Limit Administrator Logon via RDP

Q: How can I stop administrators from being able to RDP to a machine?

A: There are several ways to stop administrators from having Remote Desktop access to an OS. The cleanest way is to remove the local Administrators group from the Allow log on permission, through the Remote Desktop Services user right. However, administrators can simply add themselves back to the group; therefore, if there's a specific reason you don't want an administrator to log on directly, you should remove the administrator's rights as follows:

Depending on the reasons for wanting to block an administrator, this might not be the best solution. The person would still know that he or she had the correct password because they would see a screen indicating that access was denied for the account. Another approach would be to whitelist only certain IP address ranges from being able to connect when using endpoints in services such as Azure.