Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

So the release of Windows Server 2012 has removed a lot of the old Remote Desktop related configuration utilities. In particular, there is no more Remote Desktop Session Host Configuration utility that gave you access to the RDP-Tcp properties dialog that let you configure a custom certificate for the RDSH to use. In its place is a nice new consolidated GUI that is part of the overall "edit deployment properties" workflow in the new Server Manager. The catch is that you only get access to that workflow if you have the Remote Desktop Services role installed (as far as I can tell).

This seems like a bit of an oversight on Microsoft's part. How can we configure a custom SSL certificate for RDP on Windows Server 2012 when it's running in the default Remote Administration mode without needlessly installing the Remote Desktop Services role?

share|improve this question

1 Answer 1

up vote 38 down vote accepted

It turns out that much of the configuration data for RDSH is stored in the Win32_TSGeneralSetting class in WMI in the root\cimv2\TerminalServices namespace. The configured certificate for a given connection is referenced by the Thumbprint value of that certificate on a property called SSLCertificateSHA1Hash.

In order to get the thumbprint value

  1. Open the properties dialog for your certificate and select the Details tab
  2. Scroll down to the Thumbprint field and copy the space delimited hex string into something like Notepad
  3. Remove all the spaces from the string. You'll also want to watch out for and remove a non-ascii character that sometimes gets copied just before the first character in the string. It's not visible in Notepad.
  4. This is the value you need to set in WMI. It should look something like this: 1ea1fd5b25b8c327be2c4e4852263efdb4d16af4.

Now that you have the thumbprint value, here's a one-liner you can use to set the value using wmic:

wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="THUMBPRINT"

Or if PowerShell is your thing, you can use this instead:

$path = (Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices -Filter "TerminalName='RDP-tcp'").__path
Set-WmiInstance -Path $path -argument @{SSLCertificateSHA1Hash="THUMBPRINT"}

It occurs to me that this solution would probably work on Windows 8 systems as well. I haven't played with it much myself yet though.

Note: the certificate must be in the 'Personal' Certificate Store for the Computer account.

share|improve this answer
Just wanted to add that this saved me from pure meltdown. Thank you. Installing the roles and restarting servers as suggested within technet and the like is ridiculous. Even then, once you install the SSL cert in RD Gateway Manager, it doesn't carry over to the remote admin login. –  Papa Feb 12 '14 at 8:10
You're most welcome. –  Ryan Bolger Feb 12 '14 at 18:49
Thanks so much for this. I must've searched all of google before I found this. There are too many results telling me to install "Remote Desktop Services" via "Add roles and features", but doing so requires you to join a domain. –  Sethi Mar 12 '14 at 15:25
This is outstanding, so helpful, and should of course be provided by Microsoft. Thanks for taking the time to post it here. –  BrianFinkel Mar 3 at 18:38
Thanks for sharing...! –  Rui Mar 20 at 22:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.