Specify thumbprints of certificates representing trusted .rdp publishers

Supported OS tags: WindowsVista

This policy setting allows you to specify a list of certificate thumbprints that represent trusted Remote Desktop Protocol (.rdp) file publishers. SHA-256, SHA-384, and SHA-512 thumbprints are supported. SHA-1 thumbprints are deprecated: SHA-1 is no longer considered secure and support for SHA-1 thumbprints will be disabled by default in an upcoming security update. Users should migrate all thumbprint entries to SHA-256 or stronger as soon as possible. Thumbprints may be prefixed with the hash algorithm used to produce them. Supported prefixes are "sha256:", "sha384:", and "sha512:" (case-insensitive). For example: sha256:AB0356F2... If no prefix is specified, the entry is treated as a legacy SHA-1 thumbprint. If you enable this policy setting, any certificate with a thumbprint that matches a thumbprint on the list is trusted. If a user tries to start an .rdp file that is signed by a trusted certificate, the user does not receive any warning messages when they start the file. If you disable or do not configure this policy setting, no publisher is treated as a trusted .rdp publisher. Note: You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, the list of certificate thumbprints trusted for a user is a combination of the list defined for the computer and the list defined for the user. This policy setting overrides the behavior of the "Allow .rdp files from valid publishers and user's default .rdp settings" policy setting. If the list contains a string that is not a certificate thumbprint, it is ignored. See https://go.microsoft.com/fwlink/?LinkId=2368223 for more information.

• ComputerUser
  Allow .rdp files from unknown publishers

  At least Windows Vista with Service Pack 1
• Computer
  Allow .rdp files from valid publishers and user's default .rdp settings

  At least Windows Vista with Service Pack 1
• User
  Allow .rdp files from valid publishers and user's default .rdp settings

  At least Windows Vista with Service Pack 1
• Computer
  Configure server authentication for client

  At least Windows Vista with Service Pack 1
• Computer
  Disable Cloud Clipboard integration for server-to-client data transfer

  At least Windows 11 Version 22H2
• Computer
  Do not allow hardware accelerated decoding

  At least Windows Server 2016, Windows 10
• User
  Do not allow passwords to be saved

  At least Windows Server 2003 operating systems with SP1 or Windows XP Professional with SP2