Set up RDP access to Windows servers

Sign RDP files

Microsoft's April 2026 Windows update causes mstsc.exe to show a "Caution: Unknown remote connection" warning for unsigned .rdp files. The sft client creates an .rdp file for each RDP connection, so users see this warning every time they connect. See Understanding security warnings in the Microsoft documentation.

When you enable RDP signing, Okta Privileged Access signs the .rdp file with a certificate unique to your team, and the warning changes to a "Verify publisher" prompt. To remove the prompt, install the certificate and add its thumbprint to the allowlist on each managed machine.

If signing isn't available, sft uses an unsigned .rdp file and the connection continues.

To sign RDP files, you must complete all of the following tasks in order. If you skip a task, users still see a security prompt when they connect.

1. Update sftd
2. Enable RDP signing
3. Get the signing certificate and thumbprint
4. Install the certificate
5. Add the thumbprint to the allowlist

Update sftd

RDP signing requires the latest version of sftd on the Windows target. Earlier versions don't support it. Update sftd on every Windows server that your users connect to through RDP, using your normal sftd upgrade process.

Enable RDP signing

RDP signing is off by default. To opt in, run the following command on each client machine:

sft config beta.rdp_signing true

After you enable RDP signing, sft rdp requests a signed .rdp file automatically.

Get the signing certificate and thumbprint

Run the following command:

sft rdp --certificate

The command prints your team's signing certificate thumbprint and the PEM-encoded certificate. It doesn't install or change anything on the machine. For example:

RDP signing certificate thumbprint:
sha256:<sha256_thumbprint>,<sha1_thumbprint>

RDP signing certificate (PEM):
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

To remove the prompt, install the certificate and add the thumbprint to the allowlist on each managed machine. If you complete only one of these procedures, the "Verify publisher" prompt still appears. Both procedures require administrator access.

Install the certificate

Install the certificate in the LocalMachine\Root and LocalMachine\TrustedPublisher certificate stores so that Windows trusts the publisher. Save the PEM output from sft rdp --certificate as okta-rdp-signing.cer, and then use one of the following methods.

Group Policy (recommended for managed fleets)

1. In the Group Policy Editor, go to Computer Configuration > Windows Settings > Security Settings > Public Key Policies.
2. Import okta-rdp-signing.cer into both Trusted Root Certification Authorities and Trusted Publishers.
3. Run gpupdate /force on the target machines, or wait for the next policy refresh.

Certificate Manager (single machine)

1. Press Win + R, and then run certlm.msc.
2. Right-click Trusted Root Certification Authorities > Certificates, and then select All Tasks > Import.
3. Import okta-rdp-signing.cer.
4. Repeat the import for Trusted Publishers > Certificates.

PowerShell (single machine)

Run the following commands as an administrator:

Import-Certificate -FilePath .\okta-rdp-signing.cer -CertStoreLocation Cert:\LocalMachine\Root
Import-Certificate -FilePath .\okta-rdp-signing.cer -CertStoreLocation Cert:\LocalMachine\TrustedPublisher

Add the thumbprint to the allowlist

Add the thumbprint to the TrustedCertThumbprints policy so that mstsc skips the publisher verification prompt for this certificate.

The thumbprint string from sft rdp --certificate contains the SHA-256 thumbprint (prefixed with sha256:) and the SHA-1 thumbprint, separated by a comma. Copy the whole string and keep both hashes. Windows matches on the hash that it supports. Machines with the KB5101650 update (july 2026) or later recognize either hash. Earlier machines recognize only the SHA-1 thumbprint.

Group Policy (recommended for managed fleets)

1. In the Group Policy Editor, go to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Connection Client.
2. Enable Specify SHA1 thumbprints of certificates representing trusted .rdp publishers.
3. Paste the full thumbprint string into the list.
4. Run gpupdate /force on the target machines, or wait for the next policy refresh.

Registry Editor (single machine)

1. Press Win + R, and then run regedit.
2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services. If the Terminal Services key doesn't exist, create it.
3. Add a string value named TrustedCertThumbprints.
4. Set the value to the full thumbprint string. To trust more than one certificate, separate each thumbprint string with a comma in the same value.

PowerShell (single machine)

Run the following commands as an administrator. Replace the value of $thumbprint with the full thumbprint string.

$thumbprint = "sha256:<sha256_thumbprint>,<sha1_thumbprint>"

New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Force | Out-Null
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" `
  -Name "TrustedCertThumbprints" -Value $thumbprint

Troubleshoot the "Verify publisher" prompt

If the "Verify publisher" prompt still appears, check the following items:

• Confirm that you enabled beta.rdp_signing. Run sft config beta.rdp_signing to check the value.
• Confirm that you installed the certificate in both certificate stores.
• Confirm that the thumbprint policy applied. Run gpresult /r if you use group policies, or check the registry key.
• Confirm that you copied the entire thumbprint string, not just one of the two hashes.