Block users to access RDS - Windows Server 2016

Matheus PD 1

I have a Windows Server 2016 with 6 RDS licenses per user. It is not a domain controller.

I realized that, other users accidentally accessed the RDP server and consumed the license, is it possible to block everyone's access and allow only the 6 users that I designate or allow a specific group with these 6 users? (I will have to wait 90 days for it to be possible to revoke the license of people who accidentally accessed the server.)

Thank you in advance.

2 answers

Andriy Bilous 11,531 Reputation points MVP

2021-03-22T12:33:34.47+00:00

Hello @Matheus PD
Yes, you can restrict access to your RDS server.
Login into RDS server itself > Windows Key+R > systm.cpl > Remote > Remote Desktop > Select Users > Add as appropriate.

If you have RDS Session Collection please specify appropriate User Group that should have access to your RDS server
https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/rds-user-management
Please sign in to rate this answer.
Matheus PD 1 Reputation point

2021-03-23T11:48:46.177+00:00

Hi Andriy tks for the tips.

I followed the guidance of the "RDS Session Collection" and it worked, the user who does not have access has actually been restricted.

However, I encountered another problem. This user who tried to access and was restricted appeared in my "RD Licensing Manager", reserving a license for two months.

This is worrying to me, if a user tries to access the server by mistake, he can reserve a license from another user who needs this access.

Do you know how I can restrict this?

Matheus PD 1 Reputation point

2021-03-23T11:52:59.467+00:00

I forgot the image.

Andriy Bilous 11,531 Reputation points MVP

2021-03-24T08:51:17.23+00:00

This is known issue https://social.technet.microsoft.com/Forums/en-US/2b30dd2d-3e61-4ca0-9aea-87acd8ad7398/rds-2016-user-cal-license-issued-although-user-has-no-access-rights-to-the-server?forum=winserverTS
Lets wait Microsoft answer
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Karlie Weng 18,586 Reputation points Microsoft Vendor

2021-03-23T05:59:10.697+00:00

Hello @@Matheus PD

You may also change the Remote Desktop Users Group members from everyone to user you want.

Computer Management> Groups > double click Remote Desktop Users Group> add user to this group.

If you add everyone which means all connecting sessions will be admitted.

Best Regards
Karlie

----------

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Andriy Bilous 11,531 Reputation points MVP

2021-03-24T08:52:24.677+00:00

Could you please assist with an issue "his user who tried to access and was restricted appeared in my "RD Licensing Manager", reserving a license for two months."

https://social.technet.microsoft.com/Forums/en-US/2b30dd2d-3e61-4ca0-9aea-87acd8ad7398/rds-2016-user-cal-license-issued-although-user-has-no-access-rights-to-the-server?forum=winserverTS

Matheus PD 1 Reputation point

2021-03-24T10:28:51.123+00:00

@Andriy Bilous It is exactly my case, but there was no resolution.

A user receives this message:

The connection was denied because the user's account is not authorized for remote login

But although the user receives the error message, a USER CAL is issued to the disallowed user

Boon Han Ong 0 Reputation points

2024-05-24T14:22:46.87+00:00

HI,

We have our RDS Servers setup. How can i restrict a group of users to only connect to a specific RDS server only?

For example:

We have 2 RDS servers. Our "Accounting group" of users have access to RDS Virtual Machine to run our application and they need to sign into their onedrive. For some weird reason, if they connect to our RDS1 server, their OneDrive will always sync and updated but if they connected to RDS2, their OneDrive would not get updated or out of sync.

Our Goal is to find out how can we configure such that Accounting Group of users only connect to RDS1 server while "Frontline group" of users will only connect to RDS2 server?

What i have tried:

In RDS1 server > Remote Setting > Only Accounting Group were added to allow Remote Desktop.

In RDS2 Server > Remote Setting > Only "Frontline group" was added to allow remote desktop.

When i ask the accounting Group user to try connecting, they still get connected to RDS2 server.

Is this something that can be configure in the gateway server?

Thanks

Boon
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Block users to access RDS - Windows Server 2016

2 answers

Your answer