RDP for two users on Windows Server 2016-2025: setup guide

By default, Windows Server 2016, 2019, 2022 and 2025 let two administrators connect over RDP at the same time, and you don’t need to buy Remote Desktop licenses for it. Below: how this works, how resources are shared, and a PowerShell script that creates two users and, if you want, installs IPBan to block password guessing.

For two people to work comfortably, run Windows Server on the Castor plan or higher. Recommended resources: 8 vCores and 12 GB of RAM.

Session limits: what Windows gives you out of the box

These Windows Server versions allow no more than two remote sessions over RDP (Remote Desktop Protocol) at once. The mode is meant for server administration, not for multi-user work, and it comes with a few specifics:

• Licensing. You don’t need to buy or install Remote Desktop Services client access licenses (RDS CALs), or deploy the Remote Desktop Services Licensing role.
• Connection limit. A third connection prompts you to end one of the active sessions.
• Isolation. Each of the two users works in their own graphical environment, in a separate session.

How CPU and memory are shared

With two users in the basic mode, the system shares the server’s resources like this:

For hard limits and a guaranteed share per user you need an extra component, System Resource Manager (WSRM), or Group Policy (GPO). For two administrators the standard dynamic sharing is usually enough.

PowerShell script: two users and protection

Important: the user names (UserO1, UserO2) are demo examples, and you should replace the password in the script with your own strong one. Run PowerShell as administrator.

Warning: the commands below turn off User Account Control (UAC). That lowers the security of the system, and you do it at your own risk. The server must be restarted for the UAC change to take effect.

Option 1: basic setup without IPBan

# 1. Create the user accounts
$Password = ConvertTo-SecureString "YOUR_STRONG_PASSWORD" -AsPlainText -Force
New-LocalUser -Name "UserO1" -Password $Password -PasswordNeverExpires $true -Description "RDP Admin User 1"
New-LocalUser -Name "UserO2" -Password $Password -PasswordNeverExpires $true -Description "RDP Admin User 2"

# 2. Assign groups by SID
# S-1-5-32-544 -> Administrators
# S-1-5-32-555 -> Remote Desktop Users
$AdminGroup = (Get-LocalGroup | Where-Object { $_.SID -like "S-1-5-32-544" }).Name
$RdpGroup   = (Get-LocalGroup | Where-Object { $_.SID -like "S-1-5-32-555" }).Name

Add-LocalGroupMember -Group $AdminGroup -Member "UserO1", "UserO2"
Add-LocalGroupMember -Group $RdpGroup   -Member "UserO1", "UserO2"

# 3. Disable the default accounts
$AccountsToDisable = @("Administrator", "Admin", "Администратор")
foreach ($Acc in $AccountsToDisable) {
    if (Get-LocalUser -Name $Acc -ErrorAction SilentlyContinue) {
        Disable-LocalUser -Name $Acc
    }
}

# 4. Turn off UAC (restart required)
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableLUA" -Value 0

Option 2: setup with IPBan protection

The first four steps are the same as in Option 1. After them the script downloads and starts IPBan.

# 1. Create the user accounts
$Password = ConvertTo-SecureString "YOUR_STRONG_PASSWORD" -AsPlainText -Force
New-LocalUser -Name "UserO1" -Password $Password -PasswordNeverExpires $true -Description "RDP Admin User 1"
New-LocalUser -Name "UserO2" -Password $Password -PasswordNeverExpires $true -Description "RDP Admin User 2"

# 2. Assign groups by SID
$AdminGroup = (Get-LocalGroup | Where-Object { $_.SID -like "S-1-5-32-544" }).Name
$RdpGroup   = (Get-LocalGroup | Where-Object { $_.SID -like "S-1-5-32-555" }).Name

Add-LocalGroupMember -Group $AdminGroup -Member "UserO1", "UserO2"
Add-LocalGroupMember -Group $RdpGroup   -Member "UserO1", "UserO2"

# 3. Disable the default accounts
$AccountsToDisable = @("Administrator", "Admin", "Администратор")
foreach ($Acc in $AccountsToDisable) {
    if (Get-LocalUser -Name $Acc -ErrorAction SilentlyContinue) {
        Disable-LocalUser -Name $Acc
    }
}

# 4. Turn off UAC (restart required)
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableLUA" -Value 0

# 5. Install IPBan
$IpbanUrl = "https://github.com/DigitalRuby/IPBan/releases/latest/download/IPBan-Windows-x64.zip"
$ZipPath  = "$env:TEMP\IPBan.zip"
$DestPath = "C:\IPBan"

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest -Uri $IpbanUrl -OutFile $ZipPath
Expand-Archive -Path $ZipPath -DestinationPath $DestPath -Force

# Register and start the IPBan service
& "$DestPath\IPBan.exe" install
Start-Service -Name "IPBan"

# Clean up temporary files
Remove-Item -Path $ZipPath -Force

What the script does

• Option 1. Creates the accounts UserO1 and UserO2 and adds them to the Administrators and Remote Desktop Users groups (the groups are found by SID, so the script works on both English and localized Windows). Disables the default administrative accounts (Administrator, Admin, Администратор), a basic defense against password guessing. Turns off UAC through the EnableLUA registry value so programs install without pop-up prompts. The server must be restarted.
• Option 2. Does everything Option 1 does, and also downloads the IPBan utility from its GitHub repository into C:\IPBan and installs it as a system service. IPBan watches for failed RDP logins and blocks the attackers’ addresses through Windows Firewall.

Sharing CPU and memory between sessions

Current Windows Server versions use Dynamic Fair Share Scheduling (DFSS). Instead of hard percentage limits, it dynamically and evenly distributes the computing resources of the CPU, RAM and disk I/O between all active RDP sessions.

To make sure the CPU Fair Share mechanism is on, you can check the registry key HKLM\System\CurrentControlSet\Control\Session Manager\Quota System (the EnableCPUQuota value = 1).