Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to secure my RDP connections to a Win2k8 server with an SSL certificate, and I am hoping to use a self-signed cert that I can generate on the server.

The last time I tried this (on a Win2k3 machine), after installing the certificate, it I could no longer access IIS sites on the server using localhost without using SSL. This was a problem because I had a lot of local processes that made locahost requests and didn't specify https as the protocol.

I would like to install a SSL cert that only secures my RDP connections and does not affect IIS at all. Does anyone have experience doing this?

share|improve this question

migrated from Aug 13 '11 at 19:06

This question came from our site for professional and enthusiast programmers.

Windows 2008 R2 already generates a self-signed certificate and uses it for RDP... if that's what you are after then all is done already... – Yahia Aug 13 '11 at 18:12
I think Yahia has it right... I haven't run the security scan yet, but I think RDS on Win2k8 has it taken care of, but I'll have to test. I'll post results in a couple weeks. – user91803 Aug 16 '11 at 23:09

For TLS level security, You should be able to go to Administrative Tools, then Remote Desktop Services, Desktop Session Host Configuration. On the General tab, choose the appropriate security layer and encryption level from the drop-down boxes.

You have the following levels for security layers:

Low – uses 56 bit encryption for data sent from client to server. Does not encrypt data sent from server to client.

Client Compatible – this is the default. It encrypts data sent both ways between client and server with the maximum key strength that the client supports.

High – this encrypts data sent both ways between client and server with 128 bit encryption.

FIPS Compliant – this encrypts data sent both ways between client and server with FIPS 140-1 validated encryption.

share|improve this answer

A default install of Windows Server 2008 R2 has more steps, because Remote Desktop tools aren't installed. Full instructions starting from a blank slate:

  1. Install Remote Desktop Session Host Tools Start > Administrative Tools > Server Manager Features > Add Features, Remote Desktop Session Host Tools

  2. Restart

  3. Start > Administrative Tools > Remote Desktop Services > Remote Desktop Session Host Configuration

  4. Right-click the RDP-Tcp connection and click Properties.

  5. Verify the cert is the one you wanted - there's a self-signed cert by default, or you can use a proper authority-signed cert on the server by clicking the Select button at the bottom of the pane, then pick your cert.

You'll need to have already installed an SSL cert for the last step to be possible with an authority-signed cert.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.