Require secure RPC communication

Purpose

Show registry keys (1)

• HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\fEncryptRPCTraffic

This registry value backs the computer-scoped ADMX policy for the RPC interface of a Remote Desktop Session Host server. That interface is used to administer and configure Remote Desktop Services.

When the policy is enabled, Remote Desktop Services accepts RPC requests only from clients that support authenticated and encrypted communication. Unsecured communication with untrusted clients is rejected.

When the policy is disabled, Remote Desktop Services still requests security for all RPC traffic, but it may fall back to unsecured communication if an RPC client does not respond to that request. Unsecured RPC communication is also allowed when the policy is not configured.

Notes

Security

Enabling the policy prevents the affected administration and configuration interface from falling back to unsecured RPC communication. This protects requests sent through that interface against unauthorized observation or modification while in transit.

The setting does not replace access controls or grant clients additional administrative privileges. It determines whether authentication and encryption are mandatory for the RPC communication.

Possible side effects

RPC clients that do not support secured requests cannot communicate with the Remote Desktop Session Host through this interface when the policy is enabled. Older or incompatible management tools may consequently lose the ability to perform affected administration or configuration operations.

Notes

This setting applies to the RPC interface used to administer and configure Remote Desktop Services. It does not select the security or encryption method for the RDP session data stream itself; separate policies govern that communication.

Microsoft documentation

Microsoft Learn: RemoteDesktopServices Policy CSP – RequireSecureRPCCommunication

See also

• Entry in the reference