Inventory trusted RDP publishers before restricting which files can open

Source facts

RDP file policies control which configuration files the Remote Desktop Connection client can open. One configuration documented by Microsoft permits only files signed by publishers that are explicitly trusted. It also blocks valid signatures from untrusted publishers and connections started directly through the client’s interface. The settings are available under the Remote Desktop Connection Client policy branch, with configuration details in each policy’s Help text. Microsoft documentation.

Applicability

Identify the installed client updates, actual policy definitions, RDP publishers, unsigned files, and support workflows. Review which users connect through files and which use the client interface before selecting a restriction.

DSE recommendation

Build an inventory of approved signed files and their publisher identities. Ask service owners to identify legitimate unsigned or interface-launched connections that require a migration decision. Pilot the proposed policy with clear support instructions and retain the existing policy settings.

Verification

Test a trusted file, a validly signed file from an untrusted publisher, an unsigned file, and a direct client launch. Record the observed acceptance or rejection for each. Resolve any required workflow that is blocked unexpectedly before applying the setting across managed endpoints.

Official references

Microsoft Learn: RDP file security in Group Policy on Windows and Windows Server. Source reviewed September 8, 2026.