Custom Domain group for RDP Access

When an AADServer is joined to a Domain, default all Domain Users are allowed to use the AADServer:

The Domain group "Domain Users" is added to the Local Group "Remote Desktop Users".

If you want a Custom Domain Group, and not the default group "Domain Users", proceed as follows:

Define a Global Group in the Domain

• This step is not done on the AADServer.
• This step is done on the Domain.
  • This step is done on 1 of the Domain Controllers.

• Define a GLOBAL group in the Domain Controller. In this example our GLOBAL group is called "RDPAccess".
• Make 1 or more Domain Users members of the group RDPAccess.
  • In this example there are only 2 Domain Users member of the group RDPAccess: "domain001" and "domain002".

Remove the default group "Domain Users" from Local Group "Remote Desktop Users"

• This step is done on the AADServer.

Add the Domain Group "RDPAccess" to the Local Group "Remote Desktop Users"

• Make sure that "Locations..." points towards the Domain.
• Make sure that "Locations..." does not points towards the local AADServer.
• The Domain Group "RDPAccess" is located in the Domain. This group is not located in the local AADServer.

The result should be similar to the following:

The Domain Group "RDPAccess" is member of the Local Group "Remote Desktop Users".

Result

In this example, the user "domain003" is not a member of the Domain Group "RDPAccess". If this user attempts to login on the AADServer: