How to Enable Remote Desktop in Windows 11 Using PowerShell and Command Prompt

In enterprise administration, remote help desk operations, or headless server configurations, enabling Remote Desktop Protocol (RDP) via the graphical Settings app is not always practical. When connected through an SSH session, PowerShell Remoting (WinRM), or a remote execution script, system administrators can configure and enable Remote Desktop natively through command-line interfaces. Enabling RDP from the command line requires two distinct operations: toggling the Terminal Server registry flag and unblocking the inbound Remote Desktop rules in Windows Defender Firewall.

Important Prerequisites and Windows Editions

Before proceeding, verify that your computer meets the foundational RDP server hosting requirements:

• Windows Edition: The built-in Remote Desktop server host feature requires Windows 11 Pro, Enterprise, or Education. Windows 11 Home edition cannot act as an RDP host (though it can connect out to other remote PCs as an RDP client).
• Administrative Privileges: Modifying system registry hives and firewall policies requires executing PowerShell or Command Prompt as an Administrator.
• Password Protection: Windows security policies block blank passwords across network RDP sessions. Ensure the target user account has a secure password configured.

Method 1: Enable Remote Desktop Using PowerShell

PowerShell provides a concise, scriptable approach using native cmdlets:

1. Right-click the Start button and select Terminal (Admin) or PowerShell (Admin).
2. Enable the Terminal Server service by setting the fDenyTSConnections registry key to 0:

   Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 0

3. Allow incoming RDP connections through Windows Defender Firewall by enabling the pre-configured rule group:

   Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

4. (Recommended) Enforce Network Level Authentication (NLA) for enhanced security against man-in-the-middle attacks:

   Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name "UserAuthentication" -Value 1

The changes apply immediately without requiring a machine reboot. You can test connectivity by connecting to the machine’s IP address from any RDP client on your local network.

Method 2: Enable Remote Desktop Using Command Prompt (CMD)

If you are operating within a minimal command shell, recovery console, or legacy batch script, use the reg and netsh utilities:

1. Open Command Prompt as Administrator.
2. Modify the Terminal Server registry value:

   reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f

3. Open the required TCP port 3389 rules in Windows Defender Firewall:

   netsh advfirewall firewall set rule group="remote desktop" new enable=Yes

4. Enforce Network Level Authentication:

   reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 1 /f

Verifying the Active RDP Listener and Port Status

To confirm that the Remote Desktop service is listening and ready for incoming client connections, run:

Test-NetConnection -ComputerName localhost -Port 3389

If the configuration succeeded, PowerShell returns TcpTestSucceeded : True, confirming that the Windows RDP listener is active on TCP port 3389 and successfully accepting incoming sessions.

How to Disable Remote Desktop via Command Line

If you need to close RDP access after maintenance concludes:

1. Set fDenyTSConnections back to 1:

   Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name "fDenyTSConnections" -Value 1

2. Disable the firewall rule group:

   Disable-NetFirewallRule -DisplayGroup "Remote Desktop"