# Configure Remote Desktop

> Enables or disables Remote Desktop (RDP) on the machine and keeps every part of the configuration consistent.\n\nRemote Desktop only works when the connection setting.

Source: https://docs.capaone.com/capaone/application-manager/powerbricks/bricks/configure-remote-desktop/  
Product: CapaOne — a separate CapaSystems product; do not apply this page to any other.

Enables or disables Remote Desktop (RDP) on the machine and keeps every part of the configuration consistent.\\n\\nRemote Desktop only works when the connection setting, Network Level Authentication and the built-in Remote Desktop firewall rules all agree. This brick sets all of them in one step, so you do not end up with Remote Desktop turned on but unreachable, or turned off while the firewall is still open.\\n\\nIt can also give named users and groups permission to connect, by putting them in the computer's built-in Remote Desktop Users group. That is a lasting change to who may use the computer remotely: it stays in place after Remote Desktop is turned off again, and it is only made when you fill in the list. Nothing is ever removed from the group.\\n\\nEnabling Remote Desktop opens a remote access path into the machine. Everything that is changed is written to the job log.

## Parameters

#### State
*Required* — Default: `Enabled`

Choose whether Remote Desktop should be turned on or off on the machine.\\n\\nEnabled allows incoming Remote Desktop connections. Disabled blocks them and, when the firewall option is enabled, also closes the built-in Remote Desktop firewall rules again so no open rule is left behind. Allowed values: `Enabled`, `Disabled`.

#### Allow These Users And Groups To Connect
*Optional*

The users and groups that may connect to this computer with Remote Desktop. Type each one and add it to the list as its own entry.\\n\\nExample entries:\\nCONTOSO\\Helpdesk\\nCONTOSO\\anna\\nLocalRdpUser\\n\\nAdding a group is usually the better choice, because who may connect can then be changed without deploying anything again.\\n\\nAdministrators of this computer can already connect without being on this list, so they do not need to be added.\\n\\nAn entry that is already allowed is left alone, so the brick can be run again safely. Leave the list empty to leave the existing permissions exactly as they are - nothing is ever removed by this brick.\\n\\nPrefer names over identifiers. A name that Windows does not recognise is caught and fails the brick, but an identifier is taken as given - if it is wrong it is still added, and it then grants access to nobody while looking correct.\\n\\nThe brick fails if an entry could not be added, for example because the name is misspelled.

#### Require Network Level Authentication
*Required* — Default: `True`

Enable to require Network Level Authentication for Remote Desktop connections. The user then has to authenticate before a session is created on the machine, which protects the machine against unauthenticated attacks.\\n\\nThis is the recommended setting and should stay enabled. Only disable it if you have to support very old Remote Desktop clients that cannot use Network Level Authentication.

#### Configure Firewall Rule
*Required* — Default: `True`

Enable to also update the built-in Remote Desktop rules in Windows Firewall so they match the selected state. They are opened when Remote Desktop is enabled and closed when it is disabled.\\n\\nKeep this enabled unless the firewall is managed somewhere else. If you disable it, Remote Desktop can end up unreachable even though it is turned on, or reachable in the firewall even though it is turned off.

## Details

- **Category:** System
- **Brick ID:** `RemoteDesktop-Configure`

## Raw JSON definition

```json
{
  "category": "system",
  "description": "Enables or disables Remote Desktop (RDP) on the machine and keeps every part of the configuration consistent.\\n\\nRemote Desktop only works when the connection setting, Network Level Authentication and the built-in Remote Desktop firewall rules all agree. This brick sets all of them in one step, so you do not end up with Remote Desktop turned on but unreachable, or turned off while the firewall is still open.\\n\\nIt can also give named users and groups permission to connect, by putting them in the computer's built-in Remote Desktop Users group. That is a lasting change to who may use the computer remotely: it stays in place after Remote Desktop is turned off again, and it is only made when you fill in the list. Nothing is ever removed from the group.\\n\\nEnabling Remote Desktop opens a remote access path into the machine. Everything that is changed is written to the job log.",
  "developerVendor": "CapaSystems A/S",
  "displayName": null,
  "id": "RemoteDesktop-Configure",
  "name": "Configure Remote Desktop",
  "parameters": [
    {
      "allowManualInput": false,
      "defaultValue": null,
      "defaultValueObject": {
        "id": "Enabled",
        "name": "Enabled"
      },
      "description": "Choose whether Remote Desktop should be turned on or off on the machine.\\n\\nEnabled allows incoming Remote Desktop connections. Disabled blocks them and, when the firewall option is enabled, also closes the built-in Remote Desktop firewall rules again so no open rule is left behind.",
      "id": "State",
      "name": "State",
      "regExValidation": "",
      "required": true,
      "type": "ComboBox",
      "value": null,
      "values": [],
      "valuesObject": [
        {
          "id": "Enabled",
          "name": "Enabled"
        },
        {
          "id": "Disabled",
          "name": "Disabled"
        }
      ]
    },
    {
      "allowManualInput": true,
      "defaultValue": null,
      "defaultValueObject": {
        "id": "",
        "name": ""
      },
      "description": "The users and groups that may connect to this computer with Remote Desktop. Type each one and add it to the list as its own entry.\\n\\nExample entries:\\nCONTOSO\\Helpdesk\\nCONTOSO\\anna\\nLocalRdpUser\\n\\nAdding a group is usually the better choice, because who may connect can then be changed without deploying anything again.\\n\\nAdministrators of this computer can already connect without being on this list, so they do not need to be added.\\n\\nAn entry that is already allowed is left alone, so the brick can be run again safely. Leave the list empty to leave the existing permissions exactly as they are - nothing is ever removed by this brick.\\n\\nPrefer names over identifiers. A name that Windows does not recognise is caught and fails the brick, but an identifier is taken as given - if it is wrong it is still added, and it then grants access to nobody while looking correct.\\n\\nThe brick fails if an entry could not be added, for example because the name is misspelled.",
      "id": "AllowedUsers",
      "name": "Allow These Users And Groups To Connect",
      "regExValidation": "",
      "required": false,
      "type": "MultiSelectComboBox",
      "value": null,
      "values": [],
      "valuesObject": []
    },
    {
      "allowManualInput": false,
      "defaultValue": "True",
      "defaultValueObject": null,
      "description": "Enable to require Network Level Authentication for Remote Desktop connections. The user then has to authenticate before a session is created on the machine, which protects the machine against unauthenticated attacks.\\n\\nThis is the recommended setting and should stay enabled. Only disable it if you have to support very old Remote Desktop clients that cannot use Network Level Authentication.",
      "id": "RequireNetworkLevelAuthentication",
      "name": "Require Network Level Authentication",
      "regExValidation": "",
      "required": true,
      "type": "Boolean",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": "True",
      "defaultValueObject": null,
      "description": "Enable to also update the built-in Remote Desktop rules in Windows Firewall so they match the selected state. They are opened when Remote Desktop is enabled and closed when it is disabled.\\n\\nKeep this enabled unless the firewall is managed somewhere else. If you disable it, Remote Desktop can end up unreachable even though it is turned on, or reachable in the firewall even though it is turned off.",
      "id": "ConfigureFirewallRule",
      "name": "Configure Firewall Rule",
      "regExValidation": "",
      "required": true,
      "type": "Boolean",
      "value": null,
      "values": [],
      "valuesObject": null
    }
  ],
  "powershell": {
    "base64Encoded": true,
    "function": "ZnVuY3Rpb2..."
  },
  "type": "powerbrick",
  "version": "2026.10.8.1"
}
```