Remote Desktop Commands: Enable RDP from CMD and PowerShell

Updated: 12 October 2026 · Applies to: Windows Server 2016 to 2025 (Desktop Experience and Server Core) and Windows 10 and 11 Pro, Enterprise and Education; commands from Microsoft’s documentation, as Windows can’t run in our Linux test lab

To enable Remote Desktop from the command line, set the registry value fDenyTSConnections to 0 and enable the Remote Desktop firewall rule group. Run both commands in an elevated Command Prompt (Run as administrator):

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
netsh advfirewall firewall set rule group="remote desktop" new enable=Yes

According to Microsoft, fDenyTSConnections = 0 means RDP is enabled and 1 means disabled; the netsh line is Microsoft’s replacement for the old netsh firewall set service RemoteDesktop enable. /f overwrites the value without asking. Windows Home editions can’t accept Remote Desktop connections at all, only make them.

Remote Desktop commands at a glance

• Enable RDP: reg add ... /v fDenyTSConnections /d 0 (above)
• Open the firewall: netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
• Check whether RDP is on: reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections
• Check the RDP listener: qwinsta (same as query session)
• Allow a user: net localgroup "Remote Desktop Users" alice /add
• Who is signed in: quser (same as query user)
• Sign a session out: logoff 2; disconnect it: tsdiscon 2; reset a stuck one: reset session 2
• Warn users first: msg * /time:60 Server restarts in 10 minutes
• Check the Remote Desktop service: sc query termservice
• Connect to a server: mstsc /v:203.0.113.10

Enable RDP with PowerShell

In PowerShell run as administrator, using the cmdlets from Microsoft’s troubleshooting articles:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -Value 0 -Type DWord
Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Set-NetFirewallRule -Enabled True

Microsoft names the two inbound rules Remote Desktop - User Mode (TCP-In) and Remote Desktop - User Mode (UDP-In). Members of Administrators can connect once RDP is on. To let another account in, add it to Remote Desktop Users, with net localgroup (above) or:

Add-LocalGroupMember -Group "Remote Desktop Users" -Member "alice"

Check that RDP is enabled and listening

reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fDenyTSConnections
qwinsta

• 0x0 in the first key: RDP is enabled.
• The second key exists only when Group Policy controls RDP. According to Microsoft, its value is written back at the next Group Policy refresh, so if it holds 1, change the policy (see below) instead of the registry.
• In qwinsta, a line rdp-tcp with the state Listen means the RDP listener works. Microsoft’s example output:

 SESSIONNAME    USERNAME    ID    STATE    TYPE    DEVICE
 services                   0     Disc
>console                    1     Active
 rdp-tcp                    65536 Listen

From another Windows computer, test the port with Test-NetConnection -ComputerName 203.0.113.10 -Port 3389 -InformationLevel Detailed: TcpTestSucceeded : True means the network path is open. If you moved RDP to another port, test that port and connect with address:port; see change the RDP port 3389.

Manage Remote Desktop sessions from the command line

These commands come with Windows Server and work in Command Prompt and PowerShell:

• query user (or quser) lists signed-in users with their session name, ID, state (active or disconnected), idle time and logon time. A > marks your own session. Add /server:SRV01 to ask another server.
• logoff 2 signs out session ID 2 and ends all its programs. Microsoft warns that this can lose unsaved work and suggests warning the user with msg first. You can’t log off the console session this way.
• tsdiscon 2 disconnects session 2 but keeps its programs running, so the user can reconnect without losing anything.
• reset session 2 deletes a session that has stopped responding (also called rwinsta).
• msg * /time:60 Server restarts in 10 minutes shows a message to every signed-in user for 60 seconds.

According to Microsoft, logging off or resetting someone else’s session needs Full Control permission; you can always log off or reset your own.

Server Core: SConfig

On Windows Server Core (SConfig starts automatically from Windows Server 2022), type 7 and press Enter for the Remote desktop page, then E to enable. Choose 1 to allow only clients with Network Level Authentication (NLA, more secure) or 2 for any Remote Desktop version (less secure). On Windows Server 2016 and 2019, start it with SConfig.cmd.

With the Settings app

Start, Settings, System, Remote Desktop, switch Enable Remote Desktop to On and select Confirm. Add other accounts under Remote Desktop users.

On another computer, remotely

If PowerShell remoting already works to the target, open a session with Enter-PSSession -ComputerName SRV01 and run the PowerShell commands above there. Without remoting, Microsoft describes editing the value over the network: run regedt32, choose File, Connect Network Registry, enter the computer name and change fDenyTSConnections under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server.

Connect from the command line: mstsc

The Remote Desktop client also starts from Command Prompt, PowerShell or the Run box (Windows key + R):

mstsc /v:203.0.113.10
mstsc /v:203.0.113.10:3390 /admin
mstsc /v:203.0.113.10 /f

According to Microsoft, /v names the server and optional port, /admin opens a session for administering the server and /f starts full screen. For a step-by-step connection guide, see connect to a Windows VPS with Remote Desktop.

If it still won’t turn on

• Group Policy. Run gpresult /H c:\gpresult.html and look for Allow users to connect remotely by using Remote Desktop Services under Computer Configuration, Administrative Templates, Windows Components, Remote Desktop Services, Remote Desktop Session Host, Connections. If it is Disabled, set it to Enabled or Not configured in the GPO that wins, then run gpupdate /force.
• Services. Remote Desktop Services (TermService) and Remote Desktop Services UserMode Port Redirector (UmRdpService) must be running. Check with sc query termservice and start it with net start termservice.
• Firewall group not found. If netsh reports that no rules match the group, enable the rule by its fixed name: Get-NetFirewallRule -Name RemoteDesktop-UserMode-In-TCP | Set-NetFirewallRule -Enabled True.
• Another program on port 3389. netstat -anob | findstr 3389 (elevated) shows the process ID; it should be the one tasklist /svc | findstr TermService shows.

Keep it safe

RDP open to the whole internet attracts constant password guessing. Keep NLA on, use strong passwords, and limit the firewall rule to your own IP addresses where you can (see Windows Firewall rules). If RDP is off and you can’t get in, use the server’s console instead: on a Ucartz Windows VPS, open the VNC console from the client area (VPS console via VNC), and unmanaged dedicated servers include free IPMI KVM access.

Official documentation: Remote Desktop troubleshooting, Remote Desktop Services command reference and SConfig.