue, dont care it works/whatever

Accepted answer

Lu Dai-MSFT 28,441 Reputation points

2020-12-04T07:10:04.963+00:00
@Johannes Ebner Thanks for posting in our Q&A. From your description, I know that you want to enable RDP connection for his admin account to AzureAD joined clients via intune. If there is any misunderstanding, feel free to let us know.

To achieve this operation, we need to configure remote settings and get the RDP configure file.
For configuring remote settings in intune, here are the detailed steps for the reference:

Go to Microsoft Endpoint manager admin center. Create a custom profile and deploy this profile to the device group you want.
Name : Set a name for this profile.
OMA-URI setting: ./Device/Vendor/MSFT/Policy/Config/RemoteDesktopServices/AllowUsersToConnectRemotely
Data Type: String
Value: <enabled />

After the profile deploy successfully, we can find the remote setting is changed.

To make clients get the RDP configure file, my thought is that we can create the RDP configure file in step2 in the link that RahulJindal improved. Then, put RDP configure file in an accessible location, write a PowerShell script to download this RDP configure file.

Hope it can help.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.

2 people found this answer helpful.
Luca Chana 11 Reputation points

2021-04-22T15:15:18.557+00:00

After making the policy in intune and seeing that it's applied to the devices, I see the remote settings are correct and enabled via control panel but when I look in the settings app it shows disabled and I cannot connect. It shows "Some settings are managed by your organisation" with "Enable Remote Desktop" as off? EDIT: To fix I had to run these powershell commands to enable RDP and open the firewall... Would think that intune would automatically open the firewall but ok.

Tiago Marques 1 Reputation point

2022-02-24T18:36:37.047+00:00

Thank you, really helped.. tho ive got some regards using NLA... how to enable it on intune? (endpoint manager)

Is there an OMA-URI for that too? I lost connection with my devices, theyre azureAD joined...

Thankx in advance

Lu Dai-MSFT 28,441 Reputation points

2022-02-25T00:52:26.75+00:00

@Tiago Marques This setting "Require user authentication for remote connections by using Network Level Authentication" under Administrative Templates may make it.

Tiago Marques 1 Reputation point

2022-02-25T09:59:21.317+00:00

@Lu Dai-MSFT thank you, that did the job!

Cheers!

James Denis 11 Reputation points

2022-05-17T17:01:20.72+00:00

So I'm running into a similar issue as well, I was able to get remote assistance with NLA toggled on in advanced system settings but under settings>system>remote desktop : the icon is toggled off and grayed out.

Can you share what powershell commands you needed to run to enable RDP and add the firewall rule you needed to allow the incoming connections?

0xjoe 15 Reputation points

2024-01-04T21:35:59.3833333+00:00

Yes please I would love to get some insight into this. Thanks
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

8 additional answers

Vladimir Nekic 22 Reputation points

2022-04-14T12:16:06.567+00:00

April 14, 2022 - Many changes have happened and many new addtions. Let get this thread updated for admins trying to find the 'EASY' button and not all this old trash.
Please sign in to rate this answer.

2 people found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Rahul Jindal [MVP] 10,601 Reputation points MVP

2020-12-03T23:19:15.217+00:00

Hi,

This will basically involve making changes in the rdp config file. There is a great blog written by Niall Brady that covers the entire process which you can find here. how-can-i-rdp-to-an-azure-ad-joined-windows-10-device
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Johannes Ebner 236 Reputation points

2020-12-04T07:47:08.21+00:00

@Lu Dai-MSFT

If I understand you correctly I only need 1 and 2 and then I should be already able to RDP to the Clients?
Please sign in to rate this answer.
Lu Dai-MSFT 28,441 Reputation points

2020-12-04T09:36:35.933+00:00

@Johannes Ebner Thanks for your response.
When you just do 1 and 2, you can use local admin account to RDP to the clients.

If you want to use AzureAD account to RDP to the clients, please continue to put RDP configure file in an accessible location and create a PowerShell script to download this RDP configure file.

Hope it can help.

Lu Dai-MSFT 28,441 Reputation points

2020-12-08T06:10:42.48+00:00

@Johannes Ebner I am currently standing by for further update from you and would like to know how things are going. If you have any questions or concerns on the recent information I've provided you, please don't hesitate to let me know.

Thanks and have a nice day.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Johannes Ebner 236 Reputation points

2020-12-08T07:46:07.13+00:00

@Lu Dai-MSFT , thanks for asking.

1 and #2 I got working, I am still struggeling with the RDP Config file.

Br,
Johannes
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Enable RDP via Intune

8 additional answers

1 and #2 I got working, I am still struggeling with the RDP Config file.

Your answer