Remediate Nessus Plugins 51192 and 57582

Question

The problem is with the self-signed signed cert for Remote Desktop. I have deleted the certificate, and it recreates itself upon remoting back in to the server. How do you delete the cert permanently? Or is it even possible to remove the self signed certificate from the Remote Desktop certificate store?

Server version is Server 2019.

Answer 1

Hello amie Kennell

You can check the installed certificates using the command certmgr.msc.

1. Press Windows Key + R Key together, type certmgr.msc and hit enter. You will get a new window with the list of Certificates installed on your computer.
2. Locate the certificate you want to delete and then click on Action button then, click on Delete. You can find the actual registry entries under: \SOFTWARE\Microsoft\SystemCertificates
   In HKEY_CURRENT_USER for user-specific certificates and HKEY_LOCAL_MACHINE for machine-specific certificates.

I hope this helps! Please let me know if you need any further assistance.

Kind Regards,
Karlie Weng

---If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

If you are not using self-signed certificates for your computer certificate, IE you have a valid Intermediate and/or Root Certificate signed by a valid Certificate Authority:

Even if you remove this certificate from the Remote Desktop store, the next time someone remotes into that device, the RDP self-signed certificate will re-appear.

You need to use a wmic command to configure TerminalServices (RDP) to use your computer certificate.

From an administrative powershell window:

Get-ChildItem -Path Cert:\LocalMachine\My

Copy the thumbprint of the certificate your computer is issued

Paste it into the following command to tell windows to use this certificate instead of the default self-signed RDP certificate. Ensure there are no spaces in the thumbprint and make sure it is enclosed in quotes as follows:

wmic /namespace:\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="THUMBPRINT"

Even if the self-signed certificate shows back up in the Remote Desktop store, your computer will ignore it, and your findings for Plugins 51192 and 57582 will no longer show in your scans.