How to Enable/Disable Remote Desktop Access Using Microsoft Intune

Navigate to the Microsoft Intune admin center and create a custom configuration profile. Traditional RDP isn't directly supported through standard Intune profiles, so we'll use OMA-URI settings.

Sign in to Microsoft Intune admin center at endpoint.microsoft.com. Go to Devices > Configuration > Create > New policy.

Select Windows 10 and later as the platform and Custom as the profile type. Name your policy something descriptive like "Enable RDP Access".

Click Add to create OMA-URI settings. Add the following two configurations:

Save the configuration and proceed to assignments.

Configure the assignment scope for your RDP policy to target specific device groups or users.

In the policy creation wizard, click Assignments. Select Add groups and choose the appropriate device groups that should have RDP enabled. You can also use filters to target specific device types or operating system versions.

For security purposes, avoid assigning to "All devices" unless your organization specifically requires universal RDP access. Instead, create targeted groups like "IT Admin Devices" or "Remote Work Laptops".

Review your assignments and click Create to deploy the policy.

Due to Intune's limitations with RDP configuration, deploy a PowerShell script to ensure proper registry and firewall settings.

Go to Devices > Scripts > Add > Windows 10 and later. Create a new PowerShell script with the following content:

# Enable Remote Desktop Registry Setting
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0 -Force

# Enable Network Level Authentication (recommended for security)
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name "UserAuthentication" -Value 1 -Force

# Enable Remote Desktop Firewall Rules
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

# Verify settings
$rdpEnabled = Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections"
$firewallRules = Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Where-Object {$_.Enabled -eq "True"}

if ($rdpEnabled.fDenyTSConnections -eq 0 -and $firewallRules.Count -gt 0) {
    Write-Output "RDP successfully enabled"
    exit 0
} else {
    Write-Output "RDP configuration failed"
    exit 1
}

Configure the script to run in System context and set PowerShell execution policy to Bypass. Assign to the same device groups as your OMA-URI policy.

Enable web account sign-in for Entra ID joined devices to allow domain authentication over RDP connections.

Create another custom OMA-URI policy specifically for Entra ID authentication. Use the following settings:

Additionally, deploy a registry script to enable the "Use a web account to sign in" option:

# Enable web account sign-in for RDP
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableWebSignIn" -Value 1 -PropertyType DWORD -Force

# Restart Remote Desktop Services
Restart-Service -Name "TermService" -Force

Write-Output "Web authentication enabled for RDP"

Verify that RDP is properly configured and accessible from client devices using the correct authentication format.

From a client machine, open Remote Desktop Connection (mstsc.exe). Enter the target computer's hostname (not IP address) in the format: computername.domain.com

When prompted for credentials, use the Entra ID format:

Username: AzureAD\user@yourdomain.com
Password: [Entra ID password]

Alternatively, you can use the UPN format directly: user@yourdomain.com

Test the connection and verify that you can successfully authenticate and access the remote desktop.

Verification commands to run on the target device:

# Check RDP service status
Get-Service -Name "TermService" | Select-Object Name, Status

# Verify RDP registry setting
Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections"

# Check firewall rules
Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Where-Object {$_.Enabled -eq "True"} | Select-Object DisplayName, Enabled

# Test RDP port accessibility
Test-NetConnection -ComputerName localhost -Port 3389

Set up Microsoft's official Remote Help solution as a more secure alternative to traditional RDP for IT support scenarios.

Navigate to Tenant administration > Roles in the Intune admin center. Assign built-in roles like Help Desk Operator to users who need remote access capabilities.

Configure Remote Help permissions for each role:

• View screen: Read-only access to user's screen
• Full control: Complete remote control capabilities
• Elevation: Ability to handle UAC prompts
• Unattended: Connect without user interaction (Android fully managed devices only)

Enable Remote Help tenant-wide by going to Devices > Configuration > Create > Administrative templates. Search for "Remote Help" and enable the appropriate settings.

Create a PowerShell script to verify Remote Help availability:

# Check if Remote Help is available
$remoteHelpApp = Get-AppxPackage -Name "Microsoft.RemoteHelp" -AllUsers
if ($remoteHelpApp) {
    Write-Output "Remote Help app is installed: $($remoteHelpApp.Version)"
} else {
    Write-Output "Remote Help app not found - will auto-install after policy deployment"
}

# Check Intune enrollment status
$enrollmentStatus = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Enrollments\*" -Name "EnrollmentType" -ErrorAction SilentlyContinue
if ($enrollmentStatus) {
    Write-Output "Device is Intune enrolled"
} else {
    Write-Output "Device enrollment status unclear"
}

Implement a policy to disable RDP access when remote access is no longer needed, following security best practices.

Create a new custom OMA-URI policy named "Disable RDP Access" with the following settings:

Create a corresponding PowerShell script to ensure complete RDP disabling:

# Disable Remote Desktop Registry Setting
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 1 -Force

# Disable Remote Desktop Firewall Rules
Disable-NetFirewallRule -DisplayGroup "Remote Desktop"

# Stop Remote Desktop Services
Stop-Service -Name "TermService" -Force
Set-Service -Name "TermService" -StartupType Disabled

# Verify settings
$rdpDisabled = Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections"
$firewallRules = Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Where-Object {$_.Enabled -eq "False"}

if ($rdpDisabled.fDenyTSConnections -eq 1 -and $firewallRules.Count -gt 0) {
    Write-Output "RDP successfully disabled"
    exit 0
} else {
    Write-Output "RDP disable configuration failed"
    exit 1
}

Implement monitoring and troubleshooting procedures to ensure RDP policies are working correctly across your device fleet.

Use Intune's built-in reporting to monitor policy compliance. Navigate to Devices > Monitor > Device configuration to view deployment status.

Create a comprehensive troubleshooting script that can be deployed on-demand:

# RDP Troubleshooting and Status Check Script

# Check RDP service
$rdpService = Get-Service -Name "TermService"
Write-Output "RDP Service Status: $($rdpService.Status)"

# Check registry settings
$rdpRegistry = Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections"
Write-Output "RDP Registry Setting (0=Enabled, 1=Disabled): $($rdpRegistry.fDenyTSConnections)"

# Check firewall rules
$firewallRules = Get-NetFirewallRule -DisplayGroup "Remote Desktop"
foreach ($rule in $firewallRules) {
    Write-Output "Firewall Rule: $($rule.DisplayName) - Enabled: $($rule.Enabled)"
}

# Check network connectivity
$rdpPort = Test-NetConnection -ComputerName localhost -Port 3389 -WarningAction SilentlyContinue
Write-Output "RDP Port 3389 Accessible: $($rdpPort.TcpTestSucceeded)"

# Check Intune management
$intuneStatus = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Enrollments\*" -Name "EnrollmentType" -ErrorAction SilentlyContinue
if ($intuneStatus) {
    Write-Output "Intune Enrollment: Active"
} else {
    Write-Output "Intune Enrollment: Not detected"
}

# Generate summary report
Write-Output "\n=== RDP Configuration Summary ==="
if ($rdpRegistry.fDenyTSConnections -eq 0 -and $rdpService.Status -eq "Running" -and $rdpPort.TcpTestSucceeded) {
    Write-Output "Status: RDP is properly configured and accessible"
} else {
    Write-Output "Status: RDP configuration issues detected"
    Write-Output "Recommended: Re-run RDP enable script or check Intune policy assignment"
}

Deploy this script to devices experiencing RDP issues for quick diagnostics.

Common troubleshooting steps:

• Verify device is Intune-enrolled and compliant
• Check that policies are assigned to correct device groups
• Ensure PowerShell execution policy allows script execution
• Confirm network connectivity and VPN requirements for Entra ID devices
• Review Windows Event Logs for Remote Desktop Services errors