Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Set client connection encryption level

This `REG_DWORD` value belongs to the computer-scoped Group Policy setting for Remote Desktop Session Host.

since 0.9.8.11

Purpose

Show registry keys (1)
  • HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\MinEncryptionLevel

This REG_DWORD value belongs to the computer-scoped Group Policy setting for Remote Desktop Session Host. It specifies the minimum encryption level for communications between RDP clients and the session host:

  • 1 – Low: Encrypts only data sent from the client to the server, using 56-bit encryption. Data sent from the server to the client remains unencrypted.
  • 2 – Client Compatible: Encrypts traffic in both directions at the maximum key strength supported by the client.
  • 3 – High: Encrypts traffic in both directions using 128-bit encryption.

The policy applies only to native RDP encryption. It does not determine the encryption used when the connection is protected by SSL/TLS. It also does not configure the RDP security layer or Network Level Authentication.

Notes

Security

With a value of 1, data sent from the session host to the client is not protected by native RDP encryption, while traffic in the opposite direction uses only 56-bit encryption. This level therefore provides substantially less protection against interception than the higher levels.

With a value of 2, the effective encryption strength depends on the capabilities of each client. This permits older clients with weaker encryption support to connect.

A value of 3 enforces consistent 128-bit encryption when native RDP encryption is used. Microsoft nevertheless recommends SSL/TLS rather than native RDP encryption.

Possible side effects

When the value is 3, RDP clients that do not support 128-bit encryption cannot connect to the Remote Desktop Session Host.

Notes

The System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing security option takes precedence over this policy. A changed encryption level takes effect for a user session at the next sign-in.

If the associated Group Policy setting is disabled or not configured, Windows does not enforce an RDP encryption level through this policy.

Microsoft documentation

Microsoft Learn: RemoteDesktopServices Policy CSP – ClientConnectionEncryptionLevel

Microsoft Learn: Win32_TSGeneralSetting class

See also