diff --git a/ansible/roles/win_client/tasks/rdgw.yml b/ansible/roles/win_client/tasks/rdgw.yml
index 2b9bae4..7c82ba8 100644
--- a/ansible/roles/win_client/tasks/rdgw.yml
+++ b/ansible/roles/win_client/tasks/rdgw.yml
@@ -1,4 +1,12 @@
 ---
+- name: Add Guacamole group to remote desktop users
+  ansible.windows.win_group_membership:
+    name: Remote Desktop Users
+    members:
+      - "{{ win_project}}\\{{ guacamole_user_group }}"
+    state: present
+  tags: guacamole_rdu
+
 - name: RD Gateway setup
   tags: client_rdgw
   block:
diff --git a/ansible/roles/win_domain_controller/defaults/main.yml b/ansible/roles/win_domain_controller/defaults/main.yml
new file mode 100644
index 0000000..3942fd8
--- /dev/null
+++ b/ansible/roles/win_domain_controller/defaults/main.yml
@@ -0,0 +1 @@
+guacamole_user_group: "Guacamole Users"
\ No newline at end of file
diff --git a/ansible/roles/win_domain_controller/tasks/setup.yml b/ansible/roles/win_domain_controller/tasks/setup.yml
index 4edfec1..efd9071 100644
--- a/ansible/roles/win_domain_controller/tasks/setup.yml
+++ b/ansible/roles/win_domain_controller/tasks/setup.yml
@@ -123,6 +123,14 @@
         password: "{{ file_manager_password }}"
         state: present
         password_never_expires: yes
+      
+    - name: Create Guacamole Users group for RDP access
+      microsoft.ad.group:
+        name: "{{ guacamole_user_group }}"
+        description: "Allow remote logon for guacamole users"
+        path: "cn=Users,dc={{ win_project }},dc=loc"
+        scope: domainlocal
+        category: security
   when: inventory_hostname in groups['meta-name_dc01']
 
 
diff --git a/ansible/roles/win_user/defaults/main.yml b/ansible/roles/win_user/defaults/main.yml
index 588d16d..663d8e1 100644
--- a/ansible/roles/win_user/defaults/main.yml
+++ b/ansible/roles/win_user/defaults/main.yml
@@ -1 +1,2 @@
-user_action: create
\ No newline at end of file
+user_action: create
+guacamole_user_group: "Guacamole Users"
\ No newline at end of file
diff --git a/ansible/vars/common.yml b/ansible/vars/common.yml
index 94fb796..7be21e6 100644
--- a/ansible/vars/common.yml
+++ b/ansible/vars/common.yml
@@ -18,6 +18,8 @@ gpu_flavor: b07fc115-e48e-4289-b220-baae18c8db8a
 filetransfer_user: file-transfer
 filemanager_user: file-manager
 
+guacamole_user_group: "Guacamole Users"
+
 winrm_script_url: http://10.24.3.242/ConfigureRemotingForAnsible.ps1
 
 standard_vms: