.rdp shortcut. The remote host you're connecting to needs no changes; signature validation is entirely a client-side check.
Microsoft's April 2026 Patch Tuesday (CVE-2026-26151) added a mandatory "Caution: Unknown remote connection" prompt every time you open an unsigned .rdp file. Signing your shortcut with a self-signed certificate and adding it to your trust list quiets the warning. Here's how.
When the April 2026 update first dropped, there was widespread reporting that signed .rdp files still triggered the warning on non-domain-joined machines — a "workgroup bug" that appeared to defeat the purpose of signing entirely. That story dominated the early TechCommunity threads.
Based on real-world testing against builds current as of June 2026, that's no longer the case (and may always have been narrower than reported — some of the original complaints were conflated with a separate RemoteApp WebFeed issue). The flow in this guide works on standalone personal machines: sign the file, place the cert in Trusted Publishers and Trusted Root, add the thumbprint to TrustedCertThumbprints, and the prompt is gone entirely. No banner, no resource-redirection reset, straight to credentials.
Microsoft has not explicitly called out a workgroup-specific fix in any May 2026 cumulative update release notes — the published fixes target the multi-monitor display scaling rendering bug. Whether the broader behavior was silently improved or the original reports overstated the issue isn't fully clear from public documentation, but the practical result is the same: this flow works.
Press Win + X and pick Terminal (Admin) or PowerShell (Admin). Confirm the UAC prompt.
This generates a brand-new cert (with private key) in the local machine's Personal store. Adjust the Subject CN to whatever you want users to see in the trust banner.
PowerShellNew-SelfSignedCertificate ` -Subject "CN=My RDP Publisher" ` -Type CodeSigningCert ` -KeySpec Signature ` -KeyUsage DigitalSignature ` -HashAlgorithm SHA256 ` -CertStoreLocation "Cert:\LocalMachine\My" ` -NotAfter (Get-Date).AddYears(5)
The cert lives in Cert:\LocalMachine\My, which requires admin rights to access. If you'd rather keep it in your user store, swap LocalMachine for CurrentUser — but then signing must happen as the same user account.
You'll need the SHA1 thumbprint for both signing (Step 4) and trust (Step 6). Pull it like this:
PowerShellGet-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -eq "CN=My RDP Publisher" } | Select-Object Subject, Thumbprint, NotAfter
Copy the Thumbprint value — a 40-character hex string. Stash it in a variable so you don't have to re-copy:
PowerShell$thumb = "A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2" # your thumbprint here
If you ever paste a thumbprint copied from certmgr.msc, strip the spaces — rdpsign rejects them.
Point rdpsign.exe at your .rdp file. Replace the path with wherever yours lives. The tool overwrites the file in place with the signed version, so back it up first if you want a fallback.
CMD / PowerShellrdpsign /sha256 $thumb /v "C:\Users\<you>\Desktop\my-server.rdp"
Signing multiple files at once? Enumerate them with PowerShell:
PowerShellGet-ChildItem "C:\RDP\*.rdp" | ForEach-Object { rdpsign /sha256 $thumb /v $_.FullName }
Useful flags:
/l — dry run; tests signing without modifying the file./q — quiet mode (good for scripts)./v — verbose; tells you why it fails.Any edit to the file — changing the username, screen resolution, audio redirection, anything — breaks the signature. Always sign as your final step after you've configured the connection. If you re-open the file in mstsc and click "Save", you'll need to re-sign it.
Windows won't trust a signature unless the issuing cert is in the Trusted Publishers store. Since the cert was self-signed, we also need it in Trusted Root Certification Authorities so its own signature is considered valid.
Export the public portion (no private key) to a .cer file:
PowerShellExport-Certificate ` -Cert "Cert:\LocalMachine\My\$thumb" ` -FilePath "C:\RDP\rdp-publisher.cer"
Then import it into both stores:
PowerShellImport-Certificate -FilePath "C:\RDP\rdp-publisher.cer" ` -CertStoreLocation "Cert:\LocalMachine\TrustedPublisher" Import-Certificate -FilePath "C:\RDP\rdp-publisher.cer" ` -CertStoreLocation "Cert:\LocalMachine\Root"
Importing into Root will pop a "you are about to install a certificate from a certification authority claiming to represent…" prompt. That's expected for a self-signed cert. Click Yes.
To skip the warning entirely, add the thumbprint to the Remote Desktop Connection Client's Trusted Publisher Thumbprints list. This is the step that makes the difference between "blue verified publisher banner" and "no prompt at all."
Option A — Local Group Policy (Pro/Enterprise editions only):
gpedit.msc.gpupdate /force in an admin terminal.Option B — Registry (Home edition or scripted setups):
PowerShellNew-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Force | Out-Null Set-ItemProperty ` -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" ` -Name "TrustedCertThumbprints" ` -Value $thumb ` -Type String
Double-click your signed .rdp file. Expected outcomes:
TrustedCertThumbprints. Re-check Step 6. The connection is safe to proceed with — it's just one step short of fully silent.Still seeing "Unknown publisher" after signing. Verify the file was actually modified — open it in Notepad and look for a signature:s: line near the bottom. If it's missing, rdpsign didn't write. Re-run with /v and read the output.
Banner says "Verified Publisher" but prompt still appears every launch. The cert is trusted but Windows isn't fully bypassing the dialog. Confirm your thumbprint is actually present in HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\TrustedCertThumbprints with no spaces. If you're hitting this on a RemoteApp WebFeed connection specifically (rather than a plain .rdp file), that's a separate known issue Microsoft is still working on.
Nuclear option — disable the new dialogs entirely. Microsoft included a registry override, though they've warned it may be deprecated in a future update. Generally unnecessary now that signing works on personal machines, but here for completeness:
PowerShellSet-ItemProperty ` -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" ` -Name "DisableRDPFileSecurityDialog" ` -Value 0 ` -Type DWord
Reverts to pre-April-2026 behavior. No prompt, no signature check, no resource-default reset. Reverse it with Value 1 or by deleting the property.
Bypassing .rdp files entirely. The new prompt only fires on file-based launches. Typing the hostname directly into the Remote Desktop Connection app, or running mstsc /v:hostname from a shortcut, skips the prompt without any signing required. Useful as a quick personal workaround if you don't want to set up signing.
Research for this guide drew on Microsoft's own documentation, community bug reports filed in the weeks after KB5083769, and several third-party walkthroughs. Links open in a new tab.