Enable Remote Desktop Again

[simeononsecurity]

Following running the script, to enable remote desktop on the system again you must perform the following steps.

1. Add Users/Group to Remote Desktop Users Group

To grant remote desktop access to specific users or groups, follow these steps:

1. Open "Computer Management" on the target machine.
2. Navigate to "System Tools" > "Local Users and Groups" > "Groups."
3. Double-click on the "Remote Desktop Users" group.
4. Click the "Add" button and enter the names of the users or groups you want to grant access to.
5. Click "Check Names" to validate the entries, then click "OK" to add them.
6. Click "Apply" and "OK" to save the changes.

2. Configure Remote Desktop Logon Permissions using GPO/LGPO

Using Group Policy Objects (GPO) or Local Group Policy Objects (LGPO), follow these steps to set logon permissions:

1. Open the Group Policy Management Console (GPMC) on a domain controller or use "gpedit.msc" for local policies.
2. Navigate to "Computer Configuration" > "Windows Settings" > "Security Settings" > "Local Policies" > "User Rights Assignment."
3. Locate "Allow logon through Remote Desktop Services" and "Deny logon through Remote Desktop Services" policies.
4. Double-click each policy, add or remove the appropriate users or groups, and click "OK" to save changes.

3. Enable Remote Desktop Services via GPO/LGPO

To enable Remote Desktop Services using GPO or LGPO, follow these steps:

1. Open the Group Policy Management Console (GPMC) on a domain controller or use "gpedit.msc" for local policies.
2. Navigate to "Computer Configuration" > "Administrative Templates" > "Windows Components" > "Remote Desktop Services" > "Remote Desktop Session Host."
3. Enable the policy named "Allow users to connect remotely using Remote Desktop Services."
4. Click "Apply" and "OK" to save the changes.

4. Set Network Type to Domain or Private

To set the network type to Domain or Private, follow these steps:

1. Open "Settings" and go to "Network & Internet."
2. Click on "Change connection properties" under the network you are connected to.
3. In the "Network profile" section, choose either "Domain" or "Private" based on your network type.
4. Click "Save" to apply the changes.

5. Disable Network Level Authentication (NLA) via GPO/LGPO

1. Open the Group Policy Management Console (GPMC) on a domain controller or use "gpedit.msc" for local policies.
2. Navigate to "Computer Configuration" > "Administrative Templates" > "Windows Components" > "Remote Desktop Services" > "Remote Desktop Session Host" > "Security."
3. Look for the policy named "Require user authentication for remote connections by using Network Level Authentication."
4. Double-click on the policy, select the "Disabled" option, and click "Apply" and then "OK" to save the changes.

Note: These instructions may vary slightly depending on the Windows version you are using. Always ensure you have the necessary permissions and back up important data before making significant changes.

[uebmaster]

Doesn't works for me in windows 11

[simeononsecurity]

We've tested this again on the latest versions of Windows 11 and it worked for us.
Can you provide more details on what version you're on and any steps you've tried?
Also more importantly, what flags you used when you ran the script?

[uebmaster]

In this moment I've tried in W11 Pro 25H2 but it's the same than W11 Pro 24H2.

I've followed step by step the guide in this discussion, the diference is that my windows language is spanish.

I ran the script how you suggest: iwr -useb 'https://simeononsecurity.ch/scripts/windowsoptimizeandharden.ps1'|iex

Thanks in advance.

PS: I almost forget to mention that before your msg i ran the another script that doesn't has the harden part, because that script doesn't disable the remote desktop service, after your msg i ran the script with harden feature, maybe that could be, i will do a clean reinstall and try the run the script with harden feature.

[uebmaster]

I've tried in a clean install of W11 25H2 Pro and same problem.