How to allow IP in RDP (Remote Desktop Rule) Windows Firewall

How to allow IP in RDP (Remote Desktop Rule) Windows Firewall

To create an inbound firewall rule for a program or service
Open the Group Policy Management Console to Windows Firewall with Advanced Security.
In the navigation pane, click Inbound Rules.
Click Action, and then click New rule.
On the Rule Type page of the New Inbound Rule Wizard, click Custom, and then click Next.

Although you can create rules by selecting Program or Port, those choices limit the number of pages presented by the wizard. If you select Custom, you see all of the pages, and have the most flexibility in creating your rules.

On the Program page, click This program path.
Type the path to the program in the text box. Use environment variables, where applicable, to ensure that programs installed in different locations on different computers work correctly.

Do one of the following:
If the executable file contains a single program, click Next.

If the executable file is a container for multiple services that must all be allowed to receive inbound network traffic, click Customize, select Apply to services only, click OK, and then click Next.

If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, click Customize, select Apply to this service, and then select the service from the list. If the service does not appear in the list, click Apply to service with this service short name, and then type the short name for the service in the text box. Click OK, and then click Next.

To use the Apply to this service or Apply to service with this service short name options, the service must be configured with a security identifier (SID) with a type of RESTRICTED or UNRESTRICTED. To check the SID type of a service, run the following command:

sc qsidtype <ServiceName>
If the result is NONE, then a firewall rule cannot be applied to that service.
To set a SID type on a service, run the following command:
sc sidtype <Type> <ServiceName>
In the preceding command, the value of <Type> can be UNRESTRICTED or RESTRICTED. Although the command also permits the value of NONE, that setting means the service cannot be used in a firewall rule as described here. By default, most services in Windows are configured as UNRESTRICTED. If you change the SID type to RESTRICTED, the service might fail to start. We recommend that you change the SID type only on services that you want to use in firewall rules, and that you change the SID type to UNRESTRICTED.

For more information, see Vista Services ( and the “Service Security Improvements” section of Inside the Windows Vista Kernel (

It is a best practice to restrict the firewall rule for the program to only the ports it needs to operate. On the Protocols and Ports page, you can specify the port numbers for the allowed traffic. If the program tries to listen on a port different from the one specified here, it is blocked. For more information about protocol and port options, see Create an Inbound Port Rule on Windows 7, Windows Vista, Windows Server 2008, or Windows Server 2008 R2. After you have configured the protocol and port options, click Next.

On the Scope page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click Next.
On the Action page, select Allow the connection, and then click Next.
On the Profile page, select the network location types to which this rule applies, and then click Next.

If this GPO is targeted at server computers running Windows Server 2008 that never move, consider applying the rule to all network location type profiles. This prevents an unexpected change in the applied rules if the network location type changes due to the installation of a new network card or the disconnection of an existing network card’s cable. A disconnected network card is automatically assigned to the Public network location type.
On the Name page, type a name and description for your rule, and then click Finish.

If you arrived at this page by clicking a link in a checklist, use your browser’s Back button to return to the checklist.

    • Related Articles

    • Setting up Remote Apps on Windows and Mac and IOs Devices

      Users have 2 options to fetch RDS Apps.  Log in directly to RDWeb CAD - USA - Users can log in utilizing their RDS users created in SolidCP (email address + password) and will grant ...
    • Windows: Accessing Your Server with Remote Desktop

      This article explains how to use Remote Desktop to access your Windows server’s desktop from anywhere in the world. Please note that this article pertains only to customers who have a Windows server hosted with Cartika.   On a normal Windows computer ...
    • New Access Management User setup on Windows 2008 / 2008r2

      In order to manage your GDPR compliant access to Windows 2008 You will need to create  1) Login to your account 2) Select your access management service (customers with managed infrastructure in both the US and CAD will have two) ...
    • Creating RDP user under Windows

      in Order to create RDP user account under windows , RDP to the server/vm  Open Server Manager > hover tools > click on 'Computer Management' > click on users&groups > click on users > right click on it to create a new user > and click on user > enter ...
    • Adding / Removing Remote Desktop Applications Through your solidcp

      You can manage all the remote applications that are available for download under your RDS/RDweb portal by navigating to your Solidcp account  RDS Collections > Choose an appropriate collection > Remote applications > Your server > choose an ...