Skip to content

Commit d4b0d27

Browse files
author
Simonx Xu
authored
Merge pull request #9211 from MicrosoftDocs/repo_sync_working_branch
Confirm merge from repo_sync_working_branch to main to sync with https://github.com/MicrosoftDocs/SupportArticles-docs (branch main)
2 parents d6632f9 + ccb3360 commit d4b0d27

File tree

2 files changed

+72
-45
lines changed

2 files changed

+72
-45
lines changed

‎support/windows-server/remote/media/remote-desktop-listener-certificate-configurations/thumbprint-property-w11.png‎

15.1 KB
Loading

‎support/windows-server/remote/remote-desktop-listener-certificate-configurations.md‎

Lines changed: 72 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: Remote Desktop listener certificate configurations
33
description: Describes the methods to configure RDP listener certificates in Windows Server 2012 R2 and Windows Server 2012.
4-
ms.date: 06/17/2025
4+
ms.date: 06/27/2025
55
manager: dcscontentpm
66
audience: itpro
77
ms.topic: troubleshooting
@@ -13,41 +13,34 @@ zone_pivot_groups: rdp-windows-server-versions
1313
---
1414
# Remote Desktop listener certificate configurations
1515

16-
This article describes the methods to configure listener certificates on a Windows Server that is not part of a Remote Desktop Services (RDS) deployment.
16+
This article describes the methods to configure listener certificates on a Windows Server that isn't part of a Remote Desktop Services (RDS) deployment.
1717

1818
_Original KB number:_   3042780
1919

2020
## About Remote Desktop server listener availability
2121

22-
The listener component runs on the Remote Desktop server and is responsible for listening to and accepting new Remote Desktop Protocol (RDP) client connections. This lets users establish new remote sessions on the Remote Desktop server. There is a listener for each Remote Desktop Services connection that exists on the Remote Desktop server. Connections can be created and configured by using the Remote Desktop Services Configuration tool.
22+
The listener component runs on the Remote Desktop server and is responsible for listening to and accepting new Remote Desktop Protocol (RDP) client connections. This lets users establish new remote sessions on the Remote Desktop server. There's a listener for each Remote Desktop Services connection that exists on the Remote Desktop server. Connections can be created and configured by using the Remote Desktop Services Configuration tool.
2323

2424
## Configure Remote Desktop server listener certificate
2525

26-
The MMC method is not available starting from Windows Server 2012 or Windows Server 2012 R2. However, you can always configure the RDP listener by using WMI or the registry.
26+
### [WMI](#tab/wmi)
2727

28-
::: zone pivot="windows-server-pre-2012"
29-
30-
### [MMC](#tab/mmc)
31-
32-
The Remote Desktop Configuration Manager MMC snap-in enables you direct access to the RDP listener. In the snap-in, you can bind a certificate to the listener and in turn, enforce SSL security for the RDP sessions.
33-
34-
::: zone-end
35-
36-
### [Windows Management Instrumentation (WMI)](#tab/wmi)
37-
38-
The configuration data for the RDS listener is stored in the `Win32_TSGeneralSetting` class in WMI under the `Root\CimV2\TerminalServices` namespace.
28+
The configuration data for the RDS listener is stored in the `Win32_TSGeneralSetting` class in Windows Management Instrumentation (WMI) under the `Root\CimV2\TerminalServices` namespace.
3929

4030
The certificate for the RDS listener is referenced through the **Thumbprint** value of that certificate on a **SSLCertificateSHA1Hash** property. The thumbprint value is unique to each certificate.
4131

4232
> [!NOTE]
43-
> Before you run the wmic commands, the certificate that you want to use must be imported to the Personal certificate store for the computer account. If you do not import the certificate, you will receive an **Invalid Parameter** error.
33+
> Before you run the commands, the certificate that you want to use must be imported to the **Personal** certificate store for the computer account (via `certlm.msc`). If you don't import the certificate, you'll receive an **Invalid Parameter** error.
4434
4535
To configure a certificate by using WMI, follow these steps:
4636

4737
1. Open the properties dialog for your certificate and select the **Details** tab.
48-
2. Scroll down to the **Thumbprint** field and copy the space delimited hexadecimal string into something like Notepad.
4938

50-
The following screenshot is an example of the certificate thumbprint in the **Certificate** properties:
39+
::: zone pivot="windows-server-pre-2012"
40+
41+
2. Scroll down to the **Thumbprint** field and copy the space-delimited hexadecimal string into something like Notepad.
42+
43+
The following screenshot shows an example of the certificate thumbprint in the **Certificate** properties:
5144

5245
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/thumbprint-property.png" alt-text="An example of the certificate thumbprint in the Certificate properties.":::
5346

@@ -61,47 +54,65 @@ To configure a certificate by using WMI, follow these steps:
6154

6255
Make sure that this ASCII character is removed before you run the command to import the certificate.
6356

64-
3. Remove all spaces from the string. There may be an invisible ACSII character that is also copied. This is not visible in Notepad. The only way to validate is to copy directly into the Command Prompt window.
57+
3. Remove all spaces from the string. There may be an invisible ACSII character that is also copied. This character isn't visible in Notepad. To validate the string, copy the string directly into the Command Prompt window.
6558

66-
4. At command prompt, run the following wmic command together with the thumbprint value that you obtain in step 3:
67-
68-
::: zone pivot="windows-server-pre-2012"
59+
4. At command prompt, run the following `wmic` command together with the thumbprint value that you obtain in step 3:
6960

7061
```console
7162
wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="THUMBPRINT"
7263
```
7364

65+
The following screenshot shows a successful example:
66+
67+
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/successful-example-to-run-wmic-commands.png" alt-text="A successful example of running the `wmic` command together with the thumbprint value that you obtain in step 3." border="false":::
68+
7469
::: zone-end
7570
::: zone pivot="windows-server-2012"
7671

72+
2. Scroll down to the **Thumbprint** field and copy the space-delimited hexadecimal string into a text editor like Notepad.
73+
74+
The following screenshot shows an example of the certificate thumbprint in the **Certificate** properties:
75+
76+
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/thumbprint-property.png" alt-text="An example of the certificate thumbprint in the Certificate properties.":::
77+
78+
When you copy the string into Notepad, it should look like the following screenshot:
79+
80+
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/thumbprint-string-in-notepad.png" alt-text="Copy and paste the thumbprint string into Notepad.":::
81+
82+
After you remove the spaces in the string, it still contains an invisible ASCII character that is only visible at the command prompt. The following screenshot shows an example:
83+
84+
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/ascii-character-in-command-prompt.png" alt-text="The invisible ASCII character that is only shown at the command prompt." border="false":::
85+
86+
Ensure that this ASCII character is removed before you run the command to import the certificate.
87+
88+
3. Remove all spaces from the string. There might be an invisible ACSII character that is also copied. This character isn't visible in Notepad. To validate the string, copy the string directly into the Command Prompt window.
89+
90+
4. At command prompt, run the following `wmic` command together with the thumbprint value that you obtain in step 3:
91+
7792
```console
7893
wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="THUMBPRINT"
7994
```
8095

81-
::: zone-end
82-
::: zone pivot="windows-11-or-server-2025"
96+
The following screenshot shows a successful example:
8397

84-
```console
85-
Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices | Set-WmiInstance -Arguments @{SSLCertificateSHA1Hash="THUMBPRINT"}
86-
```
98+
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/successful-example-to-run-wmic-commands.png" alt-text="A successful example of running the `wmic` command together with the thumbprint value that you obtain in step 3." border="false":::
8799

88100
::: zone-end
101+
::: zone pivot="windows-11-or-server-2025"
89102

90-
The following screenshot is a successful example:
103+
2. Scroll down to the **Thumbprint** field and copy it. The following screenshot is an example of the certificate thumbprint in the **Certificate** properties:
91104

92-
::: zone pivot="windows-server-pre-2012"
105+
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/thumbprint-property-w11.png" alt-text="An example of the certificate thumbprint in the Certificate properties.":::
93106

94-
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/successful-example-to-run-wmic-commands.png" alt-text="A successful example of running the wmic command together with the thumbprint value that you obtain in step 3." border="false":::
107+
3. At command prompt, run the following PowerShell command together with the thumbprint value that you obtain in step 2:
95108

96-
::: zone-end
97-
::: zone pivot="windows-server-2012"
109+
```console
110+
Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices | Set-WmiInstance -Arguments @{SSLCertificateSHA1Hash="THUMBPRINT"}
111+
```
98112

99-
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/successful-example-to-run-wmic-commands.png" alt-text="A successful example of running the wmic command together with the thumbprint value that you obtain in step 3." border="false":::
113+
The following screenshot shows a successful example:
100114

101-
::: zone-end
102-
::: zone pivot="windows-11-or-server-2025"
103-
104-
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/successful-example-to-run-powershell-commands.png" alt-text="A successful example of running the powershell command together with the thumbprint value that you obtain in step 3." border="false":::
115+
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/successful-example-to-run-powershell-commands.png" alt-text="A successful example of running the PowerShell command together with the thumbprint value that you obtain in step 2." border="false":::
105116

106117
::: zone-end
107118

@@ -134,14 +145,30 @@ To configure a certificate by using registry editor, follow these steps:
134145
135146
To change the permissions, follow these steps on the Certificates snap-in for the local computer:
136147
137-
1. Click **Start**, click **Run**, type *mmc*, and then click **OK**.
138-
2. On the **File** menu, click **Add/Remove Snap-in**.
139-
3. In the **Add or Remove Snap-ins** dialog box, on the **Available snap-ins** list, click **Certificates**, and then click **Add**.
140-
4. In the **Certificates** snap-in dialog box, click **Computer account**, and then click **Next**.
141-
5. In the **Select Computer** dialog box, click **Local computer: (the computer this console is running on)**, and then click **Finish**.
142-
6. In the **Add or Remove Snap-ins** dialog box, click **OK**.
148+
1. Select **Start**, select **Run**, type *mmc*, and then select **OK**.
149+
2. On the **File** menu, select **Add/Remove Snap-in**.
150+
3. In the **Add or Remove Snap-ins** dialog box, on the **Available snap-ins** list, select **Certificates**, and then select **Add**.
151+
4. In the **Certificates** snap-in dialog box, select **Computer account**, and then select **Next**.
152+
5. In the **Select Computer** dialog box, select **Local computer: (the computer this console is running on)**, and then select **Finish**.
153+
6. In the **Add or Remove Snap-ins** dialog box, select **OK**.
143154
7. In the **Certificates** snap-in, on the console tree, expand **Certificates (Local Computer)**, expand **Personal**, and then select the SSL certificate that you want to use.
144155
8. Right-click the certificate, select **All Tasks**, and then select **Manage Private Keys**.
145-
9. In the **Permissions** dialog box, click **Add**, type *NETWORK SERVICE*, click **OK**, select **Read** under the **Allow** check box, and then click **OK**.
156+
9. In the **Permissions** dialog box, select **Add**, type *NETWORK SERVICE*, select **OK**, select **Read** under the **Allow** check box, and then select **OK**.
146157
147-
---
158+
### [MMC](#tab/mmc)
159+
160+
::: zone pivot="windows-server-pre-2012"
161+
162+
The Remote Desktop Configuration Manager Microsoft Management Console (MMC) snap-in enables you direct access to the RDP listener. In the snap-in, you can bind a certificate to the listener and in turn, enforce SSL security for the RDP sessions.
163+
164+
::: zone-end
165+
::: zone pivot="windows-server-2012"
166+
167+
The Microsoft Management Console (MMC) method isn't available starting from Windows Server 2012 or Windows Server 2012 R2. However, you can always configure the RDP listener by using WMI or the registry.
168+
169+
::: zone-end
170+
::: zone pivot="windows-11-or-server-2025"
171+
172+
The Microsoft Management Console (MMC) method isn't available starting from Windows Server 2012 or Windows Server 2012 R2. However, you can always configure the RDP listener by using WMI or the registry.
173+
174+
::: zone-end

0 commit comments

Comments
 (0)