When the Management server is configured in Windows Essential Business Server 2008, 2 group policies are configured as part of the System Center Essentials (SCE) deployment. These policies allow the Management server to deploy the SCE agent and access SCE Managed Computers in your domain.

One of these policies is the "SCE Managed Computers Group Policy (MGMT_MG)" (Note that the name in the parenthesis will vary depending on the server name you have used for your management server, on this case, the management server is called MGMT), this policy defines firewall exceptions that apply to members of the "SCE Managed Computers" group among other things. We will discuss the impact of this policy on another post, but keep in mind that this policy will define which machines can access remote desktop on the machines where the policy is applied to, and by default that is the Management server IP only.

Full Article