Remote Desktop Protocol Archives

Winsage

April 15, 2026

Microsoft releases Windows 10 KB5082200 extended security update

Microsoft has released the Windows 10 KB5082200 extended security update, addressing vulnerabilities from the April 2026 Patch Tuesday, including two critical zero-day flaws. The update enhances security with new protections against phishing attacks using Remote Desktop Protocol (.rdp) files and provides updated indicators in Windows Security for new Secure Boot certificates. Users can install the update by checking for updates in the Windows Update settings. After installation, Windows 10 will upgrade to build 19045.7184, and Windows 10 Enterprise LTSC 2021 will transition to build 19044.7184. The update resolves a total of 167 vulnerabilities, including two significant zero-day issues, and includes fixes for signing into Microsoft apps, enhanced Remote Desktop security, dynamic Secure Boot status reporting, and issues affecting Intel-based devices with Connected Standby. Microsoft is also rolling out new Secure Boot certificates to replace older ones expiring in June 2026, with no known issues reported for this update.

Winsage

April 15, 2026

Microsoft adds Windows protections for malicious Remote Desktop files

Microsoft has introduced new security measures for Windows 10 and Windows 11 to protect against phishing attacks that exploit Remote Desktop Protocol (RDP) connection files. These updates, part of the April 2026 cumulative updates (KB5082200, KB5083769, and KB5082052), include a one-time educational prompt for users upon first opening an RDP file, requiring acknowledgment of the associated risks. Subsequent attempts to open RDP files will display a security dialog with information about the file's publisher, the remote system address, and local resource redirections, with options disabled by default. If an RDP file is unsigned, a warning will indicate an "Unknown remote connection." These protections apply only to connections initiated through RDP files, not through the Windows Remote Desktop client, and can be temporarily disabled via the Windows Registry.

Winsage

February 16, 2026

Contain your Windows apps inside Linux Windows

WinApps and WinBoat are two solutions for running Windows applications on Linux. WinApps, developed since 2020 by Ben Curtis, allows users to run a genuine copy of Windows in a virtual machine (VM) and export individual applications to the Linux desktop using Microsoft's Remote Desktop Protocol (RDP). It supports various methods, including Docker, Podman, and KVM virtualization, with KVM offering extensive customization but requiring a more complex setup. WinBoat, a newer application at version 0.9.0, simplifies the user experience by automating much of the setup process and requires only Docker and FreeRDP to be installed. WinBoat is designed for ease of use, making it accessible for users less comfortable with technical configurations. Both tools allow users to run Windows software that may not work well under WINE, but running a full Windows OS in a VM involves licensing, maintenance, and resource considerations.

Winsage

January 30, 2026

Microsoft Adds Centralized RDP Shortpath Control via GPO and Intune

Microsoft has enhanced the management of Remote Desktop Protocol (RDP) Shortpath, now available through Group Policy Objects (GPO) and Microsoft Intune, allowing IT teams to implement centralized control over RDP Shortpath behavior across Azure Virtual Desktop (AVD) session hosts and Windows 365 Cloud PCs. RDP Shortpath improves performance and reliability by establishing a direct, UDP-based network connection, reducing latency and enhancing responsiveness for audio and video applications. Prior to this update, managing RDP Shortpath was fragmented, requiring manual adjustments on individual session hosts, which complicated consistent networking behavior. The new centralized configuration allows administrators to enforce Shortpath settings uniformly, reducing administrative overhead and ensuring consistent performance and security controls. Administrators can manage RDP Shortpath settings centrally, control all Shortpath modes, and ensure compatibility with AVD host pool settings. Effective operation of RDP Shortpath requires appropriate network conditions, and policy changes necessitate a restart of session hosts or Cloud PCs.

Winsage

December 12, 2025

Repurposing an ‘Obsolete’ Windows 10 Laptop into a Thin Client, Part 1 — Virtualization Review

42% of desktop systems were still operating on Windows 10 as of mid-October 2025, leaving millions of devices unsupported and vulnerable to security risks. Organizations are considering either investing in new Windows 11 devices or repurposing old PCs into thin clients. The RepurpOS thin-client operating system can revitalize aging hardware, such as the Dell E7440 laptop, which is available for around 0 on platforms like eBay. RepurpOS requires modest hardware specifications: an Intel or AMD x86 CPU, 2 GB of RAM, and 4 GB of persistent storage. It is offered through a subscription model that is more affordable than Microsoft’s Extended Security Updates for Windows 10. The installation process for RepurpOS is straightforward, and it supports various remote desktop protocols, including Citrix, Horizon, and AWS. Testing with Remote Desktop Protocol (RDP) shows that modern implementations provide fast and secure remote access with features like Adaptive Graphics and GPU-accelerated rendering.

Winsage

November 14, 2025

Be thankful: November’s Patch Tuesday has just one zero-day

The Readiness team analyzes updates monthly, providing testing guidance based on Microsoft patches. The November release includes updates for network infrastructure, remote connectivity, and wireless components, requiring careful testing despite no high-risk flags. Key areas for testing remote connections include validating packet transmission over IPv4 and IPv6, transferring large files over IPv6, testing web browsing and workflows with Microsoft Teams and Skype, and verifying Remote Desktop connections. The updates significantly impact application communication capabilities, necessitating dedicated validation for IPv6 alongside IPv4 operations.

Winsage

October 22, 2025

Microsoft Confirms Recent Updates Cause Login Issues on Windows 11 24H2, 25H2, and Windows Server 2025

Microsoft has identified an authentication issue affecting users of Windows 11 versions 24H2 and 25H2, as well as Windows Server 2025, due to updates rolled out since late August 2025. These updates have caused failures in Kerberos and NTLM protocols on devices with identical Security Identifiers (SIDs), leading to widespread login disruptions in enterprise networks. Users have reported repeated credential prompts, error messages, and compromised network access, including issues with Remote Desktop Protocol (RDP) sessions and Failover Clustering operations. Event Viewer logs indicate machine ID mismatches and potential session discrepancies. The problem is particularly severe in virtual desktop infrastructure (VDI) environments where multiple machines share SIDs. Microsoft has emphasized the importance of using the Sysprep tool to ensure unique SIDs during cloning, as the recent updates now strictly verify SIDs during authentication. IT administrators can temporarily alleviate the authentication blocks with a specialized Group Policy, but a permanent solution involves rebuilding devices using approved cloning procedures. As of October 21, 2025, no broader patch has been released.

Winsage

October 9, 2025

Tested: Why Remote Desktop Protocol (RDP) rejects Microsoft account logins

Some users are experiencing issues with Remote Desktop Protocol (RDP) rejecting Microsoft Account (MSA) credentials, displaying an error message about invalid credentials. This problem can arise from various technical factors, including: - Credential validation failures due to issues with Microsoft server interactions. - Problems with secure channel negotiation during the authentication process. - Time synchronization or DNS resolution issues affecting credential verification. - Misconfigured credential policies that block MSA logins over RDP. - Network-Level Authentication requirements that may hinder access if the MSA does not meet security standards like two-factor authentication. - Account restrictions or conditional access policies that impose specific compliance requirements. - Corruption of the user profile associated with the MSA. - Software conflicts or updates, particularly with recent Cumulative Updates or third-party security tools. To address MSA authentication failures, creating a local administrator account on the target machine can serve as a workaround for RDP access. Some users have noted that while most PCs function well with an MSA, certain systems require a local account for successful connections, particularly on Windows versions 24H2 and 25H2 within Insider Preview builds.

Winsage

September 24, 2025

Windows 11 KB5065790 23H2 released, direct download links (.msu)

Windows 11 KB5065790 is being rolled out for version 23H2, focusing on bug fixes and signaling the end of service for this version on November 11, 2025. This update does not introduce new features. Users can manually install the optional update via the settings app or use an offline installer file (.msu) if they encounter issues. The update resolves login issues for users with SIM-type authentication and disconnection problems during Remote Desktop Protocol (RDP) sessions. Additionally, an Out-of-band update for Windows 11 24H2 addresses urgent issues, excluding SMB protocol problems, and resolves issues affecting Microsoft Office applications in App-V environments, as well as bugs in Microsoft Edge and printer queue UI crashes. The SMB file sharing issue remains unresolved in the OOB update for 24H2.

Tech Optimizer

August 8, 2025

Cyberattackers Leverage Trusted Drivers to Disable Antivirus Software and Bypass Security Protocols

A cyberattack on a Brazilian enterprise involved the use of legitimate, digitally signed drivers to disable antivirus solutions and deploy MedusaLocker ransomware. The attackers executed a Bring Your Own Vulnerable Driver (BYOVD) attack by exploiting the ThrottleStop.sys driver, which has a critical vulnerability (CVE-2025-7771) allowing unauthorized memory access. They compromised an SMTP server using valid RDP credentials, extracted user credentials with Mimikatz, and moved laterally across the network. The attackers uploaded and executed an AV killer program and a renamed version of the driver, terminating antivirus processes to facilitate ransomware deployment. The malware targeted major antivirus vendors and employed kernel-level commands to eliminate security processes. Recommendations for defense include multi-factor authentication, hardening RDP access, and implementing layered security measures.