How do I use group policy in AWS Managed Microsoft AD or Simple AD to allow domain users RDP access to an EC2 Windows instance?

Short description

AWS Managed Microsoft AD and Simple AD don't allow you to add domain users to the built-in Remote Desktop Users domain group. Instead, use the built-in Admin account to create a Group Policy Object (GPO), and then apply the policy to the delegated computers.

Note: The GPO applies to all computers in the organizational unit (OU) that the policy is linked to. If you use the following procedure to add a user to the group, then the user has RDP access to any computer in the OU.

Resolution

Prerequisite:

• Join an EC2 Windows instance (Windows Server 2012 R2 or later) to a Simple AD or AWS Managed Microsoft AD directory.
• Install the Active Directory tools on the instance.

Allow domain users RDP access to an EC2 Windows instance

To allow domain users RDP access to the domain joined Windows instances, complete the following steps:

1. Use RDP to connect to your Windows EC2 instance.
2. Create a user. If you need more than one user, then repeat this step.
3. Create a security group. Note the security group name for a later step.
4. Add the new users to the new security group.
5. Open Group Policy Management. Select your domain's Forest, expand Domains, and then expand your domain name.
6. Expand your delegated OU, the NetBIOS name of the directory. Open the context menu for Computers, and then choose Create a GPO in this domain, and Link it here.
7. For Name, enter a name, and then choose Ok.
8. In the navigation pane, expand Computers. Open the context menu for the policy, and then choose Edit.
9. In the navigation pane, under Computer Configuration, expand Preferences, and then expand Control Panel Settings.
10. Open the context menu for Local Users and Groups.
11. Choose New, and then choose Local Group.
12. For Group name, choose Remote Desktop Users (built-in), and then choose Add.
13. For Name, enter the name of the security group that you created, and then choose OK. Or, open the context menu, enter the security group name, and then choose Check names.
14. Choose OK.

The policy updates your environment at the next policy refresh interval. To force the policy to apply immediately, run the gpupdate /force command on the target server.

Related information

AWS Managed Microsoft AD

Simple AD

Manage users and groups in AWS Managed Microsoft AD