When administrators enable Remote Desktop feature on Windows operating systems, by default Windows allows only the administrators of the computers to establish remote desktop sessions to the computers. In Microsoft Windows 7 as soon as an administrator initiates a remote desktop session from PC1 to PC2, locally logged on users on PC2 automatically gets logged off and the console (desktop screen) of PC2 is displayed on PC1 screen. Since administrative credentials are required to initiate and establish a remote desktop session, after the remote desktop session is established, the console of PC2 that appears on PC1 provides administrative privileges to the user who has initiated the remote desktop session.
User accounts that are not administrators of computers cannot establish remote desktop sessions to the target computers whatsoever. This default configuration is strongly recommended to be kept intact for security reasons. This is because the entire console of the computer and all the administrative rights cannot be given to the normal users in organizations or homes.
This default configuration is added to the Windows operating systems in order to protect the OS from unauthorized remote desktop accesses.
Situations Where Overriding Default Configuration Becomes Essential
As mentioned above, Microsoft strongly recommends that the default configuration must not be changed and the permissions of remote desktop sessions must be limited to administrator accounts only. However there might be times when it becomes essential to grant permissions to establish remote desktop sessions to the standard user accounts. One situation along with many others may include, a network operating system used as a terminal server where one application is installed and all trainees are directed to establish remote desktop sessions from their dump terminals or client computers to the terminal server in order to work on the installed application. In such cases, administrators must obtain Client Access Licenses or CALs for the number of computers or the users that the terminal server is likely to accept.
For testing purposes, sometimes standard user accounts are also granted permissions to establish remote desktop sessions to the client operating systems in both production environments and homes.
In either case, to grant standard user accounts permissions to establish remote desktop sessions to the remote computers, administrators of the computers must add the user accounts to the Remote Desktop Users group.
Adding Standard User Accounts to Remote Desktop Users Group
As mentioned above, in order to grant standard user accounts permissions to establish remote desktop sessions to the remote computers, user accounts must be added to Remote Desktop Users group. To do so, steps given below must be followed:
- Log on to Windows 7 computer with admin account.
- Click Start, and from the menu right-click Computer.
- From the displayed context menu, click Manage.
- On the opened Computer Management snap-in, from the left pane expand System Tools > Local Users and Groups and from the displayed containers’ list, click to select Groups folder.
- From the right pane, double-click Remote Desktop Users group.
- On the opened Remote Desktop Users Properties box, click Add button to add the standard user accounts to whom permissions to establish remote desktop sessions are to be granted.
- Once done, click OK button to save the changes and finally close Computer Management snap-in.