Skip to content

Commit fccaf15

Browse files
gpotter2gpotter2
committed
Update "Remote Desktop listener certificate configurations" for Windows 2025
1 parent 3230b46 commit fccaf15

File tree

2 files changed

+96
-50
lines changed

2 files changed

+96
-50
lines changed

‎support/windows-server/remote/media/remote-desktop-listener-certificate-configurations/successful-example-to-run-powershell-commands.png‎

43 KB
Loading

‎support/windows-server/remote/remote-desktop-listener-certificate-configurations.md‎

Lines changed: 96 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -9,93 +9,139 @@ ms.reviewer: kaushika
99
ms.custom:
1010
- sap:remote desktop services and terminal services\licensing for remote desktop services (terminal services)
1111
- pcy:WinComm User Experience
12+
zone_pivot_groups: rdp-windows-server-versions
1213
---
1314
# Remote Desktop listener certificate configurations
1415

15-
This article describes the methods to configure listener certificates on a Windows Server 2012-based or Windows Server 2012-based server that is not part of a Remote Desktop Services (RDS) deployment.
16+
This article describes the methods to configure listener certificates on a Windows Server that is not part of a Remote Desktop Services (RDS) deployment.
1617

1718
_Original KB number:_   3042780
1819

1920
## About Remote Desktop server listener availability
2021

2122
The listener component runs on the Remote Desktop server and is responsible for listening to and accepting new Remote Desktop Protocol (RDP) client connections. This lets users establish new remote sessions on the Remote Desktop server. There is a listener for each Remote Desktop Services connection that exists on the Remote Desktop server. Connections can be created and configured by using the Remote Desktop Services Configuration tool.
2223

23-
## Methods to configure listener certificate
24+
## Configure Remote Desktop server listener certificate
2425

25-
In Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2, the Remote Desktop Configuration Manager MMC snap-in lets you direct access to the RDP listener. In the snap-in, you can bind a certificate to the listener and in turn, enforce SSL security for the RDP sessions.
26+
The MMC method is not available starting from Windows Server 2012 or Windows Server 2012 R2. It is however always possible to configure the RDP listener using WMI or the Registry.
2627

27-
In Windows Server 2012 or Windows Server 2012 R2, this MMC snap-in does not exist. Therefore, the system provides no direct access to the RDP listener. To configure the listener certificates in Windows Server 2012 or Windows Server 2012 R2, use the following methods.
28+
::: zone pivot="windows-server-pre-2012"
2829

29-
- Method 1: Use Windows Management Instrumentation (WMI) script
30+
### [MMC](#tab/mmc)
3031

31-
The configuration data for the RDS listener is stored in the `Win32_TSGeneralSetting` class in WMI under the `Root\CimV2\TerminalServices` namespace.
32+
The Remote Desktop Configuration Manager MMC snap-in lets you direct access to the RDP listener. In the snap-in, you can bind a certificate to the listener and in turn, enforce SSL security for the RDP sessions.
3233

33-
The certificate for the RDS listener is referenced through the **Thumbprint** value of that certificate on a **SSLCertificateSHA1Hash** property. The thumbprint value is unique to each certificate.
34+
::: zone-end
3435

35-
> [!NOTE]
36-
> Before you run the wmic commands, the certificate that you want to use must be imported to the Personal certificate store for the computer account. If you do not import the certificate, you will receive an **Invalid Parameter** error.
36+
### [Windows Management Instrumentation (WMI)](#tab/wmi)
3737

38-
To configure a certificate by using WMI, follow these steps:
38+
The configuration data for the RDS listener is stored in the `Win32_TSGeneralSetting` class in WMI under the `Root\CimV2\TerminalServices` namespace.
3939

40-
1. Open the properties dialog for your certificate and select the **Details** tab.
41-
2. Scroll down to the **Thumbprint** field and copy the space delimited hexadecimal string into something like Notepad.
40+
The certificate for the RDS listener is referenced through the **Thumbprint** value of that certificate on a **SSLCertificateSHA1Hash** property. The thumbprint value is unique to each certificate.
4241

43-
The following screenshot is an example of the certificate thumbprint in the **Certificate** properties:
42+
> [!NOTE]
43+
> Before you run the wmic commands, the certificate that you want to use must be imported to the Personal certificate store for the computer account. If you do not import the certificate, you will receive an **Invalid Parameter** error.
4444
45-
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/thumbprint-property.png" alt-text="An example of the certificate thumbprint in the Certificate properties.":::
45+
To configure a certificate by using WMI, follow these steps:
4646

47-
If you copy the string into Notepad, it should resemble the following screenshot:
47+
1. Open the properties dialog for your certificate and select the **Details** tab.
48+
2. Scroll down to the **Thumbprint** field and copy the space delimited hexadecimal string into something like Notepad.
4849

49-
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/thumbprint-string-in-notepad.png" alt-text="Copy and paste the thumbprint string into Notepad.":::
50+
The following screenshot is an example of the certificate thumbprint in the **Certificate** properties:
5051

51-
After you remove the spaces in the string, it still contains the invisible ASCII character that is only visible at the command prompt. The following screenshot is an example:
52+
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/thumbprint-property.png" alt-text="An example of the certificate thumbprint in the Certificate properties.":::
5253

53-
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/ascii-character-in-command-prompt.png" alt-text="The invisible ASCII character that is only shown at the command prompt." border="false":::
54+
If you copy the string into Notepad, it should resemble the following screenshot:
5455

55-
Make sure that this ASCII character is removed before you run the command to import the certificate.
56+
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/thumbprint-string-in-notepad.png" alt-text="Copy and paste the thumbprint string into Notepad.":::
5657

57-
3. Remove all spaces from the string. There may be an invisible ACSII character that is also copied. This is not visible in Notepad. The only way to validate is to copy directly into the Command Prompt window.
58+
After you remove the spaces in the string, it still contains the invisible ASCII character that is only visible at the command prompt. The following screenshot is an example:
5859

59-
4. At command prompt, run the following wmic command together with the thumbprint value that you obtain in step 3:
60+
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/ascii-character-in-command-prompt.png" alt-text="The invisible ASCII character that is only shown at the command prompt." border="false":::
6061

61-
```console
62-
wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="THUMBPRINT"
63-
```
62+
Make sure that this ASCII character is removed before you run the command to import the certificate.
6463

65-
The following screenshot is a successful example:
64+
3. Remove all spaces from the string. There may be an invisible ACSII character that is also copied. This is not visible in Notepad. The only way to validate is to copy directly into the Command Prompt window.
6665

67-
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/successful-example-to-run-wmic-commands.png" alt-text="A successful example of running the wmic command together with the thumbprint value that you obtain in step 3." border="false":::
68-
69-
- Method 2: Use registry editor
66+
4. At command prompt, run the following wmic command together with the thumbprint value that you obtain in step 3:
7067

71-
> [!IMPORTANT]
72-
> Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, [How to back up and restore the registry in Windows](https://support.microsoft.com/help/322756) in case problems occur.
68+
::: zone pivot="windows-server-pre-2012"
7369

74-
To configure a certificate by using registry editor, follow these steps:
70+
```console
71+
wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="THUMBPRINT"
72+
```
7573

76-
1. Install a server authentication certificate to the Personal certificate store by using a computer account.
74+
::: zone-end
75+
::: zone pivot="windows-server-2012"
7776

78-
2. Create the following registry value that contains the certificate's SHA1 hash so that you can configure this custom certificate to support TLS instead of using the default self-signed certificate.
77+
```console
78+
wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="THUMBPRINT"
79+
```
7980

80-
- Registry path: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp`
81-
- Value name: **SSLCertificateSHA1Hash**
82-
- Value type: REG_BINARY
83-
- Value data: **certificate thumbprint**
81+
::: zone-end
82+
::: zone pivot="windows-11-or-server-2025"
8483

85-
The value should be the thumbprint of the certificate and be separated by comma (,) without any empty spaces. For example, if you were to export that registry key, the **SSLCertificateSHA1Hash** value would be as follows:
84+
```console
85+
Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices | Set-WmiInstance -Arguments @{SSLCertificateSHA1Hash="THUMBPRINT"}
86+
```
8687

87-
SSLCertificateSHA1Hash=hex:42,49,e1,6e,0a,f0,a0,2e,63,c4,5c,93,fd,52,ad,09,27,82,1b,01
88+
::: zone-end
8889

89-
3. The Remote Desktop Host Services runs under the NETWORK SERVICE account. Therefore, you have to set the system access control list (SACL) of the key file that is used by RDS to include NETWORK SERVICE together with the **Read** permissions.
90+
The following screenshot is a successful example:
9091

91-
To change the permissions, follow these steps on the Certificates snap-in for the local computer:
92+
::: zone pivot="windows-server-pre-2012"
9293

93-
1. Click **Start**, click **Run**, type *mmc*, and then click **OK**.
94-
2. On the **File** menu, click **Add/Remove Snap-in**.
95-
3. In the **Add or Remove Snap-ins** dialog box, on the **Available snap-ins** list, click **Certificates**, and then click **Add**.
96-
4. In the **Certificates** snap-in dialog box, click **Computer account**, and then click **Next**.
97-
5. In the **Select Computer** dialog box, click **Local computer: (the computer this console is running on)**, and then click **Finish**.
98-
6. In the **Add or Remove Snap-ins** dialog box, click **OK**.
99-
7. In the **Certificates** snap-in, on the console tree, expand **Certificates (Local Computer)**, expand **Personal**, and then select the SSL certificate that you want to use.
100-
8. Right-click the certificate, select **All Tasks**, and then select **Manage Private Keys**.
101-
9. In the **Permissions** dialog box, click **Add**, type *NETWORK SERVICE*, click **OK**, select **Read** under the **Allow** check box, and then click **OK**.
94+
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/successful-example-to-run-wmic-commands.png" alt-text="A successful example of running the wmic command together with the thumbprint value that you obtain in step 3." border="false":::
95+
96+
::: zone-end
97+
::: zone pivot="windows-server-2012"
98+
99+
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/successful-example-to-run-wmic-commands.png" alt-text="A successful example of running the wmic command together with the thumbprint value that you obtain in step 3." border="false":::
100+
101+
::: zone-end
102+
::: zone pivot="windows-11-or-server-2025"
103+
104+
:::image type="content" source="./media/remote-desktop-listener-certificate-configurations/successful-example-to-run-powershell-commands.png" alt-text="A successful example of running the powershell command together with the thumbprint value that you obtain in step 3." border="false":::
105+
106+
::: zone-end
107+
108+
### [Registry](#tab/registry)
109+
110+
> [!IMPORTANT]
111+
> Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, [How to back up and restore the registry in Windows](https://support.microsoft.com/help/322756) in case problems occur.
112+
113+
To configure a certificate by using registry editor, follow these steps:
114+
115+
1. Install a server authentication certificate to the Personal certificate store by using a computer account.
116+
117+
2. Create the following registry value that contains the certificate's SHA1 hash so that you can configure this custom certificate to support TLS instead of using the default self-signed certificate.
118+
119+
- Registry path: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp`
120+
- Value name: **SSLCertificateSHA1Hash**
121+
- Value type: REG_BINARY
122+
- Value data: **certificate thumbprint**
123+
124+
The value should be the thumbprint of the certificate and be separated by comma (,) without any empty spaces. For example, if you were to export that registry key, the **SSLCertificateSHA1Hash** value would be as follows:
125+
126+
```reg
127+
Windows Registry Editor Version 5.00
128+
129+
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp]
130+
"SSLCertificateSHA1Hash"=hex:42,49,e1,6e,0a,f0,a0,2e,63,c4,5c,93,fd,52,ad,09,27,82,1b,01
131+
```
132+
133+
3. The Remote Desktop Host Services runs under the NETWORK SERVICE account. Therefore, you have to set the system access control list (SACL) of the key file that is used by RDS to include NETWORK SERVICE together with the **Read** permissions.
134+
135+
To change the permissions, follow these steps on the Certificates snap-in for the local computer:
136+
137+
1. Click **Start**, click **Run**, type *mmc*, and then click **OK**.
138+
2. On the **File** menu, click **Add/Remove Snap-in**.
139+
3. In the **Add or Remove Snap-ins** dialog box, on the **Available snap-ins** list, click **Certificates**, and then click **Add**.
140+
4. In the **Certificates** snap-in dialog box, click **Computer account**, and then click **Next**.
141+
5. In the **Select Computer** dialog box, click **Local computer: (the computer this console is running on)**, and then click **Finish**.
142+
6. In the **Add or Remove Snap-ins** dialog box, click **OK**.
143+
7. In the **Certificates** snap-in, on the console tree, expand **Certificates (Local Computer)**, expand **Personal**, and then select the SSL certificate that you want to use.
144+
8. Right-click the certificate, select **All Tasks**, and then select **Manage Private Keys**.
145+
9. In the **Permissions** dialog box, click **Add**, type *NETWORK SERVICE*, click **OK**, select **Read** under the **Allow** check box, and then click **OK**.
146+
147+
---

0 commit comments

Comments
 (0)