Every Remote Desktop connection to your own office PC starts with the same certificate warning, and clicking Yes every day is a bad habit to train. There is a right way to silence it - trust that one server, and only that server - and a wrong way that switches the warning off for the whole internet.
The popup is not a fault. It is Windows asking a question it cannot answer by itself: is this really the computer you meant to connect to? A normal home or office PC presents a self-signed certificate that Windows did not issue and cannot verify, so the client asks you instead. In the video, Technical Anshu removes this popup in about a minute with a single REG file import. This page explains what a safe fix like that actually changes, how to check any REG file before you trust it, and the one rule that keeps the fix safe: silence the warning only for a server you own, and only by trusting its exact certificate.
When you connect, the remote PC proves its identity with a security certificate. Big companies hand out certificates from a trusted authority, so Windows accepts them silently. A normal PC generates its own self-signed certificate instead, and Windows has no independent way to know it is genuine - that is why the dialog says the certificate is not from a trusted certifying authority.
Two honest facts matter here. First, your session is still encrypted even with a self-signed certificate; the warning is about identity, not encryption. Second, the warning is the only thing standing between you and typing your password into the wrong machine - an impostor PC on the network would look exactly the same. That is why the safe fix never removes the question. It records your answer for one server, once, after you have verified it.
The next time the popup appears for your own PC or server - one whose name or IP address you typed yourself, on your own network - do this:
Windows now stores that certificate's thumbprint - its unique fingerprint - in your user registry under HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers, in a value named CertHash inside a key named after that server. On the next connection, the client compares the certificate it receives with the fingerprint it saved. If they match, no popup. If the certificate ever changes, the warning comes back - and that is the protection working, not breaking.
The video's one-minute route does the same job before the first connection: importing a REG file writes that CertHash entry for you, so the very first sign-in is already quiet. A REG file is plain text, and this is the most important habit on this page: right-click any REG file and open it in Notepad before you ever double-click it. A safe RDP popup fix touches only your own server's entry under Terminal Server Client\Servers - one server name or IP address, one CertHash fingerprint.
Be honest with yourself about the limits of a downloaded file: a REG file somebody else prepared contains their server's fingerprint, not yours, so the correct fingerprint for your PC must come from your own server's certificate. Inside the video, the import itself takes seconds - merge the file, answer Yes to the registry editor's confirmation, and connect. If a file you are offered reaches further - changing client-wide authentication behaviour so warnings stop for every server, known or unknown - put it down. That is no longer a per-server trust entry; that is removing the lock from the door, and it is covered honestly in the last section of this page.
Pinning a fingerprint works, but it is a per-user, per-PC arrangement, and the self-signed certificate on a normal PC is renewed or regenerated over time - every change brings the popup back once. The clean solution is to fix the server side instead: install a certificate the clients already trust.
SSLCertificateSHA1Hash setting.Once the server presents a trusted certificate, every user connects with no popup and no registry tricks - and the warning is still fully armed for any machine that is not yours.
Some files and forum posts promise more: one change and Remote Desktop never shows a certificate warning again, for any computer, anywhere. Label that promise honestly - it is dangerous. It means the day a connection is quietly redirected to a wrong or hostile machine, you will hand over your password with no warning at all, and you trained yourself out of the one signal that could have saved you.
The rule that runs through this whole guide set: you may silence the popup only for servers you own or administer, only one at a time, and only by trusting their exact certificate. An unexpected popup for a server you connect to every day is not an annoyance - it is information. A separate page in this set covers exactly that moment, and why the answer there is always No until you have checked.
Terminal Server Client\Servers. Anything wider deserves your suspicion, not your double-click.The full one minute fix, shown live on a real Windows 11 PC, step by step.
Watch Full VideoNo. Even a self-signed certificate encrypts the session. The popup is about identity - Windows cannot confirm the PC is really yours - not about encryption. That is exactly why the correct fix is to verify and trust that one certificate, not to strip the check away.
It can, and when it does it usually means the server's certificate changed - a rebuild, a migration or the self-signed certificate being renewed. Treat the returning popup as the system working. Verify the server is still yours, then trust the new certificate the same way.
Because the import itself really is a one-minute job - the care belongs before and after it. Reading the REG file takes twenty seconds, and trusting the right fingerprint keeps the warning alive for every other server. Fast and safe are not opposites here.