Skip to content

Windows: Create a New RDP User (Command Line)

Bots scanning the internet try Administrator and admin first. Logging in over RDP with your own username, and keeping the built-in Administrator for the console only, removes most of that noise.

Quick Fix

Create the user and allow RDP

  1. Open the VM Console in your Euronodes client panel (it works even when RDP is blocked or the account is locked).
  2. Log in with an administrator account.
  3. Open PowerShell as Administrator and run, replacing myuser with the login name you want: 
    $pw = Read-Host -AsSecureString "Password"
New-LocalUser -Name "myuser" -Password $pw -PasswordNeverExpires
Add-LocalGroupMember -SID S-1-5-32-555 -Member "myuser"
  4. Done. Connect over RDP as myuser.

Read-Host asks for the password, so it is not saved in your PowerShell history. Use a long one: 16 characters or more.

Prefer CMD?

net user myuser YourLongPasswordHere /add
net localgroup "Remote Desktop Users" myuser /add
On a Windows installed in another language the group name is translated (for example Portuguese Utilizadores do Ambiente de Trabalho Remoto), and the second command fails with "group not found". Use the PowerShell version above: S-1-5-32-555 is the same group in every language.

If RDP Itself Is Turned Off

Enable Remote Desktop and open it in Windows Firewall

Set-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 0
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
Then restrict who can reach it, see Stop RDP Brute-Force (Panel Firewall).

Check It Worked

Verify

Get-LocalUser myuser
Get-LocalGroupMember -SID S-1-5-32-555
myuser should be listed as Enabled and as a member of the group.

Optional: Keep Administrator Off RDP

Only after the new user works

Once you can log in over RDP as the new user, you can stop the built-in account from being used remotely:

  • If the new user only needs RDP, leave Administrator as it is and use it from the VM Console only.
  • If the new user should be an admin too, add it to Administrators and then disable the built-in account: 
    Add-LocalGroupMember -SID S-1-5-32-544 -Member "myuser"
Disable-LocalUser -Name "Administrator"

Test the new admin login before disabling Administrator, or you can lock yourself out.

A new username is not protection on its own

It cuts the noise from simple scanners, but RDP open to the whole internet keeps getting brute-forced. Restrict port 3389 to your own IP: Stop RDP Brute-Force (Panel Firewall).

FAQ

Does the new user need to be an administrator to use RDP?

No. Membership in Remote Desktop Users is enough.

How many people can be logged in at the same time?

Windows Server without RDS licensing allows 2 sessions at the same time. Windows 10/11 allows 1.

The user gets 'The connection was denied because the user account is not authorized for remote login'

It is not in the Remote Desktop Users group. Run the Add-LocalGroupMember -SID S-1-5-32-555 line again and check with Get-LocalGroupMember -SID S-1-5-32-555.

Related: Unlock User Account | Stop RDP Brute-Force (Panel Firewall) | Secure Open RDP Access