Overview
The error "To sign in remotely, you need the right to sign in through Remote Desktop Services" (user account not authorized for remote login) means the account lacks Remote Desktop permission. This guide shows how to grant it by adjusting group membership and the logon-rights policy.
Key Takeaways
- The account must be in the Remote Desktop Users group (or be an administrator).
- The "Allow log on through Remote Desktop Services" policy must include the user/group.
- Remote Desktop must be enabled on the target PC.
- Pro/Enterprise editions support incoming Remote Desktop; Home does not host RDP.
Why It Happens
Windows only lets specific accounts sign in remotely. If the user is not in the Remote Desktop Users group and not granted the logon right, Windows blocks the remote sign-in even with correct credentials.
Step 1 — Enable Remote Desktop
1. On the target PC, open Settings > System > Remote Desktop.
2. Turn Remote Desktop On.
3. Click "Select users that can remotely access this PC" to manage allowed users.
Step 2 — Add the User to the Remote Desktop Users Group
1. Press Windows key + R, type lusrmgr.msc, and press Enter (Pro/Enterprise).
2. Open Groups and double-click Remote Desktop Users.
3. Click Add, enter the user name, click Check Names, then OK.
4. Or run: net localgroup "Remote Desktop Users" "USERNAME" /add in an elevated Command Prompt.
Step 3 — Grant the Logon Right in Local Security Policy
1. Press Windows key + R, type secpol.msc, and press Enter.
2. Go to Local Policies > User Rights Assignment.
3. Open "Allow log on through Remote Desktop Services".
4. Ensure Remote Desktop Users (and/or the specific user) is listed; add it if missing, then click OK.
Note: Also check that the user is not listed under "Deny log on through Remote Desktop Services", which would override the allow.
Step 4 — Confirm the Remote Desktop Service Is Running
1. Press Windows key + R, type services.msc, and press Enter.
2. Ensure Remote Desktop Services is Running and set to start automatically.
3. Restart the service if you changed permissions, then retry the connection.
Troubleshooting
Problem: Still blocked after adding the user.
Solution: Check the Deny logon policy, confirm the user is in Remote Desktop Users, and that the account has a password (blank-password accounts are often blocked remotely).
Problem: lusrmgr.msc or secpol.msc is missing.
Solution: They are Pro/Enterprise only. On Home, use the Settings > Remote Desktop user selector and the net localgroup command.
Problem: Home edition cannot accept connections.
Solution: Windows Home cannot host Remote Desktop. Upgrade to Pro, or use an alternative remote-access tool.
Problem: Network Level Authentication blocks the user.
Solution: Ensure the account credentials are valid for NLA, or adjust NLA settings on the host if appropriate.
Conclusion
This error is a permissions gap. Enable Remote Desktop, add the user to the Remote Desktop Users group, and confirm the "Allow log on through Remote Desktop Services" right — then the account can connect remotely.
</w:pBdr><w:spacing w:before="220" w:after="40"/></w:pPr><w:r><w:rPr><w:b/><w:bCs/><w:color w:val="0B5394"/><w:sz w:val="21"/><w:szCs w:val="21"/><w:rFonts w:ascii="Calibri" w:cs="Calibri" w:eastAsia="Calibri" w:hAnsi="Calibri"/></w:rPr><w:t xml:space="preserve">About TechHub
This guide is part of the TechHub Knowledge Base. For more step-by-step IT guides and support, visit techhub.com.lk.
