rdpsign
rdpsign is a Microsoft command-line signing tool used to digitally sign Remote Desktop Protocol (RDP) files. You can integrate rdpSign with Signing Manager Controller (SMCTL) for simplified signing workflows. Alternatively, you can sign rdp files directly using rdpSign while referencing your signing certificate and private key securely stored in DigiCert® Software Trust Manager.
rdpsign is supported on Windows systems.
What can rdpsign be used to sign?
Use rdpsign to digitally sign Remote Desktop Protocol (RDP) files
Signing RDP files helps establish trust for remote desktop connections and reduces security warnings presented to end users.
rdpsign is included with the Remote Desktop Services components available on supported versions of Windows server and Windows operating systems.
To verify that rdpsign is installed, open Command Prompt and run:
rdpsign /?
If rdpsign is installed, the command displays the available rdpsign options.
You can alos install the tool from the below path:
C:\Windows\System32\rdpsign.exe
Operating systems use the environment variable called PATH to determine where executable files are stored on your system. Use the PATH environment variable to store the file path to your signing tools to ensure that the CLI can reference these signing tools.
You can configure the signing tools using command line or environment variables.
To set the path to your signing tools via command line:
set PATH=%path%;<path to signing tool folder>
To set the path to your signing tools for your system or account:
Search for environment variables in the Windows start menu.
Select Edit environment variables for your account or Edit system environment variables.
Double click on the Path variable.
Click New.
Select Browse.
Select the path to the signing tool.
Click OK to save the path.
Click on OK to close the dialog.
In the Software Trust menu, go to Resources > Client tool repository.
Select the Client tools tab.
Select your operating system.
Click the download icon next to Signing Manager Controller (SMCTL).
After installing, setup:
smctl windows certsync --store system --keypair-alias={keyalias_name}
Sign the RDP file using Microsoft’s rdpsign.exe
注意
.rdpfiles are plain-text configuration files rather than standard PE binaries, so they must be signed usingrdpsign.exe.rdpsign.execan only access certificates from the local Windows certificate store, which is why thesmctl windows certsyncstep is required..Signing changes the warning from Caution: Unknown remote connection to Verify the publisher of this remote connection.
To remove the warning completely, the signing certificate thumbprint must also be added to the client machines’ trusted RDP publishers through Group Policy
rdpsign.exe /sha256 <thumbprint> <path-to-rdp-file>
<thumbprint> is the thumbprint of the signing certificate.
<file.rdp> is the RDP file to sign.