How to Enable Remote Desktop on Windows Server Core 2025

Log into your Windows Server Core 2025 system using administrator credentials. Server Core boots directly to a command prompt interface without a graphical desktop environment.

Launch the Server Configuration tool by running the SConfig command:

sconfig.cmd

The SConfig menu displays numbered configuration options. This tool provides a text-based interface for managing core server settings without requiring PowerShell knowledge.

From the SConfig main menu, select option 7 to configure Remote Desktop settings:

7

Press Enter to access the Remote Desktop configuration submenu. You'll see the current RDP status (typically "Disabled" on fresh installations) and configuration options.

Type E to enable Remote Desktop:

E

The system will prompt you to choose the authentication level. Select option 1 for the most secure configuration:

1

This enables "Allow only clients running Remote Desktop with Network Level Authentication (more secure)". NLA requires client authentication before establishing the RDP session, preventing unauthorized connection attempts.

Press OK to confirm the changes. SConfig automatically updates the registry and enables the necessary firewall rules.

Exit SConfig by pressing 0 and return to the command prompt. Launch PowerShell to verify the firewall configuration:

powershell

Check that the Remote Desktop firewall rules are enabled:

Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Where-Object {$_.Enabled -eq "True"}

This command should return three enabled rules:

• Remote Desktop - User Mode (TCP-In)
• Remote Desktop - User Mode (UDP-In)
• Remote Desktop - Shadow (TCP-In)

If the rules aren't enabled, manually enable them:

Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

Alternatively, use the netsh command for compatibility with older scripts:

netsh advfirewall firewall set rule group="Remote Desktop" new enable=Yes

While SConfig handles most configurations automatically, you can also enable RDP through direct registry modification. This method is useful for scripting or when SConfig isn't available.

Enable Remote Desktop by setting the fDenyTSConnections registry value to 0:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 0

Enable Network Level Authentication for enhanced security:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 1

For environments requiring command prompt compatibility, use reg commands:

reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

reg add "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 1 /f

Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections

The fDenyTSConnections value should be 0 (enabled).

Ensure the Terminal Services (TermService) is running and configured for automatic startup. This service handles all RDP connections to the server.

Check the current service status:

Get-Service TermService

The service should show Status: Running and StartType: Automatic. If the service isn't running, start it manually:

Start-Service TermService

Configure the service for automatic startup to ensure RDP remains available after reboots:

Set-Service TermService -StartupType Automatic

If you encounter issues with the service, restart it forcefully:

Restart-Service TermService -Force

For additional verification, check that the service is listening on port 3389:

netstat -an | findstr :3389

You should see "TCP 0.0.0.0:3389 LISTENING" indicating the RDP service is accepting connections.

Network Level Authentication (NLA) provides enhanced security by requiring user authentication before establishing the RDP session. This prevents unauthorized users from consuming server resources.

Verify NLA is enabled (should be set from SConfig, but confirm manually):

Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication

The UserAuthentication value should be 1 (enabled). If you need to disable NLA for legacy client compatibility, set it to 0:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 0

Configure the security layer for RDP connections. The recommended setting is SSL/TLS:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name SecurityLayer -Value 2

Security layer values:

• 0 = RDP Security Layer
• 1 = Negotiate (SSL/TLS if available)
• 2 = SSL/TLS (recommended)

Set the encryption level to high for maximum security:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name MinEncryptionLevel -Value 3

Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' | Select-Object UserAuthentication, SecurityLayer, MinEncryptionLevel

From your management workstation, test the RDP connection to verify everything is configured correctly. First, determine the server's IP address from the Server Core console:

Get-NetIPAddress -AddressFamily IPv4 | Where-Object {$_.IPAddress -ne '127.0.0.1'}

On your Windows client machine, open Remote Desktop Connection (mstsc.exe) or use the command line:

mstsc /v:SERVER_IP_ADDRESS

Replace SERVER_IP_ADDRESS with your server's actual IP. You can also use the server's hostname if DNS resolution is configured:

mstsc /v:SERVERNAME.domain.com

When prompted, enter your administrator credentials. If NLA is enabled, you'll authenticate before seeing the desktop. Accept any certificate warnings for self-signed certificates (common in lab environments).

Upon successful connection, you'll see the Server Core administrative desktop with Server Manager and basic management tools. This isn't the full Windows desktop experience but provides essential server management capabilities.

Test connection persistence by performing a simple administrative task:

Get-ComputerInfo | Select-Object WindowsProductName, TotalPhysicalMemory

Implement additional security measures to protect your RDP deployment. Start by configuring session timeouts to prevent abandoned connections:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name MaxConnectionTime -Value 3600000

This sets a 1-hour maximum connection time (value in milliseconds). Set idle session timeout:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name MaxIdleTime -Value 1800000

This disconnects idle sessions after 30 minutes. Configure maximum concurrent connections:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name MaxInstanceCount -Value 2

For enhanced security, consider changing the default RDP port from 3389:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -Value 3390

After changing the port, update the firewall rule:

New-NetFirewallRule -DisplayName "RDP Custom Port" -Direction Inbound -Protocol TCP -LocalPort 3390 -Action Allow

Remove the default port 3389 rule if you're using a custom port:

Disable-NetFirewallRule -DisplayGroup "Remote Desktop"

Restart the Terminal Services to apply port changes:

Restart-Service TermService -Force