Add Remote Desktop Users in Windows: Full Guide

To add remote desktop users in Windows, you grant specific accounts permission to connect via Remote Desktop (RDP). You can do this through the System Properties dialog, Settings app, or Command Prompt, depending on your Windows edition and whether the user is a local account or a Microsoft account.

What Remote Desktop User Permissions Actually Do

Remote Desktop (RDP) is a built-in Windows feature that lets another computer connect to your PC over a network or the internet. By default, only members of the Administrators group and the Remote Desktop Users group can log in remotely. Adding a user simply places that account into the Remote Desktop Users group, or explicitly lists it in the RDP permissions. This does not give them file access or administrative control—it only allows them to start an interactive session on the machine.

There are two types of accounts you can add: local accounts (created on that PC, e.g., PCName\John) and Microsoft accounts (e.g., user@outlook.com). The process differs slightly because Microsoft accounts are identified by their email address, not a username.

Method 1: Using System Properties (All Windows Versions)

This is the classic method that works on Windows 10 Pro, Enterprise, and Windows 11 Pro and above. It is the most direct way to add a user if you already know the account name.

1. Press Win + R, type sysdm.cpl, and hit Enter.
2. Go to the Remote tab.
3. Under “Remote Desktop,” check “Allow remote connections to this computer.”
4. Click Select Users.
5. Click Add, then type the username (e.g., John or PCName\John) and click Check Names to validate.
6. Click OK on all open dialogs.

If you are adding a Microsoft account, type the full email address (e.g., user@outlook.com) and click Check Names. Windows will resolve it to the correct format.

Note: If the user is already an administrator, they are implicitly allowed—you do not need to add them. However, adding them explicitly to the Remote Desktop Users group is harmless and can be useful if you later remove their admin rights.

Method 2: Using the Settings App (Windows 10/11)

For Windows 10 and 11, the Settings app provides a more visual interface, but it only lets you add users who already exist on the system.

1. Open Settings > System > Remote Desktop.
2. Toggle on “Enable Remote Desktop.”
3. Click Confirm if prompted.
4. Click Remote Desktop Users (or “Select users that can remotely access this PC”).
5. Click Add, enter the username, and click Check Names.

This method is essentially a wrapper around the same underlying group membership. It is slightly slower than sysdm.cpl but more discoverable for less technical users.

Method 3: Using Command Line (net localgroup)

If you prefer the command line or need to script this for multiple machines, use the net localgroup command in an elevated Command Prompt or PowerShell.

1. Open Command Prompt as Administrator (right-click Start > “Command Prompt (Admin)” or “Windows Terminal (Admin)”).
2. Type the following and press Enter:
   net localgroup "Remote Desktop Users" "PCName\John" /add
3. For a Microsoft account, use the email address:
   net localgroup "Remote Desktop Users" "user@outlook.com" /add

To verify the group membership, type net localgroup "Remote Desktop Users" and check the list. This method is fast and works on all editions that support RDP, but it requires you to know the exact account name.

Method 4: Creating a New Local User for Remote Access

Sometimes you need to create a brand-new account solely for remote access—for example, a technician or a family member who does not have an account yet. This is done through Settings > Accounts > Family & other users (Windows 10/11) or via the classic User Accounts control panel.

1. Go to Settings > Accounts > Family & other users.
2. Click Add someone else to this PC.
3. Choose “I don’t have this person’s sign-in information” > “Add a user without a Microsoft account.”
4. Enter a username and password (or leave blank for no password, though this is insecure).
5. After creation, follow Method 1 or 2 to add that new user to the Remote Desktop Users group.

This is a common scenario for small businesses that want to give a contractor access without sharing an existing admin account.

Common Problems and How to Fix Them

Even with the correct steps, you may hit issues. Here are the most frequent ones:

• “The user is not allowed to sign in through Remote Desktop” – This error appears if the user is not in the Remote Desktop Users group. Double-check the group membership via net localgroup.
• Microsoft account not found – If you type the email and “Check Names” fails, the account may be a local account with a different name, or the PC is not joined to the domain. Try the local username instead.
• User is in the group but still cannot connect – This often happens when the user’s password is blank. Windows disallows blank-password remote logins by default for security. Set a password or change the local security policy (not recommended).
• Remote Desktop is not enabled – Even if the user is added, RDP must be turned on. Check Settings > System > Remote Desktop, or System Properties > Remote tab.
• Firewall blocking – Windows Firewall normally prompts to allow RDP when you enable it. If you turned it on via command line, ensure the rule “Remote Desktop” is enabled in Windows Defender Firewall.

Security Considerations for Remote Desktop Users

Adding users to Remote Desktop increases your attack surface. Follow these best practices:

• Use strong passwords – Never leave a remote user with a blank or weak password.
• Limit who you add – Only grant access to people who genuinely need it. Review the group membership periodically.
• Enable Network Level Authentication (NLA) – This is on by default in Windows 10/11 and requires the user to authenticate before a full session is established. Keep it enabled.
• Use a VPN or RDP gateway – If connecting over the internet, avoid exposing port 3389 directly. A VPN is safer.
• Consider two-factor authentication – Some third-party tools add 2FA to RDP, but Windows itself does not natively support it for RDP.

Remember that adding a user to Remote Desktop Users does not give them administrative control. If you need to grant admin rights, add them to the Administrators group instead—but do so sparingly.

How to Remove a Remote Desktop User

To revoke access, you have two options:

• Remove from the group – Use net localgroup "Remote Desktop Users" "PCName\John" /delete in an elevated command prompt.
• Remove the account entirely – Go to Settings > Accounts > Family & other users, select the user, and click “Remove.” This deletes the local profile and data.

Removing from the group is less destructive and is the recommended approach if the user might need access again later.

Frequently Asked Questions

Can I add a user who has a Microsoft account but no local account?

Yes. In the System Properties or Settings, type the full Microsoft account email (e.g., user@outlook.com) when adding the user. Windows will link it to the account. However, the Microsoft account must have been used to sign in to this PC at least once, or it must be a work/school account that is trusted. If the user has never signed in, you may need to create a local account first.

Does adding a user to Remote Desktop Users give them access to my files?

No. Remote Desktop Users only allows them to log in and use the desktop. They can only access files that their user account has permissions for. Standard users cannot read other users’ folders without explicit permission.

Why can’t I add a user on Windows 10 Home?

Windows 10 and 11 Home editions do not include the Remote Desktop host feature. You can only connect to other computers, not accept incoming connections. To add users, you need Windows Pro, Enterprise, or Education. Alternatively, you can use third-party remote access tools.

What is the difference between adding a user and giving them admin rights?

Adding a user to Remote Desktop Users only lets them connect. Giving them admin rights (adding to Administrators group) lets them change system settings, install software, and access all files. Always prefer the least privilege needed.

Can I add a domain user to Remote Desktop on a work PC?

Yes. On a domain-joined computer, you can type the domain username (e.g., DOMAIN\username) in the same dialog. The group membership is stored locally, but the account is validated by the domain controller.

What if I get “Access is denied” when using net localgroup?

This means your Command Prompt is not running as Administrator. Right-click and select “Run as administrator” before running the command.

Related

• Monster Hunter Outlanders on PC: Emulator Guide
• Reverse Proxy: What It Is & Why Self-Hosted Apps Need One
• Windows 11 Search: Customize & Use It Fully