Unknown remote connection using PAM Gateway for RDP

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

Trying to use the PAM Gateway for RDP to connect against a Windows endpoint, on clicking on the .rdp file generated for a connection, there is a warning message, "Unknown remote connection" and all local resources appear as unselected

No modification to Windows other than the regular security patches has been done, and no modification to CA PAM either

Environment

Windows 10 and Windows 11 as Windows 2025. Other Windows versions may be affected

Cause

This is not a PAM misconfiguration. This is due to a change in mstsc behaviour implemented in Microsoft's April 2026 Tuesday Patch which has introduced a change to mstsc.exe, tracked as CVE-2026-26151

Following this code modification, opening an .rdp file now triggers a security dialog listing every requested resource redirection, each disabled by default, and files without a verifiable publisher get the "Caution: Unknown remote connection" banner.

It affects Windows 10 and Windows 11 23H2 and later.

For an explanation of what has been changed please see for instance the following article

https://blog.sonnes.cloud/your-rdp-remote-desktop-files-are-now-untrusted-after-the-april-2026-windows-patch-sign-them-with-powershell/

This is affecting at least Windows 11, Windows 10 and Windows 2025, and any other Windows version having deployed a likely patch

This change was implemented by Microsoft to prevent phishing through exploits of rdp files

Following the mstsc.exe update, the behaviour will be as follows:

• Unsigned file → "Caution: Unknown remote connection" banner, Publisher = "Unknown publisher" microsoft
• All redirections off by default — the user must explicitly tick each one, and the "Don't ask me again" checkbox has been removed for unsigned files, deliberately microsoftExperts Exchange

In the case of CA PAM, the per acces .rdp file generated with PAM Gateway for RDP is not authenticated of signed with the certificate and therefore Windows considers it as not secure enough, triggering this behaviour

Resolution

Broadcom is working to find a solution to this problem, which will be included in future releases of the product, yet to be determined

In the meantime, it is possible to turn off the warning by making the following registry modifications in the final endpoints

reg add "HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\Client" /v RedirectionWarningDialogVersion /t REG_DWORD /d 1 /f

Additional Information

Be careful when doing a registry change. Make sure to have a copy of the registry before carrying out any modification. Improper modifications may lead to misfunction or corruption of the OS or applications