Removing Domain Admins from the built-in Remote Desktop group

Remove Domain Admins from the domain’s built-in Remote Desktop Users group; on domain controllers, that group is intended to remain empty, and Domain Admins normally retain administrative RDP access through their membership in the built-in Administrators group.

Operational impact

• On domain controllers: Normally none for Domain Admin accounts. Microsoft states that only administrators should use RDS sessions on a domain controller, only in emergencies, and that the built-in Remote Desktop Users group should be empty.^1^
• Why Domain Admins still have access: Domain Admins is nested in the domain’s built-in Administrators group. That Administrators group has the Allow log on through Remote Desktop Services user right by default.^1^ Domain Admins also belongs to the local Administrators group on every domain-joined computer by default.^2^
• Removing the group from Remote Desktop Users removes only that particular authorization path. It does not remove Domain Admin privileges or the alternative access inherited through Administrators.

The “keep this group empty” recommendation applies to the Builtin\Remote Desktop Users group in Active Directory, which controls domain-controller access. It does not mean every member server’s local Remote Desktop Users group must be empty. For member servers, Microsoft’s baseline allows Administrators and Remote Desktop Users to receive the RDP logon right; for domain controllers, the recommended assignment is Administrators.^3^

Remove it safely

1. Open Active Directory Users and Computers (dsa.msc).
2. Select Builtin → Remote Desktop Users.
3. Open Properties → Members.
4. Remove Domain Admins.
5. Apply policy on a domain controller:

      gpupdate /force
   

6. Test using an approved administrative account while retaining an existing console or remote session as a recovery path.

Check policy before relying on RDP

A Group Policy Object can replace the default user-right assignment. In the GPO applied to the Domain Controllers OU, inspect:

Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → User Rights Assignment

Confirm:

• Allow log on through Remote Desktop Services includes Administrators.
• Deny log on through Remote Desktop Services does not include Domain Admins, Administrators, or another group containing the account.

An explicit deny assignment can block the account despite its membership in an allowed group. Group Policy also overrides Local Security Policy.^4^

To inspect the effective policy on each domain controller:

gpresult /h C:\Temp\DC-GPResult.html

Review the report under Computer Details for the two Remote Desktop Services logon rights. If Administrators retains the allow right and no applicable deny right exists, removing Domain Admins from Remote Desktop Users should not prevent Domain Admin members from connecting by RDP.

This change does not make routine Domain Admin RDP usage advisable: Microsoft recommends limiting Domain Admin membership to break-glass or domain-wide administrative scenarios.^2^

References

1. Active Directory security groups
2. Appendix B: Active Directory privileged accounts and groups reference guide
3. Windows security baseline
4. Troubleshooting access denied and user not authorized issues in Microsoft Remote Desktop Services