Enable Multiple Domain Users Remote Desktop Sessions on the Same Server in Windows Server 2025

Windows Server 2025 · Remote Desktop Services · Active Directory

Enable Multiple Domain Users Remote Desktop Sessions on the Same Server in Windows Server 2025

Configure a Windows Server 2025 Remote Desktop Session Host so multiple authorized domain users can connect and work at the same time, with the correct RDS roles, licensing, Group Policy and security controls.

By Khurram Shahzad · Windows Server Tutorial · October 2026

By default, Windows Server configured for Remote Desktop for Administration is intended for administrative access, not as a multi-user desktop platform. If several staff members must sign in to the same server at the same time and each needs an independent desktop session, deploy the Remote Desktop Services (RDS) Session Host role and configure RDS licensing correctly.

Deployment outcome: Multiple domain users can establish separate, concurrent RDP sessions on one Windows Server 2025 Session Host. Each user gets an independent session, profile and application environment. This is the supported RDS approach—not a registry tweak to bypass the two-session administrative limit.

Licensing is mandatory: RDS deployment requires appropriate Windows Server licensing and Remote Desktop Services Client Access Licenses (RDS CALs) for users or devices connecting to the Session Host, in addition to ordinary Windows Server CAL requirements. The built-in administrative RDP allowance is not a substitute for an RDS deployment license.

Table of Contents

Goal and architecture
Prerequisites and licensing
Install Remote Desktop Session Host
Configure RDS licensing
Grant domain users RDP access
Configure session and connection policies
Firewall and NLA
Verify concurrent sessions
Troubleshooting
Security and operational checklist
FAQs

1. Goal and when this configuration is appropriate

Use this design when multiple employees, administrators or application users need to connect to one shared Windows Server and run their own desktop sessions simultaneously—for example, a small business application server, a departmental shared desktop host or a centrally managed line-of-business environment.

Use Remote Desktop Services when the server is intended to host regular user sessions. Do not use the two-session Remote Desktop for Administration mode as a general multi-user solution. Administrative mode is intended for server management and is limited to two concurrent remote administrative connections (plus the console session behavior defined by Windows Server); it does not provide the RDS user-session licensing model.

Important: RDS Session Host supports multiple concurrent sessions, but the number of practical users depends on server sizing, application workload, profile strategy, storage performance, network capacity and the RDS licensing configuration. Installing the role does not mean unlimited sessions.

2. Prerequisites and licensing requirements

Prepare these items before changing the server:

A domain-joined Windows Server 2025 computer with current updates and a stable DNS configuration.
Local Administrator or delegated rights to install roles, configure Group Policy and manage RDS.
A supported RDS deployment design. For a small single-server deployment, the Session Host and RD Licensing roles may be installed on the same server; larger environments should separate roles as appropriate.
Valid Windows Server CALs and RDS CALs. Choose Per User or Per Device RDS CALs according to the organization’s licensing model and Microsoft Product Terms.
An activated RD License Server with the correct RDS CAL pack installed.
A domain security group containing the users who should be allowed to sign in.
Firewall access to the RDP listener, normally TCP 3389 (and UDP 3389 where enabled), from trusted client networks.

Licensing note: The RDS grace period is a temporary deployment allowance, not a permanent licensing strategy. Do not leave a production Session Host operating on the assumption that the grace period replaces purchased and installed CALs. Confirm current licensing requirements with Microsoft licensing guidance or your licensing provider before deployment.

Choose the deployment mode

Mode	Purpose	Concurrent use
Remote Desktop for Administration	Manage the server remotely.	Limited administrative remote sessions; not intended for regular multi-user hosting.
Remote Desktop Services Session Host	Host desktops and applications for users.	Multiple concurrent user sessions, subject to capacity and RDS licensing.

3. Install the Remote Desktop Session Host role

For a simple single-server deployment, install the Remote Desktop Session Host role. If this is a production environment, plan whether RD Connection Broker, RD Web Access and a separate RD Licensing server are required for your availability and management needs.

Open Server Manager

Sign in to Windows Server 2025 with an account that has administrative rights. Open Server Manager, select Manage > Add Roles and Features, and start the wizard.

Select role-based installation

Choose Role-based or feature-based installation, select the local server, then expand Remote Desktop Services.

Select Remote Desktop Session Host

Select Remote Desktop Session Host. Accept the required features when prompted. If this server will also manage RDS licensing, select Remote Desktop Licensing as part of the planned role deployment.

Complete installation and restart

Review the selections and click Install. A restart is commonly required after installing the Session Host role. Schedule the reboot, then confirm the server returns healthy and domain-connected.

Install the role with PowerShell

Alternatively, run the following in an elevated PowerShell session:

Install-WindowsFeature RDS-RD-Server -IncludeManagementTools

# If this server is also your planned RD Licensing server:
Install-WindowsFeature RDS-Licensing -IncludeManagementTools

# Review installation status
Get-WindowsFeature RDS-RD-Server, RDS-Licensing

Restart if requested by the role installation result:

Restart-Computer

Deployment note: The Server Manager RDS deployment wizard can create a session-based deployment with supporting roles. A standalone role installation is suitable for a basic single-server host, but it does not automatically configure a complete, highly available RDS deployment.

4. Configure the RD Licensing server and licensing mode

Do not skip this section. A Session Host must be able to discover and contact an activated RD License Server that has the appropriate RDS CALs installed.

Activate the RD License Server

Open Server Manager > Tools > Remote Desktop Services > Remote Desktop Licensing Manager, or run licmgr.exe. Right-click the license server, choose Activate Server, and complete the activation wizard.

Install your RDS CAL pack

In Remote Desktop Licensing Manager, right-click the activated server and select Install Licenses. Follow the wizard for the agreement/program and enter the license information supplied by your licensing provider. Confirm the CAL pack appears in the console.

Set the licensing mode and license server

Use Group Policy to specify the licensing mode and license server, as described in the next section. The selected mode must match the CALs installed on the license server: Per User or Per Device.

Do not assume the grace period means licensing is configured. A deployment may initially accept connections while the grace period is active. Configure and validate the RD License Server before the grace period expires, and monitor licensing diagnostics.

5. Grant the domain users permission to connect

Membership in the local Remote Desktop Users group grants the relevant logon permission, provided no policy denies it. Use a domain security group rather than adding staff accounts one by one.

Create a domain group

In Active Directory Users and Computers, create a global security group such as:

GG-RDS-WIN2025-Users

Add the domain user accounts that require a session. Then add this group to the Session Host’s local Remote Desktop Users group.

Add the domain group using PowerShell

# Run on the Session Host in an elevated PowerShell window
Add-LocalGroupMember -Group "Remote Desktop Users" `
    -Member "CONTOSO\GG-RDS-WIN2025-Users"

# Verify local group membership
Get-LocalGroupMember -Group "Remote Desktop Users"

Replace CONTOSO with your domain’s NetBIOS name. You can also manage membership through Computer Management > Local Users and Groups > Groups > Remote Desktop Users.

Confirm the user-right assignment

Open the GPO or Local Security Policy and navigate to:

Computer Configuration
  > Policies
    > Windows Settings
      > Security Settings
        > Local Policies
          > User Rights Assignment

Review these settings:

Allow log on through Remote Desktop Services — must include Administrators and/or the approved Remote Desktop Users group, as appropriate.
Deny log on through Remote Desktop Services — must not include the users or a group they belong to. Deny assignments take precedence over allow assignments.

Group Policy can overwrite local membership. If Restricted Groups or Group Policy Preferences manage the local Remote Desktop Users group, a manual local change may be removed at the next policy refresh. Manage membership centrally in the authoritative GPO instead.

6. Configure session limits and RDS licensing with Group Policy

Create or edit a dedicated computer GPO linked to the OU containing the Session Host computer account. Open Group Policy Management with gpmc.msc, right-click the intended OU, choose Create a GPO in this domain, and Link it here, then edit the GPO.

Set the RDS licensing mode

Navigate to:

Computer Configuration
  > Policies
    > Administrative Templates
      > Windows Components
        > Remote Desktop Services
          > Remote Desktop Session Host
            > Licensing

Configure:

Set the Remote Desktop licensing mode — Enabled; select Per User or Per Device to match your purchased CALs.
Use the specified Remote Desktop license servers — Enabled; enter the FQDN of the RD License Server, for example RDSLIC01.contoso.com.

Review the connection and session limits

Navigate to:

Computer Configuration
  > Policies
    > Administrative Templates
      > Windows Components
        > Remote Desktop Services
          > Remote Desktop Session Host
            > Connections

Review these settings:

Policy	Recommended configuration for this goal
Restrict Remote Desktop Services users to a single Remote Desktop Services session	Disabled if the same user account must be able to open more than one session. This setting does not prevent different users from connecting concurrently; it controls whether one user is limited to one session.
Limit number of connections	Set to a capacity-appropriate value for the server and licensing design, or leave Not Configured if another RDS deployment setting controls the limit. Do not set this to 1 if multiple concurrent connections are required.
Configure keep-alive connection interval	Optional. Configure only if your network or operations policy requires it.

Also review session time limits under:

Computer Configuration
  > Policies
    > Administrative Templates
      > Windows Components
        > Remote Desktop Services
          > Remote Desktop Session Host
            > Session Time Limits

Check Set time limit for active but idle Remote Desktop Services sessions, Set time limit for disconnected sessions and End session when time limits are reached. Configure these according to your business requirements. Aggressive idle or disconnected-session limits can make users believe a second login is disconnecting them.

Clarification: The policy Restrict Remote Desktop Services users to a single Remote Desktop Services session is about multiple sessions for the same account. It is not the setting that enables different domain users to connect concurrently. Multi-user hosting comes from the RDS Session Host role and a valid licensing configuration.

7. Enable RDP firewall access and secure the listener

Ensure Remote Desktop is enabled and the firewall allows RDP only from trusted network ranges. On the Session Host, inspect the built-in firewall rule group:

Get-NetFirewallRule -DisplayGroup "Remote Desktop" |
    Select-Object DisplayName, Enabled, Profile, Direction, Action

To enable the built-in Remote Desktop firewall rules if your security baseline permits it:

Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

Do not expose TCP 3389 directly to the public internet. Restrict access using network firewalls, VPN or RD Gateway, and use Network Level Authentication (NLA).

Require Network Level Authentication

Open Settings > System > Remote Desktop and confirm that Network Level Authentication is required, where supported by your clients. You can also inspect the RDP-Tcp listener setting:

Get-ItemProperty `
  -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" `
  -Name UserAuthentication

A value of 1 indicates NLA is enabled. Prefer configuring NLA through supported Windows settings or policy rather than relying on direct registry edits as the management method.

8. Apply policy and verify simultaneous sessions

Refresh Group Policy

On the Session Host, run the following from an elevated Command Prompt:

gpupdate /force

For a computer-policy-only refresh:

gpupdate /target:computer /force

Restart the server if the role installation or a specific policy change requests it. A reboot is not normally required for every RDS policy adjustment, but the role installation commonly requires one.

Confirm the applied GPO

gpresult /h C:\Temp\RDS-SessionHost-Policy.html
Start-Process C:\Temp\RDS-SessionHost-Policy.html

Check the Computer Details section for the RDS licensing, connection and user-right policies. Review denied GPOs, security filtering and precedence if a setting is missing.

Check the RDS services and listener

Get-Service TermService
qwinsta
Get-NetTCPConnection -LocalPort 3389 -State Listen

TermService should be running, and the RDP listener should be present. qwinsta displays sessions and their states.

Test with two separate domain accounts

From Client PC 1, connect to the Session Host using domain account CONTOSO\UserA.
Keep UserA signed in and open a working application or desktop session.
From Client PC 2, connect to the same server using a different account, CONTOSO\UserB.
Confirm UserB receives a separate desktop rather than replacing UserA’s session.
On the server, run qwinsta or quser to confirm both sessions exist concurrently.

quser
# or
qwinsta

Expected result: two distinct user sessions (for example, UserA and UserB) are listed on the same Session Host, with their own session IDs and Active state when both are in use.

9. Troubleshooting common RDP multi-session problems

Error or symptom	Checks and corrective action
“The maximum number of connections has been reached”	Check whether the host is still in Remote Desktop for Administration mode, whether the RDS Session Host role is installed, and whether Limit number of connections is set too low. Check RDS licensing diagnostics and the license server configuration.
Second user logs on and first user is disconnected	Confirm the host is actually configured as an RDS Session Host. Check whether both connections use the same account and review Restrict Remote Desktop Services users to a single Remote Desktop Services session. Different users should have separate sessions.
User is not allowed to log on through Remote Desktop Services	Check Remote Desktop Users membership, Allow log on through Remote Desktop Services and Deny log on through Remote Desktop Services. Deny rights override allow rights.
RDS licensing mode is not configured	Configure the licensing mode and specified license server in the Session Host Licensing GPO. Confirm the license server is activated and has the correct CAL pack.
License server cannot be contacted	Check DNS, firewall connectivity, server activation, license server discovery and whether the Session Host is configured with the correct FQDN.
RDP connection times out	Check TermService, the RDP listener, the Remote Desktop firewall rules, routing, VPN/RD Gateway and whether TCP 3389 is reachable from the client network.
Users are disconnected after idle time	Review Session Time Limits policies for active, idle and disconnected sessions. Check whether a logoff policy is ending sessions.

Run the RDS licensing diagnoser

Open Server Manager > Tools > Remote Desktop Services > RD Licensing Diagnoser, or run:

lsdiag.msc

Review warnings about licensing mode, license server discovery and CAL availability. Also inspect Event Viewer under Applications and Services Logs > Microsoft > Windows > TerminalServices-* for connection and licensing events.

10. Security and operational checklist

Use a dedicated AD security group for authorized RDS users; do not add broad groups such as Domain Users to local Administrators.
Apply least-privilege access: keep users out of the local Administrators group unless their role explicitly requires administrative rights.
Require NLA and use modern authentication and strong account policies.
Do not publish RDP directly to the internet. Use VPN or RD Gateway with MFA where available.
Apply current Windows Server security updates and monitor RDS and logon events.
Size CPU, memory, storage IOPS and network capacity for the expected concurrent workload.
Configure user profile and data storage appropriately. For larger deployments, evaluate profile containers and supported RDS architecture.
Document RDS CAL assignment and licensing mode; monitor the RD Licensing Diagnoser.
Set sensible idle and disconnected session limits without interrupting legitimate work.

For additional workstation hardening, see our related VMoreCloud guide: How to Block Program Installations from USB Drives Using Group Policy in Windows Server 2025.

11. Frequently asked questions

Can Windows Server 2025 allow several domain users to connect at the same time?

Yes. Install and configure the Remote Desktop Session Host role, configure an RD License Server and valid RDS CALs, grant users the appropriate logon rights, and ensure connection limits and session policies allow the planned concurrency.

Is enabling multiple RDP sessions with a registry hack supported?

No. Do not patch termsrv.dll or use third-party RDP wrapper tools to bypass Windows Server connection limits. Use the supported Remote Desktop Services role and licensing model.

Do I need RDS CALs if I only use the two administrative RDP connections?

Remote Desktop for Administration is a separate server-management use case. It does not provide a general multi-user desktop service. If you host normal user sessions with RDS Session Host, plan for RDS CALs in addition to applicable Windows Server CALs.

Does disabling “Restrict Remote Desktop Services users to a single session” enable multiple users?

No. That setting controls whether the same user account is restricted to one session. Different users can have separate sessions when the Session Host role, licensing, permissions and connection limits are configured correctly.

How can I see who is currently connected?

Run quser or qwinsta from an elevated command prompt on the Session Host.

Do I need to reboot after changing Group Policy?

Most RDS policy settings apply after policy refresh, although a sign-out, service restart or reboot may be required for particular changes. Installing the Session Host role commonly requires a restart. Follow Server Manager and Windows prompts.

Conclusion

To host multiple domain users concurrently on one Windows Server 2025 machine, deploy Remote Desktop Session Host rather than relying on Remote Desktop for Administration mode. Configure a valid RD License Server and RDS CALs, add an approved domain group to Remote Desktop Users, verify user-right assignments, and review connection and session time-limit policies. Finally, test with two separate domain accounts and confirm both sessions appear in quser or qwinsta. This produces a supported, manageable multi-user RDP host without relying on unsupported connection-limit workarounds.

References & Further Reading

Khurram Shahzad — Hybrid Cloud & Virtualization Engineer

Hybrid Cloud & Virtualization Engineer specializing in VMware, Azure, AWS, Windows Server, Microsoft 365, Linux, networking, backup & disaster recovery. I share practical guides, technical projects and insights into modern IT infrastructure through VMoreCloud.

VMoreCloud — Virtualization, Cloud, Backup & IT Solutions Hub