/s

# 1. Configuration

$rdpFile = "C:\Users\Desktop\Default.rdp"

$certSubjectName = "LocalRDPSigner"

$certSubject = "CN=$certSubjectName"

# 2. Check for existing certificate

Write-Host "Searching for existing certificate: $certSubjectName..." -ForegroundColor Cyan

$existingCert = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -eq $certSubject } | Select-Object -First 1

if ($existingCert) {

Write-Host "Found existing certificate with Thumbprint: $($existingCert.Thumbprint)" -ForegroundColor Green

$cert = $existingCert

$thumbprint = $cert.Thumbprint

} else {

Write-Host "No existing certificate found. Creating new one..." -ForegroundColor Yellow

# Create the Self-Signed Certificate

`$cert = New-SelfSignedCertificate -Subject $certSubject ``

`-CertStoreLocation "Cert:\LocalMachine\My" ``

`-Type CodeSigningCert ``

`-KeyExportPolicy None ``

-NotAfter (Get-Date).AddYears(5)

$thumbprint = $cert.Thumbprint

# Add to Trusted Root

$rootStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("Root", "LocalMachine")

$rootStore.Open("ReadWrite")

$rootStore.Add($cert)

$rootStore.Close()

# Add to Trusted Publishers

$pubStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("TrustedPublisher", "LocalMachine")

$pubStore.Open("ReadWrite")

$pubStore.Add($cert)

$pubStore.Close()

# Update GPO Registry Key

# Update GPO Registry Key (Append Logic)

$gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client"

if (!(Test-Path $gpoPath)) { New-Item -Path $gpoPath -Force | Out-Null }

$currentRegistry = Get-ItemProperty -Path $gpoPath -Name "TrustedPublisherThumbprints" -ErrorAction SilentlyContinue

$currentValues = if ($currentRegistry) { $currentRegistry.TrustedPublisherThumbprints } else { "" }

if ($currentValues -notlike "*$thumbprint*") {

Write-Host "Appending thumbprint to GPO trust list..." -ForegroundColor Cyan

$newValue = if ([string]::IsNullOrWhiteSpace($currentValues)) { $thumbprint } else { "$currentValues,$thumbprint" }

Set-ItemProperty -Path $gpoPath -Name "TrustedPublisherThumbprints" -Value $newValue

} else {

Write-Host "Thumbprint already exists in GPO trust list. Skipping registry update." -ForegroundColor Yellow

}

Write-Host "New certificate created and trusted." -ForegroundColor Green

}

# 3. Sign the RDP File

if (Test-Path $rdpFile) {

Write-Host "Signing RDP file: $rdpFile" -ForegroundColor Cyan

rdpsign.exe /sha256 $thumbprint "$rdpFile"

Write-Host "Success! RDP file is ready for use." -ForegroundColor Green

} else {

Write-Error "Target RDP file not found at $rdpFile"

}

# 1. Configuration

$rdpFile = "C:\Users\Desktop\Default.rdp"

$certSubjectName = "LocalRDPSigner"

$certSubject = "CN=$certSubjectName"

# 2. Check for existing certificate

Write-Host "Searching for existing certificate: $certSubjectName..." -ForegroundColor Cyan

$existingCert = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -eq $certSubject } | Select-Object -First 1

if ($existingCert) {

Write-Host "Found existing certificate with Thumbprint: $($existingCert.Thumbprint)" -ForegroundColor Green

$cert = $existingCert

$thumbprint = $cert.Thumbprint

} else {

Write-Host "No existing certificate found. Creating new one..." -ForegroundColor Yellow

# Create the Self-Signed Certificate

`$cert = New-SelfSignedCertificate -Subject $certSubject ``

`-CertStoreLocation "Cert:\LocalMachine\My" ``

`-Type CodeSigningCert ``

`-KeyExportPolicy None ``

-NotAfter (Get-Date).AddYears(5)

$thumbprint = $cert.Thumbprint

# Add to Trusted Root

$rootStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("Root", "LocalMachine")

$rootStore.Open("ReadWrite")

$rootStore.Add($cert)

$rootStore.Close()

# Add to Trusted Publishers

$pubStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("TrustedPublisher", "LocalMachine")

$pubStore.Open("ReadWrite")

$pubStore.Add($cert)

$pubStore.Close()

# Update GPO Registry Key

# Update GPO Registry Key (Append Logic)

$gpoPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client"

if (!(Test-Path $gpoPath)) { New-Item -Path $gpoPath -Force | Out-Null }

$currentRegistry = Get-ItemProperty -Path $gpoPath -Name "TrustedPublisherThumbprints" -ErrorAction SilentlyContinue

$currentValues = if ($currentRegistry) { $currentRegistry.TrustedPublisherThumbprints } else { "" }

if ($currentValues -notlike "*$thumbprint*") {

Write-Host "Appending thumbprint to GPO trust list..." -ForegroundColor Cyan

$newValue = if ([string]::IsNullOrWhiteSpace($currentValues)) { $thumbprint } else { "$currentValues,$thumbprint" }

Set-ItemProperty -Path $gpoPath -Name "TrustedPublisherThumbprints" -Value $newValue

} else {

Write-Host "Thumbprint already exists in GPO trust list. Skipping registry update." -ForegroundColor Yellow

}

Write-Host "New certificate created and trusted." -ForegroundColor Green

}

# 3. Sign the RDP File

if (Test-Path $rdpFile) {

Write-Host "Signing RDP file: $rdpFile" -ForegroundColor Cyan

rdpsign.exe /sha256 $thumbprint "$rdpFile"

Write-Host "Success! RDP file is ready for use." -ForegroundColor Green

} else {

Write-Error "Target RDP file not found at $rdpFile"

}

Script to sign any .rdp file and have it be trusted. Source Gemini.

Typical microsoft, not providing warnings or a simple script to easily sign existing .rdp files.

Anyways I asked Gemini to create a one-shot a powershell script that creates a self-signed cert, imports it to trusted root and trusted publishers, configures the thumbprint GPO (via registry) and then signs the .rdp file with the thumbprint. Seems to work well, just needed to nudge it a bit (haven't tested it fully yet since I'm at home), but a test .rdp file to localhost worked perfectly fine after I ran the powershell script on it. Probably useful for MSPs who might be getting a lot of calls soon because of Microsoft.