Overview

Recent Microsoft updates (notably April cumulative updates) have introduced stricter security controls around Remote Desktop Protocol (RDP) files. These changes enforce RDP file signing and trusted publishers, which can cause repeated security prompts when launching .rdp files—particularly on non-domain connected devices.  This impacts end users who rely on distributed RDP files without centralized certificate trust via Active Directory.

Symptoms

• Users receive repeated warnings when opening .rdp files

• Prompts indicate the publisher is unknown or untrusted

• Users must manually approve each connection

Option 1 – Workaround: Revert to Legacy Behaviour (Registry Change)

This option disables the new warning behaviour and restores the previous experience.

Steps

Run the following PowerShell commands as Administrator using an elevated Powershell Command Prompt:

# Create the registry path if it doesn't exist
New-Item -Path "HKLM:\Software\Policies\Microsoft\Windows NT\Terminal Services\Client" -Force

# Set the DWORD value
New-ItemProperty \
  -Path "HKLM:\Software\Policies\Microsoft\Windows NT\Terminal Services\Client" \
  -Name "RedirectionWarningDialogVersion" \
  -Value 1 \
  -PropertyType DWord \
  -Force

# Verify
Get-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\Terminal Services\Client" | Select RedirectionWarningDialogVersion

Notes

• This may only be a temporary workaround as Microsoft make future changes.

• Reduces security by suppressing new validation checks

• Recommended only where signing is not feasible

• If the Device is domain connected the GPO policy will likely overwrite this behaviour.  If domain connected, deploy the registry work around from group policy or using a script at domain sign-in.

Option 2 – Proper Fix: Create a Signing Certificate and Sign RDP Files.

This approach aligns with Microsoft’s new security model.

Summary

• Create a self-signed code signing certificate

• Add it to Trusted Root and Trusted Publishers

• Register the certificate thumbprint in policy

• Sign the .rdp file using rdpsign.exe

Step 1 – Create Script

1. Save the following script as:

   C:\Temp\fix-rdp.ps1
   

2. IMPORTANT: Edit the two lines at the top before running:

   • Path to your .rdp file

   • Certificate name (publisher name shown to users)

# IMPORTANT: Edit the two lines below before running
# - Set the full path to your .rdp file
# - Set a meaningful name for the certificate (this shows as the publisher)

$rdpFile = "C:\Temp\My Server.rdp"
$certSubjectName = "My-RDP-Signing"

$certSubject = "CN=$certSubjectName"

# 2. Check for existing certificate
Write-Host "Searching for existing certificate: $certSubjectName..." -ForegroundColor Cyan
$existingCert = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -eq $certSubject } | Select-Object -First 1

if ($existingCert) {
    Write-Host "Found existing certificate with Thumbprint: $($existingCert.Thumbprint)" -ForegroundColor Green
    $thumbprint = $existingCert.Thumbprint
} else {
    Write-Host "No existing certificate found. Creating new one..." -ForegroundColor Yellow

    # Create the Self-Signed Certificate
    $cert = New-SelfSignedCertificate \
        -Subject $certSubject \
        -CertStoreLocation "Cert:\LocalMachine\My" \
        -Type CodeSigningCert \
        -KeyExportPolicy None \
        -NotAfter (Get-Date).AddYears(5)

    $thumbprint = $cert.Thumbprint

    # Add to Trusted Root
    $rootStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("Root", "LocalMachine")
    $rootStore.Open("ReadWrite")
    $rootStore.Add($cert)
    $rootStore.Close()

    # Add to Trusted Publishers
    $pubStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("TrustedPublisher", "LocalMachine")
    $pubStore.Open("ReadWrite")
    $pubStore.Add($cert)
    $pubStore.Close()

    # --- Updated GPO Registry Key Logic ---
    $gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"
    $keyName = "TrustedCertThumbprints"

    if (!(Test-Path $gpoPath)) {
        New-Item -Path $gpoPath -Force | Out-Null
    }

    $currentRegistry = Get-ItemProperty -Path $gpoPath -Name $keyName -ErrorAction SilentlyContinue
    $currentValues = if ($currentRegistry) { $currentRegistry.$keyName } else { "" }

    if ($currentValues -notlike "*$thumbprint*") {
        Write-Host "Updating registry trust list at $gpoPath..." -ForegroundColor Cyan

        $newValue = if ([string]::IsNullOrWhiteSpace($currentValues)) {
            $thumbprint
        } else {
            "$currentValues,$thumbprint"
        }

        Set-ItemProperty -Path $gpoPath -Name $keyName -Value $newValue -Type String
    } else {
        Write-Host "Thumbprint already exists in registry. Skipping update." -ForegroundColor Yellow
    }

    Write-Host "New certificate created and trusted." -ForegroundColor Green
}

# 3. Sign the RDP File
if (Test-Path $rdpFile) {
    Write-Host "Signing RDP file: $rdpFile" -ForegroundColor Cyan

    rdpsign.exe /sha256 $thumbprint "$rdpFile"

    Write-Host "Success! RDP file is ready for use." -ForegroundColor Green
} else {
    Write-Error "Target RDP file not found at $rdpFile"
}

Step 2 – Run Script

Run the script from an elevated Command Prompt:

powershell.exe -ExecutionPolicy Bypass -File "C:\Temp\fix-rdp.ps1"