Enable RDP to take remote of Intune managed devices, Firewall blocking the connection

[Deleted]

Hello Experts,
I need to enable RDP to take remote of Intune managed devices, could you please suggest the best solution through Intune, looks like the firewall
blocking the connection.

[#2]

Hey !@Deleted

We have the same issue and we are working on it, if we find something, we'll share with you !

For now, here's the procedure we are trying :

https://www.prajwaldesai.com/disable-remote-desktop-access-using-intune/ "Do it for enable it"

https://www.reddit.com/r/Intune/comments/vy69k8/enable_remote_desktop/

Regards

[#3]

Hi @Deleted 

Have you tried using Intune - EndPoint Security - Firewall - Create New Policy - Windows 11 - Microsoft Defender Firewall Rules

I have done the opposite recently (Locking Outbound Ports on Browsers), it worked like a treat. 

Hope this helps!

Moe

[#4]

I'm working with a customer to enable RDP on some AAD joined, Intune managed devices in the company. This is the configuration I'm testing at the moment:

- Enable RDP on device: Configuration Profile, Administrative template:

Allow users to connect remotely by using Remote Desktop Services - Enabled
Require user authentication for remote connections by using Network Level Authentication - Disabled

- Allow RDP/3389 through Windows Firewall: Device Configuration Profiles - Endpoint protection

Firewall rules - Allow TCP/3389

- Add users in local "Remote Desktop Users" group:

Endpoint security - Account protection - Local user group membership. Add users (not AAD groups) in "Remote Desktop Users" group.

There is a couple of drawback from this configuration. 

- Managment - I dont want this configuration to all Windows clients in the company. An AAD groups with devices must be maintained.

- I my testing, adding AAD group in the Endpoint security - Account protection - Local user group membership policy is not working, only users can be added.

- All users added in the policy "Local user group membership", are added in the local group "Remote Desktop Users" on all devices assigned to this policy.

[#5]

@Moe_Kinani Could you please elaborate more on this/ if possible share all screenshots 

[#6]

Hi @Deleted 

I was suggesting using the new Firewall Rules in Endpoint Security, located here.  Create New Profile Windows 10/11 - Microsoft Defender Firewall Rule - Edit Rule - Then Apply the Settings below and test. 

How did you confirm the issue from Windows firewall? Are your devices Azure AD Joined? Have you enabled the remote setting setting under Setting - System - Remote Desktop? I was prompted to enter creds without firewall policy as soon as I enabled the setting. You may need that setting only.

It will be great if you send us screenshot of the error you seeing.

Moe

https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune

[#7]

Hi Jay,

I have created this configuration profile and it worked with me.

https://www.notbad.tech/all-things-it/intune/how-to-allow-rdp-port-3389-with-microsoft-defender-fire...

[#8]

@Deleted 

I would suggest the following:

- Check the Firewall Rules in Intune. Particularly if you have any Security / Defender Baseline policies set. There is a setting called Policy rules from group policy not merged which I set to 'Not Configured' for the Private Firewall Profile

- Use the Scripts policy tool (or just do it manually) in Intune to deploy the following settings (PowerShell)

Set-NetFirewallRule -DisplayName "Remote Desktop - User Mode (TCP-In)" -Profile "Private"
Enable-NetFirewallRule -DisplayName "Remote Desktop - User Mode (TCP-In)"

- Check your network adaptor is using the Private Network Profile Type. (Settings > Network & Internet - Properties)

- Within Intune, create a Configuration Profile and enable the following settings: 

- Allow users to connect remotely by using Remote Desktop Services

- Require user authentication for remote connections by using Network Level Authentication

In the Windows 11 settings (System > Remote Desktop) it will show RDC as being OFF, but within The RDC options found in Control Panel, it will be turned on. Who knows what's going on here?

I believe that setting the Policy rules from group policy not merged to 'Not Configured' does open some doors in terms of security but I've had no luck using Intune FW rules.

I'd be interested if anyone has been able to do this recently with all the security baselines enabled.

[#9]

Did you find a way or policy to enable Remote Desktop in System?

[#10]

@GerardoHernandez 

Hey guys, we fixed our issue with the create of a new group to apply for a new Defender firewall policy accepted this : "The firewall allows RDP connection only with the private network or with the same domain via NTLMv2 authentication."

So need to turn on 2 profile through firewall as private network and domain accepting the outbound connection through NTLMv2 or your own config.

[#11]

@Subsystem3964

I've been having issues with Intune and RDP for months so your comment about the differences between the "settings" app and sysdm.cpl interested me.  Couldn't quite believe it when I saw it...

Schrödinger's RDP setting!

[#12]

@philiphgray 

I have the same issue; Settings - System shows it disabled, but it's enabled in sysdm.cpl anyone figure this out?

[#13]

@csmith00 

I've been successfully using an AD GPO that enables remote desktop for years, but using Intune to configure the same setting ("Allow users to connect remotely by using Remote Desktop Services") doesn't work.

I used process viewer to do a deep-dive on the registry settings that were being modified when throwing these switches but I didn't conclude it yet.

My next step is to do a registry examination on an AD/GPO PC and compare it to the registry on an Intune PC.   I'll post back if I find anything.

[#14]

You can enable or disable remote desktop access easily using a settings catalog policy. Please refer to this step-by-step guide for more info:

https://cloudinfra.net/enable-disable-remote-desktop-access-using-intune/

[#15]

@EtienneFiset - Thanks, we have updated the article to demonstrate the steps to enable or disable remote desktop connections using Intune - https://www.prajwaldesai.com/disable-remote-desktop-access-using-intune/