RDP and the April 2026 Windows update

Contents

1. Context: CVE-2026-26151 and the April 2026 Patch Tuesday
2. The two types of warning
3. Step 1 — Check the server's RDP certificate
4. Step 2 — Create a suitable new certificate
5. Step 3 — Bind the certificate to the RDP role
6. Step 4 — Export the public certificate
7. Step 5 — Prepare and sign the .rdp files
8. Step 6 — Deployment script for client computers
9. Important technical points
10. Summary of renewal dates

This change in behaviour happens on the client side (Windows 10/11 computers), not on the server side. All RDS servers are affected whatever their version (2016, 2019, 2022, 2025), as soon as the clients have installed the update.

First warning shown when a .rdp file is opened for the first time after the April 2026 update — Source: IT-Connect

New RDP connection dialog with an unsigned file — red "Unknown remote connection" banner — Source: IT-Connect

Dialog with a signed .rdp file — the publisher is verified and the "Remember my choices" option is available — Source: IT-Connect

To remove the warning for good: (1) a valid certificate on the server side, (2) digitally signed .rdp files, (3) the certificate imported into the trusted authorities of the client computers, and optionally (4) the registry key to disable the dialog.

# Show the hash of the certificate bound to the RDP role
Get-WmiObject -Class "Win32_TSGeneralSetting" `
    -Namespace root\cimv2\terminalservices | Select-Object SSLCertificateSHA1Hash

# Search for the certificate in all stores
$hash = (Get-WmiObject -Class "Win32_TSGeneralSetting" `
    -Namespace root\cimv2\terminalservices).SSLCertificateSHA1Hash

Get-ChildItem -Path Cert:\LocalMachine\* -Recurse -ErrorAction SilentlyContinue | Where-Object {
    $_.Thumbprint -eq $hash
} | Select-Object PSPath, Subject, Issuer, NotBefore, NotAfter

If the connection uses an IP address but the certificate is issued for a DNS name, the certificate will never match — the warning will be permanent. You must include the IP in the certificate's SAN or use the FQDN in the .rdp.

Create a certificate valid for 10 years to avoid repeating the operation and redeploying to every computer regularly.

full address:s:VALUE_HERE

# Adapt the DnsName values to your environment
$cert = New-SelfSignedCertificate `
    -DnsName "server.mydomain.com", "SHORT_NAME" `
    -CertStoreLocation "Cert:\LocalMachine\My" `
    -NotAfter (Get-Date).AddYears(10) `
    -KeyUsage DigitalSignature, KeyEncipherment `
    -FriendlyName "RDP-SERVER-2036"

# Check
$cert | Select-Object Subject, NotBefore, NotAfter, Thumbprint

The -IPAddress parameter is not available on Windows Server 2019. To include an IP in the SAN, pass it as a value in -DnsName — this works with the Windows RDP client.

$thumbprint = "YOUR_THUMBPRINT_HERE"

$path = (Get-WmiObject -Class "Win32_TSGeneralSetting" `
    -Namespace root\cimv2\terminalservices `
    -Filter "TerminalName='RDP-tcp'").__path

Set-WmiInstance -Path $path -Argument @{SSLCertificateSHA1Hash=$thumbprint}

# Check
Get-WmiObject -Class "Win32_TSGeneralSetting" `
    -Namespace root\cimv2\terminalservices | Select-Object SSLCertificateSHA1Hash, CertificateName

There is no need to restart the TermService service. The new certificate is used for new connections without interrupting active sessions.

# Export the public key only (without the private key)
Export-Certificate `
    -Cert "Cert:\LocalMachine\My\YOUR_THUMBPRINT_HERE" `
    -FilePath "C:\temp\rdp-cert.cer" -Force

The full address:s: line is mandatory in the file for rdpsign.exe to work. Without it, the file will be considered corrupt after signing. The alternate full address line alone is not enough.

full address:s:server.mydomain.com:3389
screen mode id:i:2
use multimon:i:0
dynamic resolution:i:1
session bpp:i:32
compression:i:1
keyboardhook:i:2
audiocapturemode:i:0
videoplaybackmode:i:1
connection type:i:7
networkautodetect:i:1
bandwidthautodetect:i:1
displayconnectionbar:i:1
autoreconnection enabled:i:1
authentication level:i:0
prompt for credentials:i:0
negotiate security layer:i:1
remoteapplicationmode:i:0
redirectprinters:i:1
redirectclipboard:i:1
redirectcomports:i:0
redirectsmartcards:i:0
redirectposdevices:i:0
audiomode:i:0
alternate shell:s:
shell working directory:s:
gatewayhostname:s:
gatewayusagemethod:i:4
gatewaycredentialssource:i:4
gatewayprofileusagemethod:i:0
promptcredentialonce:i:0
use redirection server name:i:0
rdgiskdcproxy:i:0
kdcproxyname:s:

rdpsign.exe /sha256 YOUR_THUMBPRINT_HERE "C:\temp\connection-mono.rdp"
rdpsign.exe /sha256 YOUR_THUMBPRINT_HERE "C:\temp\connection-multi.rdp"

REM Check the signatures
rdpsign.exe /verify "C:\temp\connection-mono.rdp"
rdpsign.exe /verify "C:\temp\connection-multi.rdp"

In an AD environment, distribute the certificate via GPO (Computer Configuration → Trusted Root Certification Authorities) and the registry key via GPO. Signed .rdp files can be distributed via the logon scripts folder or a SYSVOL share.

@echo off
CLS
net session >nul 2>&1
if %errorLevel% neq 0 (
    copy /Y "%~f0" "%TEMP%\deploy-rdp.bat" >nul 2>&1
    powershell -ExecutionPolicy Bypass -Command "Start-Process '%TEMP%\deploy-rdp.bat' -Verb RunAs"
    exit
)

chcp 65001 >nul
CLS
echo =====================================================================================
echo WARNING: Delete the OLD RDP files for the server before continuing!
echo          A search window will open - delete the old files
echo          then come back here and press a key to continue.
echo =====================================================================================
echo.

REM -- Search for old RDP files (replace SERVER_NAME with your term)
explorer "search-ms:query=SERVER_NAME System.FileExtension:rdp&crumb=location:c:\users"

color F4
timeout /t 1 >nul
color 07
timeout /t 1 >nul
color F4
timeout /t 1 >nul
color 07
timeout /t 1 >nul
color F4
echo Delete the old RDP files in the search window, then...
pause
color 07

REM -- Allow SMB guest access (required since Windows 10 1709)
echo Configuring network access...
reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v AllowInsecureGuestAuth /t REG_DWORD /d 1 /f

REM -- Import the certificate into the computer's trusted roots
echo Importing the certificate...
powershell.exe -ExecutionPolicy Bypass -Command "Import-Certificate -FilePath '\\SERVER\SHARE\rdp-cert.cer' -CertStoreLocation Cert:\LocalMachine\Root"
if %errorLevel% neq 0 (
    echo ERROR: Certificate import failed.
    pause
    exit /b 1
)
echo Certificate imported successfully.

REM -- Disable the CVE-2026-26151 dialog (optional)
echo Configuring RDP security...
reg add "HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\Client" /v RedirectionWarningDialogVersion /t REG_DWORD /d 1 /f
echo Registry updated.

REM -- Copy the signed RDP files to the public desktop
echo Copying RDP files...
copy /Y "\\SERVER\SHARE\*.rdp" "%PUBLIC%\Desktop\"
if %errorLevel% neq 0 (
    echo ERROR: Unable to copy the RDP files.
    pause
    exit /b 1
)
echo RDP files copied successfully.

REM -- Get the logged-on user (not the UAC admin)
for /f "tokens=2 delims=\" %%i in ('powershell -NoProfile -Command "(Get-WmiObject Win32_ComputerSystem).UserName"') do set REALUSER=%%i

REM -- Get the name of the admin who approved the UAC prompt
powershell -NoProfile -Command "$p = Get-WmiObject Win32_Process -Filter 'name=''cmd.exe'''; $p | ForEach-Object { $_.GetOwner().User } | Select-Object -First 1 | Out-File '%TEMP%\admin.txt' -Encoding ASCII"
set /p ADMIN=<"%TEMP%\admin.txt"

REM -- Get the user's full name
for /f "delims=" %%i in ('powershell -NoProfile -Command "(Get-LocalUser -Name '%REALUSER%').FullName"') do set FRIENDLY=%%i
if "%FRIENDLY%"=="" set FRIENDLY=%REALUSER%

REM -- Central logging on the share
set "LOGLINE=%date%;%time:~0,8%;%COMPUTERNAME%;%REALUSER%;%FRIENDLY%;%ADMIN%"
powershell -NoProfile -Command "Add-Content -Path '\\SERVER\SHARE\deploy-rdp-log.txt' -Value '%LOGLINE%' -Encoding UTF8"
echo Log saved.

REM -- Close SMB guest access again
reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v AllowInsecureGuestAuth /t REG_DWORD /d 0 /f
echo SMB guest access closed.

REM -- Clean up temporary files
del "%TEMP%\deploy-rdp.bat" >nul 2>&1
del "%TEMP%\admin.txt" >nul 2>&1

echo.
echo =====================================================================================
echo  Installation completed successfully - You can close this window
echo =====================================================================================
pause

HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\Client
Value: RedirectionWarningDialogVersion = 1 (DWORD)

Do not apply this key on computers exposed to .rdp files received from external sources (email, downloads). It removes the protection Microsoft put in place against CVE-2026-26151.

The procedure described in this article deals with the problem cleanly and durably, with a single deployment on client computers valid for 10 years. It applies to environments with Active Directory (via GPO) as well as without AD, simply by adapting the distribution method.

Sources

• →Microsoft Learn — Understanding security warnings when opening Remote Desktop (RDP) files
• →BleepingComputer — Microsoft adds Windows protections for malicious Remote Desktop files
• →Tenable — Microsoft's April 2026 Patch Tuesday Addresses 163 CVEs
• →Neowin — Microsoft details Windows 11 KB5083769 Remote Desktop changes
• →Help Net Security — Windows is getting stronger RDP file protections to fight phishing attacks
• →Microsoft MSRC — CVE-2026-26151