“To sign in remotely, you need the right to sign in through Remote Desktop Services”: fix

What the error means

The full message reads: To sign in remotely, you need the right to sign in through Remote Desktop Services. By default, members of the Administrators group have this right. It’s followed by a note that the right may need to be granted manually. Older Windows versions showed a similar message about the Allow log on through Terminal Services right.

Microsoft’s documentation says a user needs two things to connect: membership of the Remote Desktop Users or Administrators group, and the Allow log on through Remote Desktop Services user right for that group. A separate right, Deny log on through Remote Desktop Services, overrides the Allow right whenever both apply to the same account. So the error comes down to one of three things: the user isn’t in an allowed group, the Allow right no longer includes that group, or a Deny entry catches the user.

Check these first

• The remote PC runs Pro, Enterprise or Education. Microsoft says Windows Home can’t act as a Remote Desktop host, though you can connect from it. See how to upgrade Windows Home to Pro if you need to host.
• Remote Desktop is on. On the remote PC, open Settings > System > Remote Desktop and make sure it’s switched on.
• You’re using the right account format. For a local account use PCNAME\username, for a domain account DOMAIN\username. For a Microsoft account, type the full email address. If the password is refused instead, that’s a different problem; see The password is incorrect.

Fix 1: Add the user to Remote Desktop Users

Sign in to the remote PC with an administrator account. In Settings > System > Remote Desktop, open Remote Desktop users (older builds say Select users that can remotely access this PC), select Add, enter the user name and select OK. Microsoft notes that once Remote Desktop is enabled, administrators plus any users you add here can connect.

You can also do it from an administrator Command Prompt:

net localgroup "Remote Desktop Users" USERNAME /add

Use DOMAIN\username for a domain user. In PowerShell, Add-LocalGroupMember -Group "Remote Desktop Users" -Member "USERNAME" does the same, and Get-LocalGroupMember -Group "Remote Desktop Users" lists who’s in the group. On Pro editions you can also use Computer Management > Local Users and Groups > Groups > Remote Desktop Users.

Fix 2: Check the Allow and Deny rights

If the user is in the right group and still gets the error, the user right itself has probably been changed, for example by a security baseline. On the remote PC, press Win + R, run secpol.msc and go to Security Settings > Local Policies > User Rights Assignment. The same settings are under Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment in gpedit.msc.

• Open Allow log on through Remote Desktop Services. On a normal PC or member server it should list Administrators and Remote Desktop Users. Add whichever is missing with Add User or Group.
• Open Deny log on through Remote Desktop Services. By default nothing is listed. If it contains the user, or a group they belong to, that entry wins. Remove it only if you know why it was added, because security baselines sometimes deny broad groups on purpose.

Then run gpupdate /force. Microsoft says no restart is needed: the change applies the next time the user signs in.

Fix 3: Find a domain policy that overrides you

On a domain-joined PC, the lists in secpol.msc may be greyed out, or your changes may disappear after a while. That means a domain Group Policy sets the right, and Microsoft notes that Group Policy settings override local security policy. A user-rights setting in a GPO replaces the local list rather than adding to it.

To find which policy is responsible, run this from an administrator Command Prompt on the remote PC, then open the file and look under User Rights Assignment for the Winning GPO:

gpresult /h C:\gp.html

An admin then edits that GPO in the Group Policy Management Console under Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment. If you don’t have the console yet, see how to install Group Policy Management on Windows 11.

Domain controllers

Domain controllers are stricter. Microsoft lists the default for the Allow right on a DC as Administrators only, without Remote Desktop Users, and its troubleshooting guide notes that only domain admins can use RDP to a DC by default. Local Users and Groups isn’t available on a DC, so add users to the Remote Desktop Users group in the Builtin container of Active Directory Users and Computers, then add that group to the Allow right in the Default Domain Controllers Policy. Think carefully before doing this, since RDP access to a DC is a security risk.

Entra ID and Microsoft account PCs

For PCs joined to Microsoft Entra ID, Microsoft says only the user who joined the device can connect without extra setup. Add others with this command, using their full sign-in address:

net localgroup "Remote Desktop Users" /add "AzureAD\[email protected]"

Microsoft also notes that adding an Entra group (rather than individual users) to Remote Desktop Users isn’t honored for RDP sign-ins with Network Level Authentication on. For a home PC signed in with a Microsoft account, users often add it as MicrosoftAccount\[email protected]; that format is widely used but isn’t in Microsoft’s documentation.

If a Hyper-V virtual machine’s console shows the error, Microsoft Q&A users report that switching off Enhanced Session Mode helped when every right was already correct.

Default settings

These are Microsoft’s documented effective defaults:

Computer type	Allow log on through Remote Desktop Services	Deny log on through Remote Desktop Services
Windows client PC	Administrators, Remote Desktop Users	Not defined
Member or stand-alone server	Administrators, Remote Desktop Users	Not defined
Domain controller	Administrators	Not defined

If a related sign-in failure mentions the Group Policy Client service instead, see The Group Policy Client service failed the sign-in.

Related guides

• Group Policy Management Console on Windows 11: how to install and open it
• How to upgrade Windows 10 Home to Pro (3 ways)
• “The password is incorrect. Try again” at Windows sign-in: how to fix it
• The Group Policy Client service failed the sign-in: how to fix it
• Remote Desktop “The function requested is not supported”: how to fix it

Official sources

• Allow log on through Remote Desktop Services (Microsoft Learn)
• Deny log on through Remote Desktop Services (Microsoft Learn)
• Allow access to your PC with Remote Desktop (Microsoft Learn)