Problem with policy issue on Server 2016 Essentials

Hello Jeff Perkins,

The root cause is a legacy Group Policy Object (GPO) leftover from the Small Business Server (SBS) environment. The "greyed out" behavior in Windows settings is the definitive indicator that a "Winning GPO" is overriding local administrator control. This is a configuration drift issue common in SBS-to-Standard migrations, specifically regarding the "Windows SBS Client" policy templates that persist aggressively.

To resolve this permanently, you must isolate the specific policy rather than applying broad strokes. Execute gpresult /h C:\Support\RDP_Report.html from an elevated command prompt on an affected Windows 11 client to generate a precise policy resultant set. Open the report and locate the winning GPO under Computer Details > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections. The specific setting locking your UI is "Allow users to connect remotely by using Remote Desktop Services." You must edit the identified GPO in the Group Policy Management Console (GPMC) and change this setting to "Not Configured" to restore local control, or "Enabled" to force RDP on while keeping the UI greyed out.

Furthermore, Windows 11 strictly enforces Network Level Authentication (NLA) and Firewall profiles. In the same GPO path, verify that "Require user authentication for remote connections by using Network Level Authentication" is not conflicting with your client capabilities. You must also validate the "Windows Defender Firewall: Allow Inbound Remote Desktop exceptions" setting under Computer Configuration > Administrative Templates > Network > Network Connections > Windows Defender Firewall > Domain Profile. If this is not explicitly enabled with the correct scope (e.g., localsubnet), the RDP listener will be active but unreachable. Finally, if gpupdate /force does not resolve the issue, inspect HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services for a "tattooed" registry value named fDenyTSConnections; if it exists with a value of 1 without an active GPO enforcing it, delete the key manually.

Hope you found something useful in the answer. If it helped you get more insight into the issue, please consider accepting it. Thank you and have a nice day!

VP

Hello Jeff Perkins,

In reevaluating your case, the reason your previous workaround of disjoining and rejoining the domain failed on Windows 11 is almost certainly related to how modern Windows builds evaluate legacy WMI filters. Old SBS domains heavily utilized WMI filtering to target specific OS versions like Windows 7 or Windows 8. Windows 11 evaluates these legacy OS version queries differently than Windows 10 did, frequently causing these hidden, restrictive legacy policies to apply unexpectedly and lock the local UI.

You should open the Group Policy Management Console and create a new GPO specifically for your modern endpoints. Navigate to Computer Configuration, Administrative Templates, Windows Components, Remote Desktop Services, Remote Desktop Session Host, and then Connections. Explicitly set the policy "Allow users to connect remotely by using Remote Desktop Services" to Enabled. To guarantee this overrides the old SBS settings, link this new policy directly to the Organizational Unit containing your Windows 11 machines and set the link state to Enforced. This forces the policy to win any conflict resolutions against the legacy SBS templates.

To handle any lingering registry tattooing from the old environment, you must also ensure the local system is clearing out orphaned policies. If the UI remains greyed out after the enforced GPO applies, access the registry on an affected client and navigate to HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services. If you see legacy entries there, delete the Terminal Services key entirely. Furthermore, verify that HKLM\System\CurrentControlSet\Control\Terminal Server has the fDenyTSConnections DWORD set to 0. Running a standard gpupdate /force after clearing those keys will pull down your newly enforced policy, cleanly enabling RDP without requiring you to remove machines from the domain.

Hope this answer brought you some useful information. If it has, please consider accepting the answer so that other people sharing the same issue would benefit too. Thank you :)

VP

I'm posting this in hopes that it may help someone in the future. I tried changing everything, all reviews of local and domain policies resulted in no success. I created entirely new GPO and moved the resulting systems to that, I even tried unjoining and rejoining the domain with the client systems, still no success.

It became evident that a new server upgrade was in order, not from this issue, but something that was due. Instead of upgrading the new server from the old, we opted to completely create a fresh forest/domain and removed all clients from the old domain and joined them to the new one. Funny thing was, it would be suspected that this would resolve any old conflicts but it did not. In fact when a W11 client was unjoined from the domain we were still unable to enable RDP on the client.  Joining to the new domain did not resolve this.  What ended up being the resolution was completely resetting the Windows Firewall settings and this with the client joined to the domain, and having the proper domain policy in place for remote access. Without resetting the firewall nothing worked. Upon resetting the firewall the systems are now able to have RDP. I find it kind of funny that nothing any of the MS engineers and tons of other IT people consulted on the problem from various sites never even mentioned this as an option, but in the end I think it was something Gemini suggested that resulted in the solution. Maybe there is something to the assistance of Ai.