How to Enable Remote Desktop (RDP) via Windows Command Prompt or .cmd Script
Remote Desktop (RDP) is a convenient way to access a work or home PC over a local network or VPN. You can turn it on from Windows Settings, though enabling it from the Windows Command Prompt or with a ready-to-run .cmd script (launched as administrator) is faster and much more reliable across machines.
Remote Desktop (RDP) can be enabled with three commands in cmd without digging through system menus
These steps were tested on Windows 10 and Windows 11 Pro, Enterprise, and Education (Windows Home editions do not include the RDP host service by default), and the same commands also work on Windows 7, 8, and Windows Server.
Enable RDP in the Registry and Start the Service
Run all commands below in Command Prompt (cmd.exe) as administrator. First, allow incoming RDP connections in the Terminal Server registry key by setting fDenyTSConnections to 0 (the /f flag overwrites the value without asking for confirmation):
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
If you later need to disable remote access again, simply run the same command with /d 1. Next, make sure the Remote Desktop Services service is set to start automatically and is currently running:
sc config TermService start= auto net start TermService
Note the space right after the equals sign in start= auto – the sc utility strictly requires that syntax.
The same toggle in the GUI: Win + R – sysdm.cpl – Remote tab
Open Port 3389 in Windows Firewall
On non-English Windows editions, the built-in group="remote desktop" rule group name often fails to match because firewall group names are localized. The universal approach that works on any Windows language is to add an explicit inbound allow rule for standard TCP port 3389:
netsh advfirewall firewall add rule name="Allow RDP 3389" dir=in action=allow protocol=TCP localport=3389
On English Windows installations, enabling the built-in rule group also works:
netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
User Permissions and Ready-to-Use .cmd Script
Accounts in the Administrators group can sign in via RDP immediately. To grant access to a standard account, add that user to the Remote Desktop Users group:
net localgroup "Remote Desktop Users" Username /add
To avoid typing these commands manually on every machine, save them into an enable-rdp.cmd file and run it as administrator:
@echo off reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" ^ /v fDenyTSConnections /t REG_DWORD /d 0 /f sc config TermService start= auto net start TermService netsh advfirewall firewall add rule name="Allow RDP 3389" ^ dir=in action=allow protocol=TCP localport=3389
Alternative: PowerShell and Graphical Interface (GUI)
In an elevated PowerShell session, the exact same three steps (the registry value, the TermService service, and the firewall rule) look like this:
Set-ItemProperty ` -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' ` -Name fDenyTSConnections -Value 0 Set-Service TermService -StartupType Automatic Start-Service TermService New-NetFirewallRule -DisplayName 'Allow RDP 3389' ` -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Allow
If you prefer using the Windows GUI, press Win + R, run sysdm.cpl, switch to the Remote tab, and select Allow remote connections to this computer.
Once RDP is enabled, you can connect right away with mstsc.exe using the computer’s local IP address or hostname – a reboot is normally not required.