The one-minute REG fix from the video is real, but a REG file is a loaded tool: it writes exactly what it says, nothing more and nothing less. Here is the whole file, line by line, so you can judge any version of it yourself.
A REG file that removes the RDP popup for your server does one precise thing: it writes the server certificate's fingerprint into your user registry, in the same place the Don't ask me again checkbox would have put it. Everything else is ceremony. This page shows the file's anatomy with an example fingerprint, explains where the one number that matters must come from, and gives you the inspection habit that separates a safe file from a dangerous one.
Windows Registry Editor Version 5.00 is simply the file's declaration of what it is. Notepad shows it as the first line of every genuine exported registry file. Its absence is not automatically sinister, but its presence plus a sensible structure is the first sign you are looking at a real registry script and not something else wearing the .reg extension.
The line in square brackets is the address the values are written to: HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers\192.168.1.50. Three details matter. It lives under HKEY_CURRENT_USER, so it affects your sign-in only - other users of the same PC keep their own warnings, which is correct behaviour. The final part is the server exactly as you type it in the Remote Desktop box: connect by a different name or address and Windows treats it as a different server with its own entry and its own warning. And it sits inside Servers, the client's per-server notebook - nowhere else in the registry is involved in this fix.
"CertHash"=hex:... is the entire payload: the SHA-1 thumbprint of the server's certificate, written as twenty bytes of hexadecimal. This is byte-for-byte what the Don't ask me again checkbox saves when you tick it yourself. From then on, the client compares the certificate it receives on each connection against these twenty bytes. Match - silence. Mismatch - the warning returns, which is precisely the protection you are keeping.
Here is the discipline the video's one-minute pace skips past: the fingerprint must be your server's. A thumbprint copied from a tutorial, a forum or somebody else's REG file pins trust in a certificate that is not your machine's - useless at best. Get it from your own server: connect once, choose View certificate in the dialog, and read the Thumbprint field on the Details tab. Copy it from the server itself or from that dialog - never from a stranger's page.
You may also see a "UsernameHint" line. That is only the remembered user name the client pre-fills for that server - cosmetic, harmless, and not part of the fix. Its presence is normal; its absence changes nothing.
Now the inspection rule in full. A safe file for this job touches one server key and one value. Close the file and walk away if it:
HKEY_LOCAL_MACHINE to change behaviour for the whole machine or all users.Servers list - that is where global behaviour lives.None of that is needed to pin one certificate, and some of it exists precisely to strip the warning for every server you will ever touch - the dangerous route this whole guide set warns against. When the video offers a file, the twenty seconds spent reading it in Notepad are the real fix; the import is just delivery.
The full one minute fix, shown live on a real Windows 11 PC, step by step.
Watch Full VideoYes, and it is the cleanest route of all. Connect to your server once, tick Don't ask me again, click Yes - then open Registry Editor, find that server's key under Terminal Server Client, Servers, right-click it and choose Export. The exported file is your pin file, with your server's real fingerprint, ready to reuse on your other PCs.
Because the entry is stored under the exact text you connect to. A fingerprint saved for 192.168.1.50 does not cover a connection typed as OFFICE-PC. Trust each form you actually use, or settle on one - the name is the more durable choice, since IP addresses can change.
No. The key lives under HKEY_CURRENT_USER, your own registry branch. Your warning is silenced for that server; anyone signing in with a different account still gets the full popup until they make their own decision. That separation is a feature, not a bug.