Specify SHA1 thumbprints of certificates representing trusted .rdp publishers

ComputerNative Intune settingTS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_1

Supported on At least Windows Vista with Service Pack 1

23H2 · 1.0

What it does

This policy setting allows you to specify a list of Secure Hash Algorithm 1 (SHA1) certificate thumbprints that represent trusted Remote Desktop Protocol (.rdp) file publishers. If you enable this policy setting, any certificate with an SHA1 thumbprint that matches a thumbprint on the list is trusted. If a user tries to start an .rdp file that is signed by a trusted certificate, the user does not receive any warning messages when they start the file. To obtain the thumbprint, view the certificate details, and then click the Thumbprint field. If you disable or do not configure this policy setting, no publisher is treated as a trusted .rdp publisher. Notes: You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, the list of certificate thumbprints trusted for a user is a combination of the list defined for the computer and the list defined for the user. This policy setting overrides the behavior of the "Allow .rdp files from valid publishers and user's default .rdp settings" policy setting. If the list contains a string that is not a certificate thumbprint, it is ignored.

What it writes

Hive: HKEY_LOCAL_MACHINE
Registry key: SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services

In Intune

Native Intune setting: Yes — Policy CSP

./Device/Vendor/MSFT/Policy/Config/ADMX_TerminalServer/TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_1ADMX_TerminalServer on Microsoft LearnADMX-backed: Windows ships this template, so it is set with the template's own values, without an import.Windows builds listed: 10.0.22000, 10.0.19043.1202, 10.0.19042.1202, 10.0.19041.1202.

From Microsoft's Policy CSP DDF files (DDF v2 Files, February 2026), read 18 Oct 2026.

Options

Option	Type	Registry value	Allowed values
Comma-separated list of SHA1 trusted certificate thumbprintsRequired	Text	`TrustedCertThumbprints`	Up to 255 characters

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

Fix the highlighted options to generate output.

History 3 retained releases

22H2 · 1.015 Jul 2024
- Already present in the first release ChangeIntel keeps.

2 later releases left it unchanged.

Template

Internal name: TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_1
Namespace: Microsoft.Policies.TerminalServer
Template file: TerminalServer.admx
Release: Windows 11 23H2 · 1.0 · file set d784d0ea5f14a680…

Definition, editor controls and support

Definition

<policy class="Machine" displayName="$(string.TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS)" explainText="$(string.TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_MACHINE_EXPLAIN)" key="SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" name="TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_1" presentation="$(presentation.TS_TRUSTED_CERTIFICATE_THUMBPRINTS_1)" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.TerminalServer:TS_CLIENT" />
      <supportedOn ref="Microsoft.Policies.TerminalServer:TS_SUPPORTED_Vista_SP1" />
      <elements>
        <text id="TRUSTED_CERTIFICATE_THUMBPRINTS" required="true" valueName="TrustedCertThumbprints" />
      </elements>
    </policy>

Editor controls

<presentation id="TS_TRUSTED_CERTIFICATE_THUMBPRINTS_1" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <textBox refId="TRUSTED_CERTIFICATE_THUMBPRINTS">
          <label>Comma-separated list of SHA1 trusted certificate thumbprints:</label>
        </textBox>
       </presentation>

Supported platforms and category

Microsoft.Policies.TerminalServer:category:TS_CLIENT
<category displayName="$(string.TS_CLIENT)" explainText="$(string.TS_CLIENT_HELP)" name="TS_CLIENT" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.TerminalServer:TS_GP_NODE" />
    </category>
Microsoft.Policies.TerminalServer:category:TS_GP_NODE
<category displayName="$(string.TS_GP_NODE)" explainText="$(string.TS_User_Help)" name="TS_GP_NODE" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:WindowsComponents" />
    </category>
Microsoft.Policies.TerminalServer:definition:TS_SUPPORTED_Vista_SP1
<definition displayName="$(string.TS_SUPPORTED_Vista_SP1)" name="TS_SUPPORTED_Vista_SP1" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
          <reference ref="Microsoft.Policies.Products:MicrosoftWindowsVista_SP1" />
        </or>
      </definition>
Microsoft.Policies.TerminalServer:unresolved:Microsoft.Policies.Products:MicrosoftWindowsVista_SP1
<unresolved reference="Microsoft.Policies.Products:MicrosoftWindowsVista_SP1" />
Microsoft.Policies.Windows:category:WindowsComponents
<category displayName="$(string.WindowsComponents)" explainText="$(string.WindowsComponents_Help)" name="WindowsComponents" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.TerminalServer:category:TS_CLIENT
<category displayName="$(string.TS_CLIENT)" explainText="$(string.TS_CLIENT_HELP)" name="TS_CLIENT" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.TerminalServer:TS_GP_NODE" />
    </category>
<strings><string id="Microsoft.Policies.TerminalServer:TS_CLIENT">Remote Desktop Connection Client</string><string id="Microsoft.Policies.TerminalServer:TS_CLIENT_HELP">Controls Remote Desktop Connection client settings</string></strings>
Microsoft.Policies.TerminalServer:category:TS_GP_NODE
<category displayName="$(string.TS_GP_NODE)" explainText="$(string.TS_User_Help)" name="TS_GP_NODE" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:WindowsComponents" />
    </category>
<strings><string id="Microsoft.Policies.TerminalServer:TS_GP_NODE">Remote Desktop Services</string><string id="Microsoft.Policies.TerminalServer:TS_User_Help">Controls configuration of Remote Desktop Services technologies that enable access to a server running Windows-based programs or the full Windows desktop</string></strings>
Microsoft.Policies.TerminalServer:definition:TS_SUPPORTED_Vista_SP1
<definition displayName="$(string.TS_SUPPORTED_Vista_SP1)" name="TS_SUPPORTED_Vista_SP1" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
          <reference ref="Microsoft.Policies.Products:MicrosoftWindowsVista_SP1" />
        </or>
      </definition>
<strings><string id="Microsoft.Policies.TerminalServer:TS_SUPPORTED_Vista_SP1">At least Windows Vista with Service Pack 1</string></strings>
Microsoft.Policies.Windows:category:WindowsComponents
<category displayName="$(string.WindowsComponents)" explainText="$(string.WindowsComponents_Help)" name="WindowsComponents" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Windows:WindowsComponents">Windows Components</string><string id="Microsoft.Policies.Windows:WindowsComponents_Help">Contains settings for operating system components.</string></strings>