How to Completely Disable ‘Remote Desktop’ (RDP) via Group Policy in Windows 11

Remote Desktop Protocol (RDP) allows users to connect to and control a Windows machine over a network connection. While RDP is a vital tool for IT administrators managing servers or facilitating remote work, it is also one of the most heavily targeted attack vectors for ransomware gangs and brute-force attacks. If a Windows 11 workstation does not explicitly require inbound remote access (e.g., a standard employee laptop or a public kiosk), leaving the RDP service enabled or allowing users to turn it on via the Settings app is a massive, unnecessary security risk.

This guide explains how to completely disable inbound Remote Desktop (RDP) connections system-wide using the Group Policy Editor in Windows 11.

Disable Remote Desktop via Group Policy

To enforce a strict block on inbound RDP connections and prevent local administrators from re-enabling it via the GUI, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, navigate precisely to this path:

   Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections

5. In the right-hand pane, locate the policy named Allow users to connect remotely by using Remote Desktop Services.
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Disabled.
8. Click Apply, then click OK.

Verify the RDP Lockdown

To enforce the change immediately across the system without requiring a reboot, open an elevated Command Prompt and execute gpupdate /force. Note that this policy disables inbound connections to this machine; the user can still use the Remote Desktop client to connect outward to other servers.

To verify the restriction is active, press the Windows Key + I to open Settings, and navigate to System > Remote Desktop. You will notice a red banner stating “Some of these settings are hidden or managed by your organization.” The master toggle switch for “Remote Desktop” will be completely greyed out and permanently locked in the Off position. The workstation will no longer listen on TCP port 3389, effectively sealing off the primary attack vector for network-based lateral movement.