How do I allow domain users RDP access to an EC2 Windows instance using group policy in AWS Managed Microsoft AD or Simple AD?

Short description

AWS Managed Microsoft AD and Simple AD don't allow you to add domain users to the built-in Remote Desktop Users domain group. Instead, create a Group Policy Object (GPO) using the built-in Admin account, and then apply the policy to the delegated computers.

Note: The GPO applies to all computers in the organizational unit (OU) that the policy is linked to. Any users that you add to the group using the following procedure will have RDP access to any computer in the OU.

Resolution

Before you start:

• Join an EC2 Windows instance (Windows Server 2012 R2 or later) to a Simple AD or AWS Managed Microsoft AD directory.
• Install the Remote Server Administration Tools (RSAT) and Group Policy Management console on the instance.

To allow domain users RDP access to the domain joined Windows instances, follow these steps:

1. Connect to your Windows EC2 instance using RDP.
2. Create a user. Repeat this step if you need more than one user.
3. Create a security group. Note the security group name for a later step.
4. Add the new users to the new security group.
5. Open Group Policy Management. Select your domain’s Forest, expand Domains, and then expand your domain name.
6. Expand your delegated OU (NetBIOS name of the directory). Open the context (right-click) menu for Computers, and then choose Create a GPO in this domain, and Link it here.
7. For Name, enter a name, and then choose Ok.
8. In the navigation pane, expand Computers. Open the context (right-click) menu for the policy, and then choose Edit.
9. In the Computer Configuration section of the navigation pane, expand Preferences, Control Panel Settings.
10. Open the context (right-click) menu for Local Users and Groups, and then choose New, Local Group.
11. For Group name, choose Remote Desktop Users (built-in), and then choose Add.
12. For Name, enter the name of the security group that you created in step 3, and then choose Ok.

This policy updates your environment at the next policy refresh interval. To force the policy to apply immediately, run the gpupdate /force command on the target server.

Related information

AWS Managed Microsoft AD

Simply Active Directory

Manage users and groups in AWS Managed Microsoft AD