When connecting from Windows 7 RC1 to a Windows Server 2008 machine via Remote Desktop, many administrators encounter this annoying certificate warning that reappears despite installing the certificate. The core issue stems from Windows not properly trusting self-signed certificates in the Remote Desktop context.

Simply installing the certificate through the GUI doesn't work because:

1. The certificate needs to be placed in the Trusted Root Certification Authorities store
2. Remote Desktop has its own certificate validation routine that differs from standard HTTPS
3. The certificate's Subject Alternative Name (SAN) must match the server name you're connecting to

Here's the correct way to install the certificate using PowerShell (run as Administrator):

# Import the certificate to Trusted Root
Import-Certificate -FilePath "C:\path\to\server.cer" -CertStoreLocation Cert:\LocalMachine\Root

# Verify installation
Get-ChildItem -Path Cert:\LocalMachine\Root | Where-Object {$_.Subject -like "*your.server.name*"}

For domain-joined machines, you should also configure Group Policy:

1. Open gpedit.msc
2. Navigate to: Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Security
3. Enable "Server Authentication Certificate Template" and specify your certificate

For non-domain environments, edit your RDP connection file:

full address:s:your.server.name
server port:i:3389
prompt for credentials:i:1
authentication level:i:2  # Set to 2 for "Warn if authentication fails"
enablecredsspsupport:i:1

After implementing these changes:

• Check Event Viewer for Schannel events (ID 36880-36888)
• Run Test-NetConnection -ComputerName your.server.name -Port 3389
• Verify certificate chain with openssl s_client -connect your.server.name:3389 -showcerts

If issues persist:

1. Clear the credential manager cache
2. Delete all existing RDP connections from "Documents\Default.rdp"
3. Check for multiple certificates with the same name using certlm.msc

When connecting from Windows 7 to Windows Server 2008 via Remote Desktop Protocol (RDP), many administrators encounter this persistent certificate warning despite multiple installation attempts. The root cause lies in how Windows 7 handles self-signed certificates for RDP connections differently from later Windows versions.

The standard certificate installation process through the warning dialog doesn't properly register the certificate in the correct store for RDP validation. Even when selecting "Trusted Root Certification Authorities," Windows 7 maintains separate validation rules for RDP sessions.

To permanently resolve this, we need to:

1. Export the server's certificate
2. Import it into the correct certificate store
3. Modify the Remote Desktop client configuration

First, export the certificate from your server:

# PowerShell command to export certificate
$cert = Get-ChildItem -Path "Cert:\LocalMachine\Remote Desktop" -DnsName "your.server.name"
Export-Certificate -Cert $cert -FilePath "C:\temp\rdpcert.cer"

Then import it on the client machine using this registry tweak:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates]
"RDPCertStore"=dword:00000001

For domain environments, create a Group Policy Object (GPO) with these settings:

Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Public Key Policies
-> Trusted Root Certification Authorities -> Import your RDP certificate

After implementation, verify the certificate is properly trusted by running:

certmgr.msc

Navigate to Trusted Root Certification Authorities and confirm your RDP certificate appears there.

If warnings persist, check these common issues:

• Certificate SAN (Subject Alternative Name) mismatch
• Expired certificate
• Multiple certificates installed causing conflict