A Powershell script which runs on a list of computer accounts and sets the security -> permission : "Allowed to authenticate"

Question

As the topic says I'd like to automate the process of running on all computer accounts in my domain and setting this option to enabled otherwise people are unable to log into the servers using RDP. Any idea if it can be done using a script?

The image is not displayed well, you can click This Link to view the image.

Answer 1

Set-Acl should work for AD objects as well. See this Scripting Guy article.

Answer 2

Are you dealing with users from one trusted domain needing to RDP into computers in a trusting domain? That is my understanding of why you could possibly need what you are asking for.

I may be way off here, but it sounds like you would simply like to enable your all of your users to RDP into all of your computers/servers. If so, you should only need to populate the Remote Desktop Users group on each computer with the security principal of those you want to be able to RDP. So in your case, you would add Authenticated Users to Remote Desktop Users on each computer.

The easiest and most consistent way to do this is with Group Policy Restricted Groups. From http://technet.microsoft.com/en-us/library/cc776790%28v=ws.10%29.aspx:

To add a domain group to the Remote Desktop Users group via Group Policy

1. To open Group Policy Management Console, click Start, click Run, and then type GPMC.msc.
2. Create and link a GPO named Restricted Groups to the terminal server OU.
3. Right-click the Restricted Groups GPO linked to the terminal server OU, and then click Edit.
4. You can configure the Restricted Groups setting in the following location in Group Policy Object Editor:
5. Computer Configuration\Windows Settings\Security Settings\Restricted Groups\
6. Right-click Restricted Groups and then click Add Group.
7. Click Browse, click Locations, select the locations you want to browse, and then click OK.
8. Type Remote Desktop Users in the Enter the object names to select text box and then click Check Names. Or, click Advanced, and then click Find Now to list all available groups.
9. Click the Remote Desktop Users group and then click OK.
10. Click OK in the Add Groups dialog box to close it. The Remote Desktop Users Properties dialog box is then displayed.
11. Click Add in the Members of this group section of the dialog box.
12. Click Browse.
13. Type the name of the domain group in the Select Users or Groups dialog box. Click Check Names, and then click OK to close this dialog box.
14. Click OK to close this dialog box to finish adding the domain group to the Remote Desktop Users group.