Configuring Remote Desktop access on a server without locking yourself out

Goal

Enable Remote Desktop on a Windows Server host, keep Network Level Authentication on, restrict who may sign in, and know how to see and end active sessions — all from a script, without depending on the machine's own RDP session to make the change (which would disconnect mid-change).

Prerequisites

Local administrator rights; a connection method other than RDP itself for making the initial change remotely (PowerShell remoting, a management console, or physical/iLO access), since enabling RDP from inside an RDP session is safe but disabling it is not.

Steps

1. Check current state before changing anything: Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name fDenyTSConnections. Microsoft's own RDP troubleshooting guidance documents that a value of 1 means RDP is disabled and 0 means it is enabled.
2. Enable it: Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name fDenyTSConnections -Value 0.
3. Open the firewall rule group so connections can actually reach it: Enable-NetFirewallRule -DisplayGroup "Remote Desktop" (the display name is localized; -Group "@FirewallAPI.dll,-28752" works on any language).
4. Leave Network Level Authentication (NLA) on unless a specific legacy client cannot support it — UserAuthentication = 1 under HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp: Microsoft's guidance on allowing remote access states that NLA "adds an extra layer of security to Remote Desktop connections" by requiring authentication before a session is established, reducing exposure to unauthenticated attacks against the session stack.
5. By default Administrators and members of the built-in Remote Desktop Users group may sign in; grant non-administrators access through that group rather than making them administrators (Add-LocalGroupMember -Group "Remote Desktop Users" -Member "CONTOSO\jdoe"). On a domain controller the "Allow log on through Remote Desktop Services" right is granted only to Administrators by default; domain controllers have no local groups, so the domain's Builtin Remote Desktop Users group would open every domain controller — leave that default in place.
6. Session limits (idle and disconnected timeouts) are controlled by policy values including MaxIdleTime, MaxDisconnectionTime and MaxConnectionTime (milliseconds), set under Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Session Time Limits in Group Policy, or the equivalent registry values under the Terminal Services policy key.
7. Before disconnecting anyone, see who is actually connected: quser /server:SRV1. To end a specific session found there: logoff <ID> /server:SRV1 — this discards unsaved work in that session.

Expected result

quser lists active and disconnected sessions with their session IDs; only Administrators and members of Remote Desktop Users can establish a new RDP session; a client without NLA support is refused rather than silently downgraded.

Limits and test basis

fDenyTSConnections's two states are documented in Microsoft's RDP troubleshooting guide; the Remote Desktop Users group and NLA guidance are documented in Microsoft's remote-access and RDS security-rights articles; MaxIdleTime/MaxConnectionTime appear in Microsoft's RDS session-behavior troubleshooting documentation; quser and logoff are documented Windows commands. To undo: set fDenyTSConnections back to 1 and Disable-NetFirewallRule -DisplayGroup "Remote Desktop" — do this from a connection method other than the RDP session being closed. No reboot is required for any of these settings to take effect for new sessions; group-membership and policy changes apply at the next sign-in, not to a session already open.