Remote Desktop Greyed Out in Windows? The Causes and Fixes

When Settings → System → Remote Desktop is greyed out, many troubleshooting guides immediately blame the firewall or port 3389. That is often the wrong place to start.

A genuinely greyed-out Remote Desktop switch usually means that Windows is not allowing the Settings app to control the feature. A Group Policy, an Intune policy or the installed Windows edition is making the decision instead. Services, firewall rules and damaged listeners become more relevant when Remote Desktop appears enabled but still refuses connections.

Microsoft does not publish statistics ranking these failures, so the order below is based on how directly each cause produces the greyed-out symptom, Microsoft’s own troubleshooting sequence and repeated Microsoft Q&A cases where the proposed solution was accepted or confirmed. Microsoft itself directs administrators to check Group Policy when the Remote Desktop options are unavailable.

Terminology: Remote Desktop Connection, or RDC, is the mstsc.exe client used to initiate a connection. Remote Desktop Protocol, or RDP, is the underlying protocol. The greyed-out Windows switch controls whether the computer can act as an RDP host.

Diagnose the problem before changing anything

Open PowerShell as Administrator on the affected computer. If RDP is already inaccessible, use a local keyboard, a virtual-machine console, Parsec, TeamViewer or another emergency access method.

Run:

# Check the installed Windows edition
Get-ComputerInfo |
    Select-Object WindowsProductName, WindowsEditionId

# Check the normal local Remote Desktop setting
Get-ItemProperty `
    'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' `
    -Name fDenyTSConnections

# Check whether a policy is controlling Remote Desktop
Get-ItemProperty `
    'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' `
    -Name fDenyTSConnections `
    -ErrorAction SilentlyContinue

# Generate a Group Policy report
gpresult /H "$env:USERPROFILE\Desktop\RDP-Policy.html"

# Check the two relevant services
Get-Service TermService, UmRdpService

# Check whether Windows has created an RDP listener
qwinsta

The most important value is fDenyTSConnections:

• 0 means incoming Remote Desktop connections are enabled.
• 1 means they are disabled.

Microsoft documents both the ordinary computer setting and the separate policy-controlled setting. If the value changes back to 1 after you correct it, a Group Policy or device-management policy is probably overriding you.

---

1. Group Policy is controlling Remote Desktop

This is the most likely explanation for a truly greyed-out switch, particularly when Windows displays:

Some settings are managed by your organisation.

A Group Policy can disable Remote Desktop, force it on or take control away from the local Settings app. This can happen on a domain-joined business computer, but it can also happen on a personal computer through Local Group Policy, security software, configuration scripts or policy settings left behind after an organisational account was removed.

Microsoft specifically states that if Remote Desktop cannot be enabled through the interface—or if fDenyTSConnections keeps reverting—a Group Policy Object may be overriding the computer-level setting.

Find the policy responsible

Open the HTML report created earlier:

Desktop\RDP-Policy.html

Inside the report, navigate to:

Computer Configuration
  → Administrative Templates
    → Windows Components
      → Remote Desktop Services
        → Remote Desktop Session Host
          → Connections

Look for:

Allow users to connect remotely by using Remote Desktop Services

The report should also identify the Winning GPO, meaning the specific policy that is applying the setting.

Fix it through Group Policy

Open:

gpedit.msc

Navigate to:

Computer Configuration
  → Administrative Templates
    → Windows Components
      → Remote Desktop Services
        → Remote Desktop Session Host
          → Connections

Open:

Allow users to connect remotely by using Remote Desktop Services

You now have two legitimate choices:

• Select Enabled when you want policy to force Remote Desktop on. The Settings switch may remain greyed out because policy still owns the setting, but RDP should be operational.
• Select Not Configured when you want to return control to the ordinary Windows Settings switch.

Then run:

gpupdate /force

Microsoft’s documentation explicitly recommends setting this policy to either Enabled or Not configured, followed by gpupdate /force. An accepted Microsoft Q&A answer uses the same policy location and procedure for enabling RDP through Group Policy.

Remove a stale policy value on a personal computer

Only do this on a computer you own or are authorised to administer, and only after setting the corresponding Local Group Policy to Not Configured:

$PolicyPath = `
    'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'

Remove-ItemProperty `
    -Path $PolicyPath `
    -Name fDenyTSConnections `
    -ErrorAction SilentlyContinue

gpupdate /force

Then enable the normal local setting:

Set-ItemProperty `
    -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' `
    -Name fDenyTSConnections `
    -Value 0

If the policy value reappears, something is actively managing it. Deleting it repeatedly is not a fix; the controlling GPO or device-management profile must be corrected.

---

2. Intune, MDM or Microsoft Entra management is overriding it

The second most likely cause is mobile-device management, usually Microsoft Intune.

This is particularly relevant when:

• Windows says the setting is managed by your organisation.
• gpresult does not show a traditional Group Policy blocking it.
• The computer is connected to a work or school account.
• The setting changes back after a reboot or policy synchronisation.
• The device is Microsoft Entra joined or registered.

Run:

dsregcmd /status

An Entra registration alone does not prove that Intune is controlling RDP, but it is an important clue. Also inspect:

Settings
  → Accounts
    → Access work or school

Microsoft exposes a specific device policy for this purpose:

./Device/Vendor/MSFT/Policy/Config/RemoteDesktopServices/AllowUsersToConnectRemotely

When enabled, authorised users may connect. When disabled, the computer refuses new incoming RDP connections. When the policy is not configured, Windows falls back to the local Remote Desktop setting.

Intune administrator solution

In Intune, create or modify the device configuration policy controlling Remote Desktop. Using a custom OMA-URI profile, the accepted Microsoft Q&A solution specifies:

OMA-URI:
./Device/Vendor/MSFT/Policy/Config/RemoteDesktopServices/AllowUsersToConnectRemotely

Data type:
String

Value:
<enabled />

Deploy it to the appropriate device group and synchronise the affected computer. This solution was marked as accepted by the question author on Microsoft Q&A.

On an employer-owned computer, do not try to defeat the policy locally. Even if a registry command appears to work, Intune can restore the managed value during the next sync.

---

3. The computer is running Windows Home

Windows Home can run the Remote Desktop client and connect to another computer, but it cannot act as a supported host for incoming Microsoft RDP connections.

Check the edition:

Get-ComputerInfo |
    Select-Object WindowsProductName, WindowsEditionId

Typical supported host editions include:

• Windows Pro
• Windows Enterprise
• Windows Education

If the result says Core, Home or CoreSingleLanguage, the missing or unavailable host setting is expected.

Microsoft’s own Remote Desktop instructions state that the target computer must run Windows Pro, while the device initiating the connection may run either Home or Pro. ASUS independently documents the same Windows 10/11 Pro host requirement for its Remote Desktop integration.

Solution

Upgrade the host computer to Windows Pro through:

Settings
  → System
    → Activation

Alternatively, use a remote-access product that officially supports Windows Home. There is no registry command that turns Windows Home into a properly licensed and supported built-in RDP host.

---

4. The ordinary RDP registry setting has been switched off

If the computer is running a supported Windows edition and there is no active policy, the local RDP value may simply be wrong.

This can happen after:

• A Windows update
• A security-hardening tool
• A privacy utility
• A system-optimisation script
• A failed Settings operation
• Restoring an old registry or system image

The relevant value is:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
fDenyTSConnections

Set it to 0:

Set-ItemProperty `
    -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' `
    -Name fDenyTSConnections `
    -Value 0

Microsoft documents 0 as enabled and 1 as disabled. The same registry change, combined with enabling the firewall rules, has also been repeatedly endorsed in Microsoft Q&A command-line solutions. (Microsoft Learn)

Restart Remote Desktop Services:

Restart-Service TermService -Force

Reopen Settings afterward. If the value immediately or eventually returns to 1, go back to the Group Policy and Intune sections. Something is enforcing it.

---

5. Remote Desktop Services are stopped or disabled

This is less likely to make the main switch grey, but it commonly causes a machine to appear correctly configured while accepting no connections.

Microsoft identifies two services that should be running:

Remote Desktop Services
Service name: TermService

Remote Desktop Services UserMode Port Redirector
Service name: UmRdpService

Check them:

Get-Service TermService, UmRdpService

Start them:

Start-Service TermService

Start-Service UmRdpService `
    -ErrorAction SilentlyContinue

Then restart the main service:

Restart-Service TermService -Force

If a service has explicitly been set to Disabled, open:

services.msc

Change it from Disabled to an appropriate start mode, then start it. Microsoft’s troubleshooting documentation says both services should be running and instructs administrators to start them when stopped.

Restarting TermService terminates existing RDP sessions, so perform this from a local console or alternative remote-access session.

---

6. Windows Firewall rules are disabled or corrupted

A disabled firewall rule normally results in a timeout rather than a grey Settings switch. Nevertheless, enabling RDP in Windows also involves enabling the corresponding inbound firewall rules. If that process fails, the Settings interface may refuse to complete the change or RDP may appear enabled while remaining unreachable.

Enable the built-in rules:

Get-NetFirewallRule `
    -DisplayGroup 'Remote Desktop' |
    Set-NetFirewallRule -Enabled True

Microsoft provides this exact PowerShell approach in its RDP connection troubleshooting documentation.

On a non-English Windows installation, the display-group name may be translated. In that case, open:

wf.msc

Under Inbound Rules, confirm that the following are enabled for the required profiles:

Remote Desktop - User Mode (TCP-In)
Remote Desktop - User Mode (UDP-In)

Last resort: reset the Windows Firewall policy

There is at least one Microsoft Q&A case where the question author confirmed that the Remote Desktop interface became usable again after running:

netsh advfirewall reset

That is credible evidence of firewall-policy corruption causing the UI problem, but it is only a user-confirmed support case—not a reason to make firewall reset the first step.

A reset restores Windows Firewall policy to its defaults and can remove custom rules. Export the current configuration first:

netsh advfirewall export `
    "$env:USERPROFILE\Desktop\firewall-backup.wfw"

netsh advfirewall reset

Microsoft’s command documentation confirms that reset restores default firewall policy and that the active configuration can be exported beforehand.

After the reset, enable Remote Desktop and its firewall rules again:

Get-NetFirewallRule `
    -DisplayGroup 'Remote Desktop' |
    Set-NetFirewallRule -Enabled True

Do not permanently disable Windows Firewall merely to make RDP work.

---

7. The RDP listener, certificate or Windows components are damaged

This is the least common category, but it becomes relevant when:

• Remote Desktop is enabled.
• The services are running.
• The firewall rules are enabled.
• The computer still does not listen for connections.

Run:

qwinsta

You should see an entry similar to:

rdp-tcp     Listen

Microsoft uses qwinsta as its primary check for the RDP listener.

Also check port 3389:

Get-NetTCPConnection `
    -LocalPort 3389 `
    -State Listen `
    -ErrorAction SilentlyContinue

From another computer on the same network, run:

Test-NetConnection `
    -ComputerName COMPUTER-NAME-OR-IP `
    -Port 3389 `
    -InformationLevel Detailed

A result of:

TcpTestSucceeded : True

means the port is reachable. Microsoft recommends Test-NetConnection from another machine and documents 3389 as the default RDP port.

Check whether the RDP port was changed

Get-ItemProperty `
    'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' `
    -Name PortNumber

If the port is no longer 3389, connect using:

computer-name:port

Repair a broken self-signed RDP certificate

Microsoft documents a more advanced repair for a damaged RDP self-signed certificate:

1. Open mmc.exe.
2. Add the Certificates snap-in.
3. Select Computer account.
4. Open the Remote Desktop certificate store.
5. Delete only the RDP-generated self-signed certificate.
6. Restart TermService.
7. Confirm that Windows creates a new certificate.

Do not delete a certificate deliberately issued by your organisation or certification authority. Microsoft specifically describes this procedure for the RDP self-signed certificate.

Repair damaged Windows components

Run DISM first, then System File Checker:

DISM.exe /Online /Cleanup-Image /RestoreHealth

sfc /scannow

Microsoft recommends this order because DISM repairs the Windows component source that SFC may need when replacing damaged system files.

---

Emergency PowerShell repair

The following block is useful when you still have emergency access through Parsec, a hypervisor console or a local screen and need to make RDP operational immediately.

Run it as Administrator:

# Local Remote Desktop setting
$LocalRdpPath = `
    'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server'

Set-ItemProperty `
    -Path $LocalRdpPath `
    -Name fDenyTSConnections `
    -Value 0

# Force the policy value to allow RDP
$PolicyRdpPath = `
    'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'

New-Item `
    -Path $PolicyRdpPath `
    -Force |
    Out-Null

New-ItemProperty `
    -Path $PolicyRdpPath `
    -Name fDenyTSConnections `
    -PropertyType DWord `
    -Value 0 `
    -Force |
    Out-Null

# Start the required services
Start-Service TermService

Start-Service UmRdpService `
    -ErrorAction SilentlyContinue

# Enable the built-in firewall rules
Get-NetFirewallRule `
    -DisplayGroup 'Remote Desktop' `
    -ErrorAction SilentlyContinue |
    Enable-NetFirewallRule

# Apply policy and restart RDP
gpupdate /force
Restart-Service TermService -Force

This prioritises restoring connectivity, not returning the switch to a clickable state. Because it creates an explicit policy value, Windows may continue to show the switch as greyed out or managed even though Remote Desktop now works.

The clean long-term solution is to find the GPO or MDM profile responsible. On a genuinely unmanaged personal computer, set that policy to Not Configured and remove the policy value so the ordinary Settings switch regains control.

---

Confirm that the repair worked

Run:

Get-ItemProperty `
    'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' `
    -Name fDenyTSConnections

Get-Service TermService, UmRdpService

qwinsta

Get-NetTCPConnection `
    -LocalPort 3389 `
    -State Listen `
    -ErrorAction SilentlyContinue

The desired results are:

fDenyTSConnections : 0
TermService         : Running
rdp-tcp             : Listen
TCP 3389            : Listening

From another computer:

Test-NetConnection `
    -ComputerName TARGET-PC `
    -Port 3389 `
    -InformationLevel Detailed

Then connect using:

mstsc.exe

---

What not to do

Do not begin by permanently disabling Network Level Authentication. NLA controls how a connection is authenticated; it does not normally explain why the main Remote Desktop switch is policy-greyed. Microsoft treats NLA as a separate Remote Desktop security policy.

Do not repeatedly delete policy registry values on a company-managed computer. The management platform will probably restore them, and bypassing an employer’s access policy may breach security rules.

Do not leave Windows Firewall disabled.

Most importantly, do not expose TCP port 3389 directly to the entire internet unless there is no viable alternative and strict source restrictions are in place. Microsoft explicitly warns that exposing a PC through port forwarding is not recommended and advises using a VPN instead.

The practical conclusion

When the Remote Desktop switch is genuinely greyed out, investigate the causes in this order:

1. Group Policy
2. Intune or another MDM platform
3. Unsupported Windows Home edition
4. Incorrect local fDenyTSConnections value
5. Stopped Remote Desktop services
6. Disabled or corrupted firewall rules
7. Damaged listener, certificate or Windows components

The distinction matters. A policy or unsupported edition explains why Windows will not let you operate the switch. Services, firewall rules and listeners explain why a computer that supposedly has Remote Desktop enabled still refuses the connection.