When Microsoft redesigned the Remote Desktop services architecture in Windows Server 2012, they centralized certificate management under the RDS role. For servers running in Remote Administration mode (limited to 2 concurrent connections), the traditional certificate configuration path disappeared.

The most reliable method is modifying the registry directly. This works on all Server 2012+ versions:

# PowerShell script to configure custom certificate thumbprint
$certThumbprint = "YOUR_CERT_THUMBPRINT_HERE"

# Set RDP certificate binding
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" 
    -Name "SSLCertificateSHA1Hash" -Value $certThumbprint

# Restart Terminal Services to apply changes
Restart-Service TermService -Force

For GUI enthusiasts, you can use the Certificates MMC snap-in:

1. Open MMC → Add/Remove Snap-in → Certificates (Computer account)
2. Navigate to Personal → Certificates
3. Right-click your certificate → All Tasks → Manage Private Keys
4. Grant "NETWORK SERVICE" read permissions
5. Note the certificate thumbprint

After making changes, verify with this PowerShell command:

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" | 
    Select-Object SSLCertificateSHA1Hash

• Certificates must have the Server Authentication EKU (OID 1.3.6.1.5.5.7.3.1)
• The private key must be exportable during certificate request
• After changes, always test with Test-NetConnection -ComputerName localhost -Port 3389

If RDP fails after certificate assignment:

# Reset to self-signed certificate
Remove-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" 
    -Name "SSLCertificateSHA1Hash"

# Recreate default certificate
schtasks /Run /TN "\Microsoft\Windows\CertificateServicesClient\SystemTask" 

When Microsoft redesigned the Remote Desktop services in Windows Server 2012, they moved certificate management into the RD Deployment Properties workflow. This creates a frustrating limitation - the certificate configuration interface is only accessible when you've installed the Remote Desktop Services role, which is overkill for servers only using Remote Administration mode.

The solution lies in Windows Management Instrumentation (WMI). The Win32_TSGeneralSetting class contains the properties we need to modify. Here's how to query the current configuration:

$RDPsettings = Get-WmiObject -Namespace "Root\Cimv2\TerminalServices" 
    -Class Win32_TSGeneralSetting 
    -Filter "TerminalName='RDP-Tcp'"
$RDPsettings | Select-Object SSLCertificateSHA1Hash

First, identify your certificate's thumbprint from the certificate store:

Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { 
    $_.Subject -match "CN=YourServerName" 
} | Select-Object Thumbprint

Then apply it to the RDP listener:

$certThumbprint = "YOUR_CERT_THUMBPRINT_HERE"
$RDPsettings = Get-WmiObject -Namespace "Root\Cimv2\TerminalServices" 
    -Class Win32_TSGeneralSetting 
    -Filter "TerminalName='RDP-Tcp'"
$result = $RDPsettings.SetSSLCertificate($certThumbprint)
if ($result.ReturnValue -eq 0) {
    Write-Host "Certificate successfully applied"
} else {
    Write-Host "Failed to apply certificate. Error: $($result.ReturnValue)"
}

For environments where WMI isn't accessible, you can modify the registry directly:

$regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"
Set-ItemProperty -Path $regPath -Name "SSLCertificateSHA1Hash" -Value $certThumbprint

After making this change, restart the Remote Desktop Services:

Restart-Service -Name TermService -Force

To confirm your certificate is properly applied:

Test-NetConnection -ComputerName localhost -Port 3389 -InformationLevel Detailed
(Get-ItemProperty -Path $regPath).SSLCertificateSHA1Hash

When working with RDP certificates:

• Always use certificates with at least 2048-bit keys
• Ensure the certificate's Subject CN matches the server's hostname
• Include Server Authentication in the certificate's Enhanced Key Usage
• Consider enabling Certificate-Based Authentication for additional security

For enterprise environments, here's a script to deploy certificates across multiple servers:

$servers = @("server1","server2","server3")
$certThumbprint = "YOUR_CERT_THUMBPRINT"

foreach ($server in $servers) {
    Invoke-Command -ComputerName $server -ScriptBlock {
        param($thumbprint)
        $RDPsettings = Get-WmiObject -Namespace "Root\Cimv2\TerminalServices" 
            -Class Win32_TSGeneralSetting 
            -Filter "TerminalName='RDP-Tcp'"
        $RDPsettings.SetSSLCertificate($thumbprint) | Out-Null
        Restart-Service -Name TermService -Force
    } -ArgumentList $certThumbprint
}