You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Minor fixes to "Remote Desktop listener certificate"
- pivot titles are too big. Reduce their size
- the "MMC" tab was displayed badly
- thumbprint has a different format, and doesn't require the extra
notepad step on 2025+
- mention "powershell" instead of wmic commands for Win2025
Copy file name to clipboardExpand all lines: support/windows-server/remote/remote-desktop-listener-certificate-configurations.md
+52-22Lines changed: 52 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -23,28 +23,39 @@ The listener component runs on the Remote Desktop server and is responsible for
23
23
24
24
## Configure Remote Desktop server listener certificate
25
25
26
-
The MMC method is not available starting from Windows Server 2012 or Windows Server 2012 R2. However, you can always configure the RDP listener by using WMI or the registry.
26
+
### [MMC](#tab/mmc)
27
27
28
28
::: zone pivot="windows-server-pre-2012"
29
29
30
-
### [MMC](#tab/mmc)
31
-
32
30
The Remote Desktop Configuration Manager MMC snap-in enables you direct access to the RDP listener. In the snap-in, you can bind a certificate to the listener and in turn, enforce SSL security for the RDP sessions.
33
31
32
+
::: zone-end
33
+
::: zone pivot="windows-server-2012"
34
+
35
+
The MMC method is not available starting from Windows Server 2012 or Windows Server 2012 R2. However, you can always configure the RDP listener by using WMI or the registry.
36
+
37
+
::: zone-end
38
+
::: zone pivot="windows-11-or-server-2025"
39
+
40
+
The MMC method is not available starting from Windows Server 2012 or Windows Server 2012 R2. However, you can always configure the RDP listener by using WMI or the registry.
The configuration data for the RDS listener is stored in the `Win32_TSGeneralSetting` class in WMI under the `Root\CimV2\TerminalServices` namespace.
39
47
40
48
The certificate for the RDS listener is referenced through the **Thumbprint** value of that certificate on a **SSLCertificateSHA1Hash** property. The thumbprint value is unique to each certificate.
41
49
42
50
> [!NOTE]
43
-
> Before you run the wmic commands, the certificate that you want to use must be imported to the Personal certificate store for the computer account. If you do not import the certificate, you will receive an **Invalid Parameter** error.
51
+
> Before you run the commands, the certificate that you want to use must be imported to the **Personal** certificate store for the computer account (via `certlm.msc`). If you do not import the certificate, you will receive an **Invalid Parameter** error.
44
52
45
53
To configure a certificate by using WMI, follow these steps:
46
54
47
55
1. Open the properties dialog for your certificate and select the **Details** tab.
56
+
57
+
::: zone pivot="windows-server-pre-2012"
58
+
48
59
2. Scroll down to the **Thumbprint** field and copy the space delimited hexadecimal string into something like Notepad.
49
60
50
61
The following screenshot is an example of the certificate thumbprint in the **Certificate** properties:
@@ -65,43 +76,62 @@ To configure a certificate by using WMI, follow these steps:
65
76
66
77
4. At command prompt, run the following wmic command together with the thumbprint value that you obtain in step 3:
67
78
68
-
::: zone pivot="windows-server-pre-2012"
69
-
70
79
```console
71
80
wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="THUMBPRINT"
72
81
```
73
82
83
+
The following screenshot is a successful example:
84
+
85
+
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/successful-example-to-run-wmic-commands.png" alt-text="A successful example of running the wmic command together with the thumbprint value that you obtain in step 3." border="false":::
86
+
74
87
::: zone-end
75
88
::: zone pivot="windows-server-2012"
76
89
77
-
```console
78
-
wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="THUMBPRINT"
79
-
```
90
+
2. Scroll down to the **Thumbprint** field and copy the space delimited hexadecimal string into something like Notepad.
80
91
81
-
::: zone-end
82
-
::: zone pivot="windows-11-or-server-2025"
92
+
The following screenshot is an example of the certificate thumbprint in the **Certificate** properties:
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/thumbprint-property.png" alt-text="An example of the certificate thumbprint in the Certificate properties.":::
87
95
88
-
::: zone-end
96
+
If you copy the string into Notepad, it should resemble the following screenshot:
89
97
90
-
The following screenshot is a successful example:
98
+
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/thumbprint-string-in-notepad.png" alt-text="Copy and paste the thumbprint string into Notepad.":::
91
99
92
-
::: zone pivot="windows-server-pre-2012"
100
+
After you remove the spaces in the string, it still contains the invisible ASCII character that is only visible at the command prompt. The following screenshot is an example:
93
101
94
-
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/successful-example-to-run-wmic-commands.png" alt-text="A successful example of running the wmic command together with the thumbprint value that you obtain in step 3." border="false":::
102
+
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/ascii-character-in-command-prompt.png" alt-text="The invisible ASCII character that is only shown at the command prompt." border="false":::
95
103
96
-
::: zone-end
97
-
::: zone pivot="windows-server-2012"
104
+
Make sure that this ASCII character is removed before you run the command to import the certificate.
105
+
106
+
3. Remove all spaces from the string. There may be an invisible ACSII character that is also copied. This is not visible in Notepad. The only way to validate is to copy directly into the Command Prompt window.
107
+
108
+
4. At command prompt, run the following wmic command together with the thumbprint value that you obtain in step 3:
109
+
110
+
```console
111
+
wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="THUMBPRINT"
112
+
```
113
+
114
+
The following screenshot is a successful example:
98
115
99
116
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/successful-example-to-run-wmic-commands.png" alt-text="A successful example of running the wmic command together with the thumbprint value that you obtain in step 3." border="false":::
100
117
101
118
::: zone-end
102
119
::: zone pivot="windows-11-or-server-2025"
103
120
104
-
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/successful-example-to-run-powershell-commands.png" alt-text="A successful example of running the powershell command together with the thumbprint value that you obtain in step 3." border="false":::
121
+
2. Scroll down to the **Thumbprint** field and copy it.
122
+
The following screenshot is an example of the certificate thumbprint in the **Certificate** properties:
123
+
124
+
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/thumbprint-property-w11.png" alt-text="An example of the certificate thumbprint in the Certificate properties.":::
125
+
126
+
3. At command prompt, run the following powershell command together with the thumbprint value that you obtain in step 2:
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/successful-example-to-run-powershell-commands.png" alt-text="A successful example of running the powershell command together with the thumbprint value that you obtain in step 2." border="false":::
0 commit comments