{"id":15857,"date":"2019-07-24T17:02:13","date_gmt":"2019-07-24T10:02:13","guid":{"rendered":"https:\/\/blog.tinohost.com\/?p=2257"},"modified":"2026-10-22T12:16:06","modified_gmt":"2026-10-22T05:16:06","slug":"mo-remote-desktop-tren-windows-server","status":"publish","type":"post","link":"https:\/\/tino.vn\/blog\/mo-remote-desktop-tren-windows-server\/","title":{"rendered":"C\u00e1ch m\u1edf Remote Desktop tr\u00ean Windows Server 2025, 2022 v\u00e0 2019"},"content":{"rendered":"\n

\u0110\u1ec3 m\u1edf Remote Desktop tr\u00ean Windows Server 2025, 2022 ho\u1eb7c 2019, v\u00e0o Server Manager \u2192 Local Server, b\u1ea5m v\u00e0o ch\u1eef “Disabled” c\u1ea1nh Remote Desktop, ch\u1ecdn “Allow remote connections to this computer” r\u1ed3i b\u1ea5m OK.<\/strong> Tr\u00ean b\u1ea3n Server Core kh\u00f4ng c\u00f3 giao di\u1ec7n, b\u1ea1n d\u00f9ng c\u00f4ng c\u1ee5 sconfig (m\u1ee5c 7) ho\u1eb7c hai l\u1ec7nh PowerShell. Remote Desktop m\u1eb7c \u0111\u1ecbnh b\u1ecb t\u1eaft sau khi c\u00e0i Windows Server.<\/p>\n\n\n\n

Khi thu\u00ea VPS Windows<\/a> (m\u1ed9t m\u00e1y ch\u1ee7 \u1ea3o VPS<\/a> ch\u1ea1y Windows Server<\/a>), Remote Desktop th\u01b0\u1eddng \u0111\u00e3 b\u1eadt s\u1eb5n. B\u1ea1n c\u1ea7n c\u00e1c b\u01b0\u1edbc d\u01b0\u1edbi khi c\u00e0i l\u1ea1i h\u1ec7 \u0111i\u1ec1u h\u00e0nh cho VPS<\/a>, d\u00f9ng Server Core ho\u1eb7c kh\u00f4ng v\u00e0o \u0111\u01b0\u1ee3c.<\/p>\n\n\n\n

Remote Desktop tr\u00ean Windows Server l\u00e0 g\u00ec?<\/h2>\n\n\n\n

Remote Desktop l\u00e0 t\u00ednh n\u0103ng cho ph\u00e9p b\u1ea1n \u0111i\u1ec1u khi\u1ec3n Windows Server t\u1eeb m\u1ed9t m\u00e1y kh\u00e1c qua m\u1ea1ng b\u1eb1ng giao th\u1ee9c Remote Desktop Protocol (RDP), nh\u01b0 \u0111ang ng\u1ed3i tr\u01b0\u1edbc m\u00e0n h\u00ecnh m\u00e1y ch\u1ee7. M\u00e1y ch\u1ee7 l\u1eafng nghe \u1edf c\u1ed5ng 3389 (TCP v\u00e0 UDP) theo m\u1eb7c \u0111\u1ecbnh; m\u00e1y b\u1ea1n d\u00f9ng Remote Desktop Connection (mstsc<\/code>) ho\u1eb7c Windows App tr\u00ean macOS, iPhone, Android (Microsoft Learn<\/a>, Windows App<\/a>).<\/p>\n\n\n\n

C\u00e0i m\u1edbi Windows Server th\u00ec Remote Desktop \u1edf tr\u1ea1ng th\u00e1i t\u1eaft: gi\u00e1 tr\u1ecb fDenyTSConnections<\/code> m\u1eb7c \u0111\u1ecbnh l\u00e0 “t\u1eeb ch\u1ed1i k\u1ebft n\u1ed1i” (Microsoft Learn<\/a>). \u0110\u1ec3 b\u1eadt, b\u1ea1n c\u1ea7n quy\u1ec1n Administrators v\u00e0 l\u00e0m hai vi\u1ec7c: cho ph\u00e9p k\u1ebft n\u1ed1i t\u1eeb xa, v\u00e0 b\u1eadt nh\u00f3m quy t\u1eafc “Remote Desktop” tr\u00ean Windows Firewall.<\/p>\n\n\n\n

\"Ch\u1ecdn<\/figure>\n\n\n\n

C\u00e1ch m\u1edf Remote Desktop b\u1eb1ng Server Manager<\/h2>\n\n\n\n

Server Manager l\u00e0 c\u00e1ch nhanh tr\u00ean Windows Server b\u1ea3n c\u00f3 giao di\u1ec7n (Desktop Experience): \u0111\u1ed5i tr\u1ea1ng th\u00e1i Remote Desktop \u1edf trang Local Server, Windows t\u1ef1 b\u1eadt quy t\u1eafc t\u01b0\u1eddng l\u1eeda cho c\u1ed5ng 3389. Server Manager t\u1ef1 m\u1edf sau khi \u0111\u0103ng nh\u1eadp; n\u1ebfu \u0111\u00e3 \u0111\u00f3ng, t\u00ecm trong menu Start.<\/p>\n\n\n\n

B\u01b0\u1edbc 1:<\/strong> Trong Server Manager, ch\u1ecdn Local Server<\/strong> \u1edf c\u1ed9t tr\u00e1i. D\u00f2ng Remote Desktop<\/strong> \u0111ang hi\u1ec3n th\u1ecb Disabled<\/strong>.<\/p>\n\n\n\n

\"Trang
\u1ea2nh ch\u1ee5p tr\u00ean Windows Server 2019; Windows Server 2022 v\u00e0 2025 c\u00f3 giao di\u1ec7n t\u01b0\u01a1ng t\u1ef1.<\/figcaption><\/figure>\n\n\n\n

B\u01b0\u1edbc 2:<\/strong> B\u1ea5m v\u00e0o ch\u1eef Disabled<\/strong> \u0111\u1ec3 m\u1edf System Properties \u1edf tab Remote<\/strong>. Ch\u1ecdn Allow remote connections to this computer<\/strong> v\u00e0 gi\u1eef d\u1ea5u t\u00edch \u1edf \u00f4 Allow connections only from computers running Remote Desktop with Network Level Authentication (recommended)<\/strong>.<\/p>\n\n\n\n

\"Tab
\u1ea2nh ch\u1ee5p tr\u00ean Windows Server 2019; Windows Server 2022 v\u00e0 2025 c\u00f3 giao di\u1ec7n t\u01b0\u01a1ng t\u1ef1.<\/figcaption><\/figure>\n\n\n\n

B\u01b0\u1edbc 3:<\/strong> Windows b\u00e1o “Remote Desktop Firewall exception will be enabled” (s\u1ebd b\u1eadt ngo\u1ea1i l\u1ec7 t\u01b0\u1eddng l\u1eeda). B\u1ea5m OK<\/strong>, r\u1ed3i b\u1ea5m OK<\/strong> l\u1ea7n n\u1eefa \u0111\u1ec3 \u0111\u00f3ng System Properties.<\/p>\n\n\n\n

B\u01b0\u1edbc 4:<\/strong> Quay l\u1ea1i Server Manager, nh\u1ea5n F5. D\u00f2ng Remote Desktop chuy\u1ec3n sang Enabled<\/strong>.<\/p>\n\n\n\n

\"Server
\u1ea2nh ch\u1ee5p tr\u00ean Windows Server 2019; Windows Server 2022 v\u00e0 2025 c\u00f3 giao di\u1ec7n t\u01b0\u01a1ng t\u1ef1.<\/figcaption><\/figure>\n\n\n\n

M\u1eb7c \u0111\u1ecbnh ch\u1ec9 nh\u00f3m Administrators \u0111\u01b0\u1ee3c k\u1ebft n\u1ed1i. Mu\u1ed1n cho t\u00e0i kho\u1ea3n kh\u00e1c v\u00e0o, b\u1ea5m Select Users\u2026<\/strong> trong tab Remote; t\u00e0i kho\u1ea3n \u0111\u00f3 \u0111\u01b0\u1ee3c \u0111\u01b0a v\u00e0o nh\u00f3m Remote Desktop Users (Microsoft Learn<\/a>).<\/p>\n\n\n\n

C\u00e1ch b\u1eadt Remote Desktop b\u1eb1ng PowerShell<\/h2>\n\n\n\n

B\u1eadt Remote Desktop b\u1eb1ng PowerShell c\u1ea7n hai l\u1ec7nh: \u0111\u1eb7t fDenyTSConnections<\/code> v\u1ec1 0 \u0111\u1ec3 cho ph\u00e9p k\u1ebft n\u1ed1i, r\u1ed3i b\u1eadt nh\u00f3m quy t\u1eafc “Remote Desktop” tr\u00ean Windows Firewall. C\u00e1ch n\u00e0y d\u00f9ng \u0111\u01b0\u1ee3c cho b\u1ea3n c\u00f3 giao di\u1ec7n, Server Core v\u00e0 script qu\u1ea3n tr\u1ecb nhi\u1ec1u m\u00e1y. M\u1edf PowerShell b\u1eb1ng Run as administrator<\/strong>.<\/p>\n\n\n\n

# 1. Cho ph\u00e9p k\u1ebft n\u1ed1i Remote Desktop (0 = cho ph\u00e9p, 1 = ch\u1eb7n)\nSet-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server' -Name 'fDenyTSConnections' -Value 0\n\n# 2. B\u1eadt nh\u00f3m quy t\u1eafc Remote Desktop tr\u00ean Windows Firewall\nEnable-NetFirewallRule -DisplayGroup 'Remote Desktop'\n\n# 3. B\u1eaft bu\u1ed9c Network Level Authentication (khuy\u1ebfn ngh\u1ecb)\nSet-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp' -Name 'UserAuthentication' -Value 1<\/code><\/pre>\n\n\n\n
UserAuthentication<\/code> b\u1eb1ng 1 y\u00eau c\u1ea7u x\u00e1c th\u1ef1c \u1edf m\u1ee9c m\u1ea1ng (NLA) tr\u01b0\u1edbc khi phi\u00ean \u0111\u01b0\u1ee3c t\u1ea1o (Microsoft Learn<\/a>). Ki\u1ec3m tra l\u1ea1i b\u1eb1ng:<\/p>\n\n\n\n
Get-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server' -Name 'fDenyTSConnections'\nGet-NetFirewallRule -DisplayGroup 'Remote Desktop' | Select-Object DisplayName, Enabled, Profile<\/code><\/pre>\n\n\n\n
T\u00ean nh\u00f3m “Remote Desktop” \u0111\u01b0\u1ee3c d\u1ecbch theo ng\u00f4n ng\u1eef c\u1ee7a Windows. N\u1ebfu l\u1ec7nh b\u00e1o kh\u00f4ng t\u00ecm th\u1ea5y nh\u00f3m, d\u00f9ng t\u00ean n\u1ed9i b\u1ed9: Enable-NetFirewallRule -Group '@FirewallAPI.dll,-28752'<\/code>. Xem t\u00ean n\u1ed9i b\u1ed9 tr\u00ean m\u00e1y b\u1eb1ng Get-NetFirewallRule -DisplayGroup 'Remote Desktop' | Select-Object -First 1 Group<\/code>.<\/p>\n\n\n\n
C\u00e1ch b\u1eadt Remote Desktop tr\u00ean Server Core b\u1eb1ng sconfig<\/h2>\n\n\n\n
Tr\u00ean Windows Server b\u1ea3n Server Core, c\u00f4ng c\u1ee5 SConfig l\u00e0 c\u00e1ch \u0111\u01a1n gi\u1ea3n \u0111\u1ec3 b\u1eadt Remote Desktop: g\u00f5 7 \u1edf menu ch\u00ednh, ch\u1ecdn E \u0111\u1ec3 b\u1eadt, r\u1ed3i ch\u1ecdn 1 \u0111\u1ec3 ch\u1ec9 cho m\u00e1y kh\u00e1ch h\u1ed7 tr\u1ee3 Network Level Authentication k\u1ebft n\u1ed1i. T\u1eeb Windows Server 2022, SConfig t\u1ef1 m\u1edf sau khi \u0111\u0103ng nh\u1eadp Server Core (Microsoft Learn<\/a>).<\/p>\n\n\n\n
    \n
  1. \u0110\u0103ng nh\u1eadp Server Core. N\u1ebfu SConfig ch\u01b0a hi\u1ec7n (Windows Server 2019 tr\u1edf v\u1ec1 tr\u01b0\u1edbc), g\u00f5 sconfig<\/code> trong c\u1eeda s\u1ed5 d\u00f2ng l\u1ec7nh r\u1ed3i Enter.<\/li>\n\n\n
  2. \u1ede menu ch\u00ednh, g\u00f5 7<\/code> (Remote desktop) v\u00e0 Enter.<\/li>\n\n\n
  3. G\u00f5 E<\/code> v\u00e0 Enter \u0111\u1ec3 b\u1eadt (g\u00f5 D<\/code> n\u1ebfu mu\u1ed1n t\u1eaft).<\/li>\n\n\n
  4. G\u00f5 1<\/code> \u0111\u1ec3 ch\u1ec9 cho ph\u00e9p m\u00e1y kh\u00e1ch c\u00f3 NLA (an to\u00e0n h\u01a1n). Ch\u1ec9 ch\u1ecdn 2<\/code> khi ph\u1ea3i k\u1ebft n\u1ed1i t\u1eeb ph\u1ea7n m\u1ec1m Remote Desktop qu\u00e1 c\u0169.<\/li>\n<\/ol>\n\n\n\n
    C\u00e1ch m\u1edf c\u1ed5ng Remote Desktop tr\u00ean Windows Firewall<\/h2>\n\n\n\n
    Remote Desktop c\u1ea7n c\u1ed5ng 3389 TCP (v\u00e0 UDP) \u0111\u01b0\u1ee3c m\u1edf tr\u00ean Windows Firewall. B\u1eadt b\u1eb1ng Server Manager th\u00ec Windows t\u1ef1 b\u1eadt nh\u00f3m quy t\u1eafc “Remote Desktop”; b\u1eadt b\u1eb1ng registry ho\u1eb7c script th\u00ec b\u1ea1n ph\u1ea3i t\u1ef1 b\u1eadt nh\u00f3m n\u00e0y. Ki\u1ec3m tra c\u1ea3 t\u01b0\u1eddng l\u1eeda \u1edf trang qu\u1ea3n l\u00fd c\u1ee7a nh\u00e0 cung c\u1ea5p VPS.<\/p>\n\n\n\n
    M\u1edf Remote Desktop l\u00e0 m\u1edf m\u1ed9t c\u1ed5ng ra Internet, n\u00ean Microsoft khuy\u1ebfn ngh\u1ecb ch\u1ec9 cho t\u00e0i kho\u1ea3n c\u00f3 m\u1eadt kh\u1ea9u m\u1ea1nh k\u1ebft n\u1ed1i. K\u1ebft n\u1ed1i t\u1eeb IP c\u1ed1 \u0111\u1ecbnh (v\u0103n ph\u00f2ng, VPN c\u00f4ng ty) th\u00ec gi\u1edbi h\u1ea1n ch\u1ec9 IP \u0111\u00f3:<\/p>\n\n\n\n
    # Ch\u1ec9 cho IP 203.0.113.10 k\u1ebft n\u1ed1i Remote Desktop (thay b\u1eb1ng IP c\u1ee7a b\u1ea1n, nhi\u1ec1u IP c\u00e1ch nhau d\u1ea5u ph\u1ea9y)\nSet-NetFirewallRule -DisplayGroup 'Remote Desktop' -RemoteAddress 203.0.113.10\n\n# B\u1ecf gi\u1edbi h\u1ea1n, cho m\u1ecdi IP\nSet-NetFirewallRule -DisplayGroup 'Remote Desktop' -RemoteAddress Any<\/code><\/pre>\n\n\n\n
    IP trong l\u1ec7nh ph\u1ea3i l\u00e0 IP Internet hi\u1ec7n t\u1ea1i c\u1ee7a m\u00e1y b\u1ea1n, kh\u00f4ng ph\u1ea3i IP m\u1ea1ng n\u1ed9i b\u1ed9. N\u1ebfu IP sai ho\u1eb7c nh\u00e0 m\u1ea1ng c\u1ea5p IP \u0111\u1ed9ng, l\u1ea7n k\u1ebft n\u1ed1i sau s\u1ebd b\u1ecb ch\u1eb7n; khi \u0111\u00f3 v\u00e0o b\u1eb1ng console c\u1ee7a nh\u00e0 cung c\u1ea5p v\u00e0 ch\u1ea1y l\u1ec7nh b\u1ecf gi\u1edbi h\u1ea1n. Tham s\u1ed1 -RemoteAddress<\/code>: xem Set-NetFirewallRule<\/a>. Quy t\u1eafc v\u00e0o, ra c\u1ee7a t\u01b0\u1eddng l\u1eeda: xem firewall l\u00e0 g\u00ec<\/a>.<\/p>\n\n\n\n
    L\u00e0m sao ki\u1ec3m tra Remote Desktop \u0111\u00e3 ho\u1ea1t \u0111\u1ed9ng?<\/h2>\n\n\n\n
    C\u00e1ch ki\u1ec3m tra ch\u1eafc ch\u1eafn l\u00e0 k\u1ebft n\u1ed1i th\u1eed t\u1eeb m\u00e1y kh\u00e1c: nh\u1ea5n Win + R, g\u00f5 mstsc<\/code>, nh\u1eadp IP m\u00e1y ch\u1ee7 r\u1ed3i \u0111\u0103ng nh\u1eadp. Kh\u00f4ng v\u00e0o \u0111\u01b0\u1ee3c th\u00ec ki\u1ec3m tra l\u1ea7n l\u01b0\u1ee3t b\u1ed1n l\u1edbp m\u00e0 k\u1ebft n\u1ed1i ph\u1ea3i \u0111i qua: t\u01b0\u1eddng l\u1eeda nh\u00e0 cung c\u1ea5p, Windows Firewall, d\u1ecbch v\u1ee5 Remote Desktop v\u00e0 b\u01b0\u1edbc x\u00e1c th\u1ef1c.<\/p>\n\n\n\n
    \"K\u1ebft<\/figure>\n\n\n\n
    # Tr\u00ean m\u00e1y c\u1ee7a b\u1ea1n: TcpTestSucceeded : True l\u00e0 c\u1ed5ng \u0111\u00e3 m\u1edf\nTest-NetConnection IP_MAY_CHU -Port 3389\n\n# Tr\u00ean m\u00e1y ch\u1ee7: d\u00f2ng rdp-tcp \u1edf tr\u1ea1ng th\u00e1i Listen l\u00e0 RDP \u0111ang l\u1eafng nghe\nqwinsta<\/code><\/pre>\n\n\n\n
    Test-NetConnection b\u00e1o False nh\u01b0ng tr\u00ean m\u00e1y ch\u1ee7 nh\u00f3m quy t\u1eafc \u0111\u00e3 b\u1eadt v\u00e0 rdp-tcp<\/code> \u0111ang Listen th\u00ec ch\u1ed7 ch\u1eb7n l\u00e0 t\u01b0\u1eddng l\u1eeda c\u1ee7a nh\u00e0 cung c\u1ea5p. K\u1ebft n\u1ed1i t\u1eeb macOS, \u0111i\u1ec7n tho\u1ea1i v\u00e0 l\u1ed7i ph\u00eda m\u00e1y kh\u00e1ch: xem c\u00e1ch k\u1ebft n\u1ed1i VPS b\u1eb1ng SSH v\u00e0 Remote Desktop<\/a>.<\/p>\n\n\n\n
    C\u00f3 n\u00ean \u0111\u1ed5i c\u1ed5ng Remote Desktop kh\u00f4ng?<\/h2>\n\n\n\n
    \u0110\u1ed5i c\u1ed5ng Remote Desktop kh\u1ecfi 3389 gi\u00fap gi\u1ea3m s\u1ed1 l\u1ea7n d\u00f2 m\u1eadt kh\u1ea9u t\u1ef1 \u0111\u1ed9ng v\u00e0o c\u1ed5ng quen thu\u1ed9c, nh\u01b0ng kh\u00f4ng thay \u0111\u01b0\u1ee3c m\u1eadt kh\u1ea9u m\u1ea1nh, NLA v\u00e0 gi\u1edbi h\u1ea1n IP. Microsoft c\u00f3 h\u01b0\u1edbng d\u1eabn \u0111\u1ed5i c\u1ed5ng, \u0111\u1ed3ng th\u1eddi ghi trong t\u00e0i li\u1ec7u x\u1eed l\u00fd s\u1ef1 c\u1ed1 r\u1eb1ng kh\u00f4ng khuy\u1ebfn ngh\u1ecb ch\u1ea1y RDP \u1edf c\u1ed5ng kh\u00e1c (Microsoft Learn<\/a>).<\/p>\n\n\n\n
    N\u1ebfu v\u1eabn \u0111\u1ed5i, m\u1edf s\u1eb5n console c\u1ee7a nh\u00e0 cung c\u1ea5p, t\u1ea1o b\u1ea3n sao l\u01b0u ho\u1eb7c snapshot VPS<\/a> r\u1ed3i l\u00e0m \u0111\u00fang th\u1ee9 t\u1ef1 d\u01b0\u1edbi. B\u01b0\u1edbc 4 l\u00e0 \u0111i\u1ec3m kh\u00f4ng quay l\u1ea1i: phi\u00ean \u0111ang m\u1edf b\u1ecb ng\u1eaft v\u00e0 RDP ch\u1ec9 c\u00f2n nghe \u1edf c\u1ed5ng m\u1edbi.<\/p>\n\n\n\n
    \"Th\u1ee9<\/figure>\n\n\n\n
    # Ch\u1ea1y trong PowerShell (Administrator). V\u00ed d\u1ee5 \u0111\u1ed5i sang c\u1ed5ng 3390\n$port = 3390\n\n# 1. Ki\u1ec3m tra c\u1ed5ng m\u1edbi ch\u01b0a c\u00f3 ch\u01b0\u01a1ng tr\u00ecnh kh\u00e1c d\u00f9ng (kh\u00f4ng c\u00f3 k\u1ebft qu\u1ea3 l\u00e0 tr\u1ed1ng)\nGet-NetTCPConnection -LocalPort $port -ErrorAction SilentlyContinue\nGet-NetUDPEndpoint -LocalPort $port -ErrorAction SilentlyContinue\n\n# 2. M\u1edf c\u1ed5ng m\u1edbi tr\u00ean Windows Firewall TR\u01af\u1edaC\nNew-NetFirewallRule -DisplayName 'RDP-Custom-TCP-In' -Direction Inbound -Action Allow -Protocol TCP -LocalPort $port -Profile Any\nNew-NetFirewallRule -DisplayName 'RDP-Custom-UDP-In' -Direction Inbound -Action Allow -Protocol UDP -LocalPort $port -Profile Any\n\n# 3. \u0110\u1ed5i c\u1ed5ng l\u1eafng nghe c\u1ee7a RDP\nSet-ItemProperty -Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp' -Name 'PortNumber' -Value $port\n\n# 3b. D\u1eeaNG L\u1ea0I: n\u1ebfu VPS c\u00f3 t\u01b0\u1eddng l\u1eeda \u1edf trang qu\u1ea3n tr\u1ecb c\u1ee7a nh\u00e0 cung c\u1ea5p, m\u1edf c\u1ed5ng $port (TCP v\u00e0 UDP) \u1edf \u0111\u00f3 NGAY B\u00c2Y GI\u1edc.\n#     Ch\u1ec9 ch\u1ea1y b\u01b0\u1edbc 4 khi c\u1ea3 Windows Firewall v\u00e0 t\u01b0\u1eddng l\u1eeda nh\u00e0 cung c\u1ea5p \u0111\u1ec1u \u0111\u00e3 m\u1edf c\u1ed5ng m\u1edbi.\n\n# 4. Kh\u1edfi \u0111\u1ed9ng l\u1ea1i d\u1ecbch v\u1ee5 Remote Desktop (phi\u00ean hi\u1ec7n t\u1ea1i s\u1ebd b\u1ecb ng\u1eaft) ho\u1eb7c kh\u1edfi \u0111\u1ed9ng l\u1ea1i m\u00e1y\nRestart-Service TermService -Force<\/code><\/pre>\n\n\n\n