Skip to content

Commit 46297d1

Browse files
Deland-HanDeland-Han
authored
Update remote-desktop-listener-certificate-configurations.md
1 parent e29b0a2 commit 46297d1

File tree

1 file changed

+27
-30
lines changed

1 file changed

+27
-30
lines changed

‎support/windows-server/remote/remote-desktop-listener-certificate-configurations.md‎

Lines changed: 27 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: Remote Desktop listener certificate configurations
33
description: Describes the methods to configure RDP listener certificates in Windows Server 2012 R2 and Windows Server 2012.
4-
ms.date: 06/24/2025
4+
ms.date: 06/27/2025
55
manager: dcscontentpm
66
audience: itpro
77
ms.topic: troubleshooting
@@ -23,27 +23,9 @@ The listener component runs on the Remote Desktop server and is responsible for
2323

2424
## Configure Remote Desktop server listener certificate
2525

26-
### [Microsoft Management Console (MMC)](#tab/mmc)
26+
### [WMI](#tab/wmi)
2727

28-
::: zone pivot="windows-server-pre-2012"
29-
30-
The Remote Desktop Configuration Manager MMC snap-in enables you direct access to the RDP listener. In the snap-in, you can bind a certificate to the listener and in turn, enforce SSL security for the RDP sessions.
31-
32-
::: zone-end
33-
::: zone pivot="windows-server-2012"
34-
35-
The MMC method isn't available starting from Windows Server 2012 or Windows Server 2012 R2. However, you can always configure the RDP listener by using WMI or the registry.
36-
37-
::: zone-end
38-
::: zone pivot="windows-11-or-server-2025"
39-
40-
The MMC method isn't available starting from Windows Server 2012 or Windows Server 2012 R2. However, you can always configure the RDP listener by using WMI or the registry.
41-
42-
::: zone-end
43-
44-
### [Windows Management Instrumentation (WMI)](#tab/wmi)
45-
46-
The configuration data for the RDS listener is stored in the `Win32_TSGeneralSetting` class in WMI under the `Root\CimV2\TerminalServices` namespace.
28+
The configuration data for the RDS listener is stored in the `Win32_TSGeneralSetting` class in Windows Management Instrumentation (WMI) under the `Root\CimV2\TerminalServices` namespace.
4729

4830
The certificate for the RDS listener is referenced through the **Thumbprint** value of that certificate on a **SSLCertificateSHA1Hash** property. The thumbprint value is unique to each certificate.
4931

@@ -56,9 +38,9 @@ To configure a certificate by using WMI, follow these steps:
5638

5739
::: zone pivot="windows-server-pre-2012"
5840

59-
2. Scroll down to the **Thumbprint** field and copy the space delimited hexadecimal string into something like Notepad.
41+
2. Scroll down to the **Thumbprint** field and copy the space-delimited hexadecimal string into something like Notepad.
6042

61-
The following screenshot is an example of the certificate thumbprint in the **Certificate** properties:
43+
The following screenshot shows an example of the certificate thumbprint in the **Certificate** properties:
6244

6345
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/thumbprint-property.png" alt-text="An example of the certificate thumbprint in the Certificate properties.":::
6446

@@ -72,15 +54,15 @@ To configure a certificate by using WMI, follow these steps:
7254

7355
Make sure that this ASCII character is removed before you run the command to import the certificate.
7456

75-
3. Remove all spaces from the string. There may be an invisible ACSII character that is also copied. This isn't visible in Notepad. The only way to validate is to copy directly into the Command Prompt window.
57+
3. Remove all spaces from the string. There may be an invisible ACSII character that is also copied. This character isn't visible in Notepad. To validate the string, copy the string directly into the Command Prompt window.
7658

7759
4. At command prompt, run the following `wmic` command together with the thumbprint value that you obtain in step 3:
7860

7961
```console
8062
wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="THUMBPRINT"
8163
```
8264

83-
The following screenshot is a successful example:
65+
The following screenshot shows a successful example:
8466

8567
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/successful-example-to-run-wmic-commands.png" alt-text="A successful example of running the `wmic` command together with the thumbprint value that you obtain in step 3." border="false":::
8668

@@ -103,7 +85,7 @@ To configure a certificate by using WMI, follow these steps:
10385

10486
Ensure that this ASCII character is removed before you run the command to import the certificate.
10587

106-
3. Remove all spaces from the string. There might be an invisible ACSII character that is also copied. This isn't visible in Notepad. The only way to validate is to copy directly into the Command Prompt window.
88+
3. Remove all spaces from the string. There might be an invisible ACSII character that is also copied. This character isn't visible in Notepad. To validate the string, copy the string directly into the Command Prompt window.
10789

10890
4. At command prompt, run the following `wmic` command together with the thumbprint value that you obtain in step 3:
10991

@@ -118,10 +100,9 @@ To configure a certificate by using WMI, follow these steps:
118100
::: zone-end
119101
::: zone pivot="windows-11-or-server-2025"
120102

121-
2. Scroll down to the **Thumbprint** field and copy it.
122-
The following screenshot is an example of the certificate thumbprint in the **Certificate** properties:
103+
2. Scroll down to the **Thumbprint** field and copy it. The following screenshot is an example of the certificate thumbprint in the **Certificate** properties:
123104

124-
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/thumbprint-property-w11.png" alt-text="An example of the certificate thumbprint in the Certificate properties.":::
105+
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/thumbprint-property-windows-11.png" alt-text="An example of the certificate thumbprint in the Certificate properties.":::
125106

126107
3. At command prompt, run the following PowerShell command together with the thumbprint value that you obtain in step 2:
127108

@@ -174,4 +155,20 @@ To configure a certificate by using registry editor, follow these steps:
174155
8. Right-click the certificate, select **All Tasks**, and then select **Manage Private Keys**.
175156
9. In the **Permissions** dialog box, select **Add**, type *NETWORK SERVICE*, select **OK**, select **Read** under the **Allow** check box, and then select **OK**.
176157
177-
---
158+
### [MMC](#tab/mmc)
159+
160+
::: zone pivot="windows-server-pre-2012"
161+
162+
The Remote Desktop Configuration Manager Microsoft Management Console (MMC) snap-in enables you direct access to the RDP listener. In the snap-in, you can bind a certificate to the listener and in turn, enforce SSL security for the RDP sessions.
163+
164+
::: zone-end
165+
::: zone pivot="windows-server-2012"
166+
167+
The Microsoft Management Console (MMC) method isn't available starting from Windows Server 2012 or Windows Server 2012 R2. However, you can always configure the RDP listener by using WMI or the registry.
168+
169+
::: zone-end
170+
::: zone pivot="windows-11-or-server-2025"
171+
172+
The Microsoft Management Console (MMC) method isn't available starting from Windows Server 2012 or Windows Server 2012 R2. However, you can always configure the RDP listener by using WMI or the registry.
173+
174+
::: zone-end

0 commit comments

Comments
 (0)