Microsoft Adds Warnings and Default Restrictions for Risky RDP Files

Summary

April 2026 Windows updates add warnings before .rdp files connect, identify the publisher and remote address, and disable local resource redirection by default to reduce phishing-related credential and data theft.

Key points

April 2026 updates for Windows 10 and Windows 11 introduce protections for RDP connection files.
The first time a user opens an RDP file, Windows displays a one-time prompt explaining its risks.
Before later connections, a security dialog shows the publisher's verification status and remote address, with local resource redirections disabled by default.
Unsigned files are labeled “Caution: Unknown remote connection”; signed files show the publisher, but Windows still advises users to verify its legitimacy.
The protections cover connections opened through RDP files, not connections made through the Windows Remote Desktop client.
Administrators can temporarily disable the protections through a registry setting; Microsoft recommends keeping them enabled.

Article Details

Event Type: Windows security protection update
Impact: April 2026 cumulative updates for Windows 10 and Windows 11 add warnings before users open Remote Desktop connection files, display publisher and remote-address information, and disable local resource redirections by default. The protections are intended to reduce phishing-enabled theft of files, credentials, and clipboard data. They apply to connections initiated by opening RDP files, not connections made through the Windows Remote Desktop client.

Threat Actors

ICE RELICThe article identifies Russian state-sponsored APT29 as having previously used rogue RDP files in phishing campaigns to steal victims’ data and credentials.

Vendors

MicrosoftMicrosoft has added new Windows protections that warn users and disable risky shared resources by default when opening Remote Desktop (.rdp) connection files to thwart phishing attacks.

Products

Remote DesktopMicrosoft has added new Windows protections that warn users and disable risky shared resources by default when opening Remote Desktop (.rdp) connection files to thwart phishing attacks.Windows 10As part of the April 2026 cumulative updates for Windows 10 (KB5082200) and Windows 11 (KB5083769 and KB5082052), Microsoft has now released new protections to prevent malicious RDP connection files from being used on Windows 11As part of the April 2026 cumulative updates for Windows 10 (KB5082200) and Windows 11 (KB5083769 and KB5082052), Microsoft has now released new protections to prevent malicious RDP connection files from being used on