{"id":1486,"date":"2026-11-05T14:04:32","date_gmt":"2026-11-05T11:04:32","guid":{"rendered":"https:\/\/blog.officesupport.ru\/?p=1486"},"modified":"2026-11-05T14:19:05","modified_gmt":"2026-11-05T11:19:05","slug":"1486","status":"publish","type":"post","link":"https:\/\/blog.officesupport.ru\/?p=1486","title":{"rendered":"How to Sign RDP Files and Fix the Security Warning"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">The April 2026 Windows security update changed how unsigned RDP files are handled. Every time you open an unsigned <code>.rdp<\/code> file, you now get a red \u201cCaution: Unknown remote connection\u201d warning, and there\u2019s no way to tick a box and make it go away.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Local resource redirections like clipboard and drive sharing are also blocked by default until you manually re-enable them on each connection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The proper fix? Digitally sign your RDP files. A signed file shows a verified publisher name in the connection dialog, replaces the red warning with a normal prompt, and lets your redirections work as configured.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this article<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/lazyadmin.nl\/it\/how-to-sign-rdp-files\/#why-is-signing-rdp-files-needed\">Why is signing RDP files needed?<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/lazyadmin.nl\/it\/how-to-sign-rdp-files\/#requirements\">Requirements<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/lazyadmin.nl\/it\/how-to-sign-rdp-files\/#choosing-your-certificate\">Choosing Your Certificate<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/lazyadmin.nl\/it\/how-to-sign-rdp-files\/#self-signed-certificate\">Self-signed certificate<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/lazyadmin.nl\/it\/how-to-sign-rdp-files\/#enterprise-ca-certificate\">Enterprise CA certificate<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/lazyadmin.nl\/it\/how-to-sign-rdp-files\/#option-1-self-signed-certificate\">Option 1 Self-Signed Certificate<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/lazyadmin.nl\/it\/how-to-sign-rdp-files\/#step-1-%e2%80%93-create-the-certificate\">Step 1 \u2013 Create the Certificate<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/lazyadmin.nl\/it\/how-to-sign-rdp-files\/#step-2-%e2%80%93-trust-the-certificate-on-this-machine\">Step 2 \u2013 Trust the Certificate on This Machine<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/lazyadmin.nl\/it\/how-to-sign-rdp-files\/#step-3-%e2%80%93-export-the-certificate-for-other-machines\">Step 3 \u2013 Export the Certificate for Other Machines<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/lazyadmin.nl\/it\/how-to-sign-rdp-files\/#option-2-active-directory-enterprise-ca\">Option 2 Active Directory \/ Enterprise CA<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/lazyadmin.nl\/it\/how-to-sign-rdp-files\/#step-1-%e2%80%93-check-if-you-already-have-an-enterprise-ca\">Step 1 \u2013 Check If You Already Have an Enterprise CA<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/lazyadmin.nl\/it\/how-to-sign-rdp-files\/#step-2-%e2%80%93-install-active-directory-certificate-services\">Step 2 \u2013 Install Active Directory Certificate Services<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/lazyadmin.nl\/it\/how-to-sign-rdp-files\/#step-3-%e2%80%93-enable-the-code-signing-certificate-template\">Step 3 \u2013 Enable the Code Signing Certificate Template<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/lazyadmin.nl\/it\/how-to-sign-rdp-files\/#step-4-%e2%80%93-request-the-code-signing-certificate\">Step 4 \u2013 Request the Code Signing Certificate<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/lazyadmin.nl\/it\/how-to-sign-rdp-files\/#step-5-%e2%80%93-deploy-certificate-trust-and-rdp-settings-via-group-policy\">Step 5 \u2013 Deploy Certificate Trust and RDP Settings via Group Policy<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/lazyadmin.nl\/it\/how-to-sign-rdp-files\/#signing-the-rdp-file\">Signing the RDP File<\/a>\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/lazyadmin.nl\/it\/how-to-sign-rdp-files\/#signing-multiple-files-at-once\">Signing Multiple Files at Once<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><a href=\"https:\/\/lazyadmin.nl\/it\/how-to-sign-rdp-files\/#important-re-sign-after-any-changes\">Important Re-sign After Any Changes<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/lazyadmin.nl\/it\/how-to-sign-rdp-files\/#wrapping-up\">Wrapping Up<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In this article, I will show you how to sign your own RDP files, both self-signed and for corporate environments.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why is signing RDP files needed?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Signing RDP files has always been a best practice, but it\u2019s one that most people never bothered with because it was easy to ignore. The old warning had a \u201cdon\u2019t ask me again\u201d checkbox, so you clicked through it once and forgot about it.<\/p>\n\n\n\n<figure class=\"wp-block-image is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"542\" height=\"287\" src=\"https:\/\/blog.officesupport.ru\/wp-content\/uploads\/2026\/11\/image-3.png\" alt=\"Old Remote Desktop Connection Security warning\" class=\"wp-image-1489\" style=\"aspect-ratio:1.8885017421602788;width:542px;height:auto\" srcset=\"https:\/\/blog.officesupport.ru\/wp-content\/uploads\/2026\/11\/image-3.png 542w, https:\/\/blog.officesupport.ru\/wp-content\/uploads\/2026\/11\/image-3-300x159.png 300w\" sizes=\"auto, (max-width: 542px) 100vw, 542px\" \/><figcaption class=\"wp-element-caption\">Old Remote Desktop Connection Security warning<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The April 2026 security update changed that. The checkbox is gone, and the warning now appears every single time you open an unsigned RDP file. For anyone using RDP connections daily, this will become annoying fast. The solution is to sign your RDP files, which is not that difficult.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There\u2019s a good reason Microsoft made the change. RDP files are frequently misused in phishing attacks. A malicious RDP file sent via email looks identical to a legitimate one, and a user who has been trained to click through RDP warnings without reading them is an easy target.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"542\" height=\"431\" src=\"https:\/\/blog.officesupport.ru\/wp-content\/uploads\/2026\/11\/image-5.png\" alt=\"\" class=\"wp-image-1496\" style=\"aspect-ratio:1.25754060324826;width:542px;height:auto\" srcset=\"https:\/\/blog.officesupport.ru\/wp-content\/uploads\/2026\/11\/image-5.png 542w, https:\/\/blog.officesupport.ru\/wp-content\/uploads\/2026\/11\/image-5-300x239.png 300w\" sizes=\"auto, (max-width: 542px) 100vw, 542px\" \/><figcaption class=\"wp-element-caption\">New RDP Connection security warning<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">This is where signing actually matters beyond just fixing your own annoyance. When you sign your own RDP files, the warning becomes meaningful again. Your connections open cleanly with a verified publisher name. Any unsigned or tampered file still triggers the full red warning, and now that warning can\u2019t be dismissed, users are much more likely to stop and think before clicking through it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So signing your files isn\u2019t just about getting rid of the dialog. It\u2019s about making the security warning effective for the cases where it actually counts.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Requirements<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The good news is that everything you need is already on your Windows machine:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>rdpsign.exe<\/code> \u2013 built into Windows at <code>C:\\Windows\\System32\\rdpsign.exe<\/code><\/li>\n\n\n\n<li>PowerShell running as Administrator<\/li>\n\n\n\n<li>A code signing certificate (we\u2019ll create one below)<\/li>\n\n\n\n<li>Your configured <code>.rdp<\/code> file<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Choosing Your Certificate<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">There are two main options depending on your environment:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Self-signed certificate<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This is the perfect choice for home users, IT pros connecting to their own machines, and small environments without Active Directory. It\u2019s free, takes a few minutes to set up, and works perfectly as long as you trust the certificate on each machine that needs to open the signed files.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Enterprise CA certificate<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If you have an Active Directory, then we can use the Active Directory Certificate Services in your environment. All domain-joined machines automatically trust certificates from your internal CA, so you don\u2019t need to manually install anything on client machines. And it allows you to manage everything centrally via Group Policy.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Option 1: Self-Signed Certificate<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The easiest method to sign an RDP file is using the self-signed method.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1 \u2013 Create the Certificate<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Open PowerShell as Administrator and run:Copy<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n$cert = New-SelfSignedCertificate `    -Type CodeSigningCert `    -Subject &quot;CN=RDP Publisher, O=LazyAdmin&quot; `    -KeyUsage DigitalSignature `    -FriendlyName &quot;RDP Signing Certificate&quot; `    -CertStoreLocation &quot;Cert:\\LocalMachine\\My&quot; `    -NotAfter (Get-Date).AddYears(3)\n<\/pre><\/div>\n\n\n<p class=\"wp-block-paragraph\">Adjust the <code>-Subject<\/code> value to something that makes sense for you. This is the publisher name that will appear in the RDP connection dialog.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2 \u2013 Trust the Certificate on This Machine<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">For the signed file to show as trusted, the certificate needs to be in both the Trusted Root CA store and the Trusted Publishers store:Copy<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n# Trust the certificate on this machine$certPath = &quot;Cert:\\LocalMachine\\My\\$($cert.Thumbprint)&quot;Import-Certificate -FilePath (Export-Certificate -Cert $cert -FilePath &quot;$env:TEMP\\rdp-signing.cer&quot; -Force).FullName -CertStoreLocation &quot;Cert:\\LocalMachine\\Root&quot;Import-Certificate -FilePath &quot;$env:TEMP\\rdp-signing.cer&quot; -CertStoreLocation &quot;Cert:\\LocalMachine\\TrustedPublisher&quot;\n<\/pre><\/div>\n\n\n<h3 class=\"wp-block-heading\">Step 3 \u2013 Export the Certificate for Other Machines<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If you want signed files to show as trusted on other machines too (for example, a colleague connecting to the same server), export the public certificate and install it there:Copy<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nExport-Certificate -Cert $cert -FilePath &quot;C:\\Certs\\rdp-signing-public.cer&quot;\n<\/pre><\/div>\n\n\n<p class=\"wp-block-paragraph\">Then on each other machine, run as Administrator:Copy<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nImport-Certificate -FilePath &quot;C:\\Certs\\rdp-signing-public.cer&quot; -CertStoreLocation &quot;Cert:\\LocalMachine\\Root&quot;Import-Certificate -FilePath &quot;C:\\Certs\\rdp-signing-public.cer&quot; -CertStoreLocation &quot;Cert:\\LocalMachine\\TrustedPublisher&quot;\n<\/pre><\/div>\n\n\n<p class=\"wp-block-paragraph\">The next step is to sign your RDP files, which I will explain further down in the article.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Option 2: Active Directory \/ Enterprise CA<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If your domain already has Active Directory Certificate Services (AD CS) set up, this is the cleanest solution. Every domain-joined machine automatically trusts your internal CA, so signed RDP files just work on all your machines without any manual certificate distribution.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1 \u2013 Check If You Already Have an Enterprise CA<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Before setting one up, check whether your domain already has AD CS running. Open PowerShell on your domain controller and run:Copy<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nGet-WindowsFeature -Name ADCS-Cert-Authority\n<\/pre><\/div>\n\n\n<p class=\"wp-block-paragraph\">If <code>InstallState<\/code> shows <code>Installed<\/code>, you already have a CA and can skip straight to Step 3.<\/p>\n\n\n\n<figure class=\"wp-block-image is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"746\" height=\"370\" src=\"https:\/\/blog.officesupport.ru\/wp-content\/uploads\/2026\/11\/image-6.png\" alt=\"Create cert for rdp connection in Active Directory\" class=\"wp-image-1487\" style=\"aspect-ratio:2.016216216216216;width:746px;height:auto\" srcset=\"https:\/\/blog.officesupport.ru\/wp-content\/uploads\/2026\/11\/image-6.png 746w, https:\/\/blog.officesupport.ru\/wp-content\/uploads\/2026\/11\/image-6-300x149.png 300w\" sizes=\"auto, (max-width: 746px) 100vw, 746px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">You can also check via the Certification Authority console \u2013 press Win + R, type <code>certsrv.msc<\/code>. If it opens and shows your CA, you\u2019re good to go.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2 \u2013 Install Active Directory Certificate Services<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If AD CS isn\u2019t installed yet, you can set it up on your domain controller. You\u2019ll need to be a member of both the Domain Admins and Enterprise Admins groups.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">First, install the role:Copy<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nInstall-WindowsFeature -Name ADCS-Cert-Authority -IncludeManagementTools\n<\/pre><\/div>\n\n\n<p class=\"wp-block-paragraph\">Then configure it as an Enterprise Root CA:Copy<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nInstall-AdcsCertificationAuthority `    -CAType EnterpriseRootCA `    -CACommonName &quot;YourDomain-CA&quot; `    -KeyLength 2048 `    -HashAlgorithmName SHA256 `    -ValidityPeriod Years `    -ValidityPeriodUnits 10 `    -Force\n<\/pre><\/div>\n\n\n<p class=\"wp-block-paragraph\">Adjust <code>-CACommonName<\/code> to something that makes sense for your organization, like <code>LazyAdmin-CA<\/code>. The <code>-Force<\/code> flag skips the confirmation prompt.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After this completes, the CA is immediately active, and all domain-joined machines will start trusting certificates issued by it at the next Group Policy refresh.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Note<\/strong>Setting up AD CS makes permanent changes to your Active Directory. If this is a production environment and you\u2019re not sure, test it in a lab first. For most small to mid-size environments an Enterprise Root CA is the right and simplest choice.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3 \u2013 Enable the Code Signing Certificate Template<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">By default, the Code Signing template exists in AD CS but isn\u2019t published for enrollment. You need to enable it to request a certificate.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open the Certification Authority console (<code>certsrv.msc<\/code>)<\/li>\n\n\n\n<li>Expand your CA<\/li>\n\n\n\n<li>Right-click <strong>Certificate Templates<\/strong><\/li>\n\n\n\n<li>Choose <strong>New &gt; Certificate Template to Issue<\/strong>.<\/li>\n\n\n\n<li>Select <strong>Code Signing<\/strong> from the list and click <strong>OK<\/strong>.<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"746\" height=\"370\" src=\"https:\/\/blog.officesupport.ru\/wp-content\/uploads\/2026\/11\/image-7.png\" alt=\"Create new code signing template cert\" class=\"wp-image-1488\" style=\"aspect-ratio:2.016216216216216;width:746px;height:auto\" srcset=\"https:\/\/blog.officesupport.ru\/wp-content\/uploads\/2026\/11\/image-7.png 746w, https:\/\/blog.officesupport.ru\/wp-content\/uploads\/2026\/11\/image-7-300x149.png 300w\" sizes=\"auto, (max-width: 746px) 100vw, 746px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">We can, of course, also use PowerShell to add the Code Signing Template:Copy<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nAdd-CATemplate -TemplateName &quot;CodeSigning&quot;\n<\/pre><\/div>\n\n\n<h3 class=\"wp-block-heading\">Step 4 \u2013 Request the Code Signing Certificate<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Now request the certificate on the machine you\u2019ll use for signing the RPD file. Open PowerShell as Administrator:Copy<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nGet-Certificate -Template &quot;CodeSigning&quot; -CertStoreLocation &quot;Cert:\\CurrentUser\\My&quot;\n<\/pre><\/div>\n\n\n<p class=\"wp-block-paragraph\">Verify it was issued correctly:Copy<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nGet-ChildItem Cert:\\CurrentUser\\My | Where-Object { $_.EnhancedKeyUsageList -match &quot;Code Signing&quot; }\n<\/pre><\/div>\n\n\n<p class=\"wp-block-paragraph\">You should see your new certificate with your domain CA as the issuer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To deploy the certificate to other domain computers, we need to export the cert and store it somewhere where the domain controller can access it.Copy<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n# Get the certificate$cert = Get-ChildItem Cert:\\CurrentUser\\My | Where-Object { $_.EnhancedKeyUsageList -match &quot;Code Signing&quot; }# Export the cert - copy it from temp to a place where the DC can access itExport-Certificate -Cert $cert -FilePath &quot;C:\\Temp\\rdp-signing.cer\n<\/pre><\/div>\n\n\n<h3 class=\"wp-block-heading\">Step 5 \u2013 Deploy Certificate Trust and RDP Settings via Group Policy<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Even though domain machines automatically trust your CA, you\u2019ll want to push the certificate into the Trusted Publishers store via GPO so signed RDP files show as fully trusted without any additional prompts.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open <strong>Group Policy Management Console<\/strong> (<code>gpmc.msc<\/code>)<\/li>\n\n\n\n<li><strong>Create or edi<\/strong>t a GPO linked to the appropriate OU<\/li>\n\n\n\n<li>Navigate to <strong>Computer Configuration &gt; Windows Settings &gt; Security Settings &gt; Public Key Policies &gt; Trusted Publishers<\/strong><\/li>\n\n\n\n<li>Right-click <strong>Trusted Publishers<\/strong>, select Import, and import your <code>.cer<\/code> certificate file<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"535\" height=\"523\" src=\"https:\/\/blog.officesupport.ru\/wp-content\/uploads\/2026\/11\/image-9.png\" alt=\"\" class=\"wp-image-1490\" style=\"aspect-ratio:1.022944550669216;width:535px;height:auto\" srcset=\"https:\/\/blog.officesupport.ru\/wp-content\/uploads\/2026\/11\/image-9.png 535w, https:\/\/blog.officesupport.ru\/wp-content\/uploads\/2026\/11\/image-9-300x293.png 300w\" sizes=\"auto, (max-width: 535px) 100vw, 535px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">You can also configure RDP trust centrally so machines recognize your signing certificate without waiting for the Trusted Publishers policy to propagate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Navigate to: <strong>Computer Configuration<\/strong> &gt; <strong>Administrative Templates<\/strong> &gt; <strong>Windows Components<\/strong> &gt; <strong>Remote Desktop Services<\/strong> &gt; <strong>Remote Desktop Connection Client<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Add your certificate thumbprint to <strong>Specify SHA1 thumbprints of certificates representing trusted .rdp publishers<\/strong>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Signing the RDP File<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Once you have your certificate in place, signing is straightforward. First, get your certificate thumbprint:Copy<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n$thumbprint = (Get-ChildItem Cert:\\CurrentUser\\My |     Where-Object { $_.EnhancedKeyUsageList -match &quot;Code Signing&quot; } |     Select-Object -First 1).Thumbprint\n<\/pre><\/div>\n\n\n<p class=\"wp-block-paragraph\">Then sign your RDP file:Copy<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nrdpsign.exe \/sha256 $thumbprint &quot;C:\\Path\\To\\Your\\File.rdp&quot;\n<\/pre><\/div>\n\n\n<p class=\"wp-block-paragraph\">When you open the RDP connection after you have signed the RDP file, you will now only get a normal warning, which you can mark as \u201cdon\u2019t ask me again\u201d:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"663\" height=\"361\" src=\"https:\/\/blog.officesupport.ru\/wp-content\/uploads\/2026\/11\/image-11.png\" alt=\"\" class=\"wp-image-1498\" style=\"aspect-ratio:1.8365650969529086;width:663px;height:auto\" srcset=\"https:\/\/blog.officesupport.ru\/wp-content\/uploads\/2026\/11\/image-11.png 663w, https:\/\/blog.officesupport.ru\/wp-content\/uploads\/2026\/11\/image-11-300x163.png 300w\" sizes=\"auto, (max-width: 663px) 100vw, 663px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Signing Multiple Files at Once<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If you have several RDP files to sign, you can do them all in one go:Copy<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n$thumbprint = &quot;YOUR_THUMBPRINT_HERE&quot;Get-ChildItem &quot;C:\\RDP\\*.rdp&quot; | ForEach-Object {    &amp;amp; rdpsign.exe \/sha256 $thumbprint $_.FullName    Write-Host &quot;Signed: $($_.Name)&quot;}\n<\/pre><\/div>\n\n\n<h2 class=\"wp-block-heading\">Important: Re-sign After Any Changes<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">One thing to keep in mind, if you modify an RDP file after signing it, the signature is invalidated, and the warning comes back. This includes any change to the file, even a small one. Always sign your RDP files as the last step after you\u2019ve finished configuring them.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Wrapping Up<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Signing your RDP files is the right way to deal with the new security warning. It takes a few minutes to set up, and once it\u2019s done, you won\u2019t see the red warning again for those files. More importantly, it actually improves security rather than just hiding the warning, anyone who tampers with a signed file will immediately trigger the red banner again.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For home use and self-managed machines, the self-signed route works well. For corporate environments with Active Directory, the Enterprise CA option gives you central control and zero manual work on client machines.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The April 2026 Windows security update changed how unsigned RDP files are handled. Every time you open an unsigned .rdp file, you now get a red \u201cCaution: Unknown remote connection\u201d warning, and there\u2019s no way to tick a box and [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1486","post","type-post","status-publish","format-standard","hentry","category-it"],"_links":{"self":[{"href":"https:\/\/blog.officesupport.ru\/index.php?rest_route=\/wp\/v2\/posts\/1486","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.officesupport.ru\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.officesupport.ru\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.officesupport.ru\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.officesupport.ru\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1486"}],"version-history":[{"count":5,"href":"https:\/\/blog.officesupport.ru\/index.php?rest_route=\/wp\/v2\/posts\/1486\/revisions"}],"predecessor-version":[{"id":1499,"href":"https:\/\/blog.officesupport.ru\/index.php?rest_route=\/wp\/v2\/posts\/1486\/revisions\/1499"}],"wp:attachment":[{"href":"https:\/\/blog.officesupport.ru\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1486"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.officesupport.ru\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1486"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.officesupport.ru\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1486"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}