Remote Desktop adds new safeguards for connections opened from RDP files

Starting with the April 2026 Windows security update, Remote Desktop adds new safeguards to help reduce phishing attacks that misuse Remote Desktop (.rdp) files. These attacks attempt to trick devices into connecting to attacker‑controlled systems and sharing local resources without clear visibility. To address this, a new security dialog appears before any connection is made, showing the remote computer address, publisher information (when available), and any requested access to local resources. All requested settings are disabled by default and must be explicitly enabled. A one‑time security warning also appears the first time an RDP file is opened. This change helps make potentially risky connections more visible and intentional, without affecting connections that are started manually in the Remote Desktop app.

Organizations that build or deploy custom Remote Desktop clients are encouraged to review their handling of RDP file–based connections. For more information, including detailed explanations of the new dialogs, redirection behavior, and available admin and developer options, see Understanding security warnings when opening Remote Desktop (RDP) files.