Fixing the issue of remote sign-in though Remote Desktop Services using Local group membership setting in Intune

If you have a need for non-admin users to remote into Windows devices (Physical or VM), then in order to do so, they need to be a member of the Remote Desktop Users group. Now for Domain joined devices, this can be easily achieved by pushing down a policy using GPO. But how do you address this on devices joined to AAD? Read on to find out..

Back in March 2021, I had blogged on configuring local admins using LocalUsersandGroups CSP. Since then, Microsoft have recognized the need for managing the memebership of the built-in admin groups and introduced a new profile under Endpoint Security known as Local user group membership (At the time of writing this blog, the feature is still in preview). This template profile will allow IT admins to add, remove, or replace users and user groups to the built-in local groups on Windows devices. We are going to use this new template profile to configure the membership for the built-in Remote Desktop Users group.

Cuurently, the template setting allows you to perform the following actions: 

Add (Update): Adds members to specified group while keeping the current group membership intact.

Remove (Update): Removes members of specified group while keeping the current group membership intact.

Add (Replace): Replaces current membership of specified group with newly specified group.

This is how you can go about creating the policy in Intune -

1. Navigate to the Microsoft Endpoint Manager admin center portal. 

2. Head over to Endpoint security > Account protection > Create Policy > Platform. Select Windows 10 & later here and then select Local user group membership (Preview) from the drop down menu under Profile.

3. Fill in the name and other necessary details and click next.

4. Next up is to select the local group that you want to manage. Remote Desktop Users in my case.

5. Select the AAD users or groups that need remote sign-in access. (Note - These users and groups will get added\removed against all targeted devices so use them accordingly)

There are 2 ways of adding or removing users and groups:

a. Azure Active Directory (Azure AD) users and user groups (supported for Azure AD joined devices only).

b. Manually adding Azure AD and/or AD users and user groups (supported for Azure AD joined and hybrid joined devices).

We are going to be selecting option (a) for this particular use case, but if you do need to select option (b) then you can do so by adding SID, domain\username, or member’s username with SID being the most preferred method. 

Option (a)

6. Assign the policy to the intended list of devices or users.

Once complete, you can verify the policy and its compliance in Intune. The added users will be able to remotely sign-in on the targeted devices again without any more fuss.

Conclusion

I am glad that Microsoft recognised the need and provided the template to manage built-in admin groups natively in Intune as it is obviously an easier and much pleasant admin experience when compared to dealing with CSPs. However, it goes without saying that the template profile is still in preview and there are some known issues associated with it. For example, when you create the policy under Account Protection, it also gets created under Disk Encryption automatically. But overall, it is a good addition to the existing template profiles and I am sure such issues will get rectified eventually.