How to define an GPO for Remote desktop User for specify Computer and user

Question

How to define an GPO for Remote desktop User for specify Computer and user

SSE@TUE 300

Hi,

How can I create an GPO for RDP Connection that user X does allow connect to the Computer Y?

It mean the User X can connect only to the Computer Y.

Regards

Nick

Answer accepted by question author

1 additional answer

Your answer

Answer 1

Marcin Policht 81,790 MVP Volunteer Moderator

To allow User X to connect via RDP only to Computer Y, you need to control two things: where the user is allowed to log on through Remote Desktop Services, and ensure they are denied everywhere else.

First, on Computer Y, make sure User X is allowed to log on via RDP. In Group Policy, create or edit a GPO that applies only to Computer Y (link it to the OU containing Computer Y). Go to Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → User Rights Assignment. Configure “Allow log on through Remote Desktop Services” and add either User X directly or, preferably, a security group that contains User X. Also ensure User X is not listed in “Deny log on through Remote Desktop Services” in that same GPO.

Next, prevent User X from connecting to any other computers. Create another GPO that applies to all other computers (for example, link it at the domain level or to the relevant OUs, excluding Computer Y). In that GPO, go to Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → User Rights Assignment and configure “Deny log on through Remote Desktop Services” to include User X (or the group containing User X). Because deny rights override allow rights, make sure this deny GPO does not apply to Computer Y. You can exclude Computer Y either by placing it in a separate OU and not linking the deny GPO there, or by using security filtering so the deny GPO does not apply to Computer Y.

A clean design is to create a group such as “RDP-Only-ComputerY”, add User X to it, allow that group in the “Allow log on through Remote Desktop Services” setting on Computer Y, and configure a domain-wide GPO that denies that same group the “Log on through Remote Desktop Services” right, excluding Computer Y from that deny GPO scope. After configuring, run gpupdate /force on the target machines and verify effective rights with rsop.msc or gpresult /h report.html.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

SSE@TUE 300 Reputation points

2026-03-03T06:36:19.5666667+00:00

Thank you for your replay. I have many Users and Computers. According to your description I have to create many OUs and GPOs for all the users and Computers.

for example user Z, T, R, Computer Z, T, R, and so on.
Marcin Policht 81,790 Reputation points MVP Volunteer Moderator

2026-03-03T12:12:14.77+00:00

You do not need to create many OUs and many GPOs. The scalable approach would be to use security groups and a single deny GPO that applies broadly, combined with per-computer local group membership control.

Create one domain GPO linked high in the domain (for example at the domain root or to all workstation/server OUs) that configures “Deny log on through Remote Desktop Services”. In that setting, add a single domain group such as RDP-Restricted-Users. Do not apply this GPO to Domain Controllers unless required. This GPO will deny RDP to all members of that group on all computers it applies to.

Then do not use “Allow log on through Remote Desktop Services” in GPO for normal delegation. Instead, control access per computer by managing membership of the local “Remote Desktop Users” group on each machine. By default, only Administrators and members of Remote Desktop Users can log on via RDP.

For each computer, create a domain global group that represents who may RDP to that specific computer, for example RDP-ComputerY, RDP-ComputerZ, and so on. Add the appropriate users to each of those groups. Then use one additional GPO with Group Policy Preferences linked to all computers to manage local group membership. In Computer Configuration → Preferences → Control Panel Settings → Local Users and Groups, create a Local Group item that targets the local group “Remote Desktop Users” and add the corresponding domain group. Use Item-level Targeting so that RDP-ComputerY is added only when the computer name equals ComputerY, RDP-ComputerZ only when the computer name equals ComputerZ, and so forth. This way you still use a single GPO.

Effectively, all restricted users are members of RDP-Restricted-Users, so they are denied RDP everywhere by default. They are also members of one or more per-computer RDP-ComputerX groups. On each computer, only its matching RDP-ComputerX group is added to the local Remote Desktop Users group. Because the deny GPO applies everywhere, you should exclude the target computer from the deny scope. The method is to security-filter the deny GPO so it does not apply to computers that should allow specific users, or create a second allow GPO for those computers that defines “Allow log on through Remote Desktop Services” explicitly and ensure the deny GPO does not apply there. Deny always overrides allow, so scope control is critical.

In practice, the large-scale design is to avoid the Deny right entirely and instead simply not grant RDP access except through the local Remote Desktop Users group managed centrally. If a user is not in the local Remote Desktop Users group of a machine and is not an administrator, they cannot RDP to it. This removes the need for many OUs and many GPOs and scales well with many users and many computers.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Answer 2

SSE@TUE 300

Thank you for your replay. I have many Users and Computers. According to your description I have to create many OUs and GPOs for all the users and Computers.

for example user Z, T, R, Computer Z, T, R, and so on.

Share via

How to define an GPO for Remote desktop User for specify Computer and user

1 additional answer

Your answer