In modern enterprise environments, remote administration plays a critical role in maintaining infrastructure, supporting users, and managing systems across distributed networks.
Technologies such as Remote Desktop Services (RDS) are widely used by administrators to access servers and endpoints remotely.
However, if remote connections are not properly secured, attackers may attempt to intercept or manipulate communication between the client and the remote host.
One important security control designed to mitigate this risk is Secure RPC communication.
Remote Desktop sessions rely on Remote Procedure Call (RPC) to exchange data between the client and the remote system. If this communication is not properly secured, it may become a potential target for interception or unauthorized manipulation.
Microsoft provides a policy that allows organizations to require secure RPC communication for Remote Desktop sessions, ensuring that traffic between the client and the server is properly encrypted and protected.
By enforcing this configuration through Microsoft Intune, administrators can ensure that all managed devices comply with secure communication requirements when establishing remote desktop sessions.
When enabled, this policy strengthens remote connection security by enforcing encrypted RPC communication, helping protect remote management sessions from potential network-based attacks.
The result is a more secure remote administration environment where communication between clients and remote hosts is properly protected.
Why This Policy Matters
Remote administration is essential in modern IT environments, but insecure communication channels can expose remote sessions to potential risks.
Without enforcing secure RPC communication:
Remote session traffic may be less protected
Attackers may attempt to intercept or manipulate communication
Remote administration channels may become security weak points
By requiring secure RPC communication:
Remote Desktop traffic is encrypted and protected
Communication between client and host becomes more secure
Network-based interception risks are reduced
Remote management sessions become more resilient to attacks
This configuration aligns with modern security principles such as secure communication, endpoint hardening, and Zero Trust architecture.
Windows CSP Overview
The policy responsible for enforcing this behavior is exposed through the Windows Policy Configuration Service Provider (CSP) framework.
The configuration RequireSecureRPCCommunication allows administrators to require secure RPC communication for Remote Desktop sessions.
This setting applies at the device scope and is supported on modern Windows editions such as Pro, Enterprise, Education, and IoT Enterprise, starting with Windows 10 version 1703 and later.
When deployed using Microsoft Intune configuration profiles, this policy ensures that secure communication requirements are consistently enforced across all managed devices.
Description Framework Properties
This policy is implemented through the Windows CSP framework, enabling Intune to configure the setting directly at the operating system level.
Key configuration properties include:
Format: chr (string)
Access Type: Add, Delete, Get, Replace
These properties allow administrators to centrally deploy and manage the configuration through Intune while ensuring that the setting remains enforced across managed devices.
ADMX Mapping (For Reference)
For organizations that still rely on Group Policy or operate in hybrid environments, this CSP setting maps directly to the equivalent Administrative Template policy.
Policy Name TS_RPC_ENCRYPTION
Friendly Name Require secure RPC communication
Location Computer Configuration
Policy Path Windows Components → Remote Desktop Services → Remote Desktop Session Host → Security
Registry Key Software\Policies\Microsoft\Windows NT\Terminal Services
Registry Value Name fEncryptRPCtraffic
ADMX File TerminalServer.admx
This mapping ensures that the same security configuration can be consistently enforced across both Group Policy and Microsoft Intune managed environments.
How to Configure Secure RPC Communication for Remote Connections Using Intune (Settings Catalog)
You can enforce this policy centrally using the Intune Settings Catalog, ensuring that secure RPC communication is required for Remote Desktop sessions across all managed Windows devices.
By enforcing this configuration through Microsoft Intune, organizations can strengthen remote administration security and ensure that communication between remote clients and hosts is properly protected.
To begin, sign in to the Microsoft Intune admin center and follow the steps below, as illustrated in the screenshot.
Create the Configuration Profile
In the Microsoft Intune admin center:
Navigate to Devices
Select Windows
Click Configuration
Select + Create policy
In the Create a profile pane:
Platform: Windows 10 and later
Profile type: Settings catalog
Click Create to continue.
At this stage, you have created the foundation of a Settings Catalog policy. In the next steps, you will search for and configure the setting that requires secure RPC communication for Remote Desktop sessions.
This configuration ensures that Windows enforces encrypted RPC communication between the client and the remote host, helping protect remote management sessions from potential interception or unauthorized manipulation.
Define Basic Profile Details
After clicking Create, the next step is to define the basic details of the configuration profile. This stage is essential for long-term management, clarity, and governance within Microsoft Intune, especially in environments with multiple endpoint hardening policies and security baselines.
Providing a clear Name and a concise but meaningful Description ensures that the purpose of the policy is immediately understood by administrators and security teams in the future.
As shown in the screenshot, configure the fields as follows.
Policy Name and Description
Name: WIN – Endpoint Hardening – Secure RPC for Remote Connections
Description: This policy enforces secure Remote Procedure Call (RPC) communication for remote connections. It ensures that Remote Desktop and other remote management services use encrypted RPC channels, helping mitigate risks such as credential exposure, man-in-the-middle attacks, and unauthorized interception of remote communication.
The Platform field is already pre-selected as Windows, so no changes are required.
Once the name and description are defined, click Next to proceed to the configuration settings.
Configure the Setting Using the Settings Picker
With the profile basics defined, the next step is to configure the policy using the Settings picker, where you select the exact Windows security setting to enforce.
Click Add settings to open the Settings picker panel.
By default, this setting is not configured, which means Windows will follow its existing behavior and will not explicitly enforce secure RPC communication for Remote Desktop sessions through Intune unless you enable it.
As shown in the screenshot, use the search field at the top of the Settings picker and type:
Require secure RPC communication
Then click Search to filter the results.
From the returned results:
Select the category Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security
Choose the setting: Require secure RPC communication
Once selected, the setting is added to the configuration profile. Back on the configuration page, change the value from its default state to Enabled.
When enabled, Windows requires secure RPC communication for Remote Desktop sessions, helping ensure that communication between the client and the remote host is encrypted and protected.
This reduces the risk of unauthorized interception, insecure remote communication, and certain network-based attacks, while strengthening the security of remote administration.
This configuration aligns with modern endpoint hardening practices and supports Zero Trust security principles, ensuring that remote connections use stronger communication security controls.
After configuring the setting, click Next to continue with the profile deployment steps.
Configure Scope Tags (Optional)
Scope tags are used to control who can view and manage this policy within the Microsoft Intune admin center. They are particularly useful in environments with delegated administration, multiple IT teams, or regional management models.
As shown in the screenshot, the Default scope tag is selected. This is the standard and recommended configuration for most environments, as it ensures the policy is visible to all administrators who have access to Intune.
Optionally, custom scope tags can be assigned if you need to:
Restrict policy visibility to specific IT roles or teams
Enforce administrative separation of duties
Support delegated or region-based Intune management
If no additional scope tags are required, keep the Default selection and click Next to continue.
Assignments – Restrict Anonymous Access Policy
After configuring the policy settings, the next step is to assign the policy to the appropriate target group. Assignments define which devices will receive and enforce this configuration, ensuring the policy is applied in a controlled and intentional manner.
In the Assignments tab, click Add groups under Included groups and search for the group you want to target. This approach allows you to deploy the policy gradually, starting with test devices before expanding to production.
As shown in the screenshot, the policy is assigned to the following group:
GRP – MS365Education – Test Computers
Once the group is selected, verify the following:
The group appears under Included groups
The group status is Active
No assignment filters are applied (unless explicitly required)
At this stage, no Excluded groups are configured, which is appropriate for controlled test deployments.
After confirming the assignment, click Next to proceed to the Review + Create step.
Review + Create – Final Validation
The Review + Create step is the final checkpoint before deploying the policy. This is where you validate that all configurations are correct and aligned with your intended remote connection security hardening objective.
Pay special attention to the following items.
Policy name and description
Confirm that the policy clearly reflects its purpose: strengthening endpoint security by requiring secure RPC communication for Remote Desktop connections, ensuring that communication between remote clients and hosts is encrypted and protected.
Configuration settings: Verify that Require secure RPC communication is set to Enabled under: Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security
Scope tags: Ensure the correct scope tag is assigned. In this example, the Default scope tag is used.
Assignments: Confirm the policy is assigned to the intended group: GRP – MS365Education – Test Computers
Also verify that no unintended exclusions are configured.
This final review step helps prevent misconfigurations, unintended deployments, or scope issues, especially in environments with multiple security baselines, delegated administration, and layered endpoint security policies.
Once everything has been validated, click Create to finalize and deploy the policy to the assigned devices.
Monitor Policy Deployment Status
After creating and assigning the WIN – Endpoint Hardening – Secure RPC for Remote Connections configuration profile, the next step is to verify its deployment status.
This validation confirms that the policy has been successfully applied and that Windows is enforcing secure RPC communication for Remote Desktop sessions on the targeted devices.
Although Microsoft Intune can take up to 8 hours to automatically deliver configuration profiles, deployment often occurs much faster. If needed, you can accelerate the process by:
Triggering a manual device sync from the Company Portal
Initiating a sync directly from the Microsoft Intune admin center
Monitoring deployment ensures that the secure RPC communication policy is active and operating as intended.
How to Verify Policy Deployment Status
To review the deployment results:
In the Microsoft Intune admin center, navigate to Devices ➝ Configuration profiles
Use the search bar to locate the profile: WIN – Endpoint Hardening – Secure RPC for Remote Connections
Select the policy to open the Overview page.
Review Deployment Metrics
Intune provides clear indicators to evaluate the policy deployment status:
Succeeded – Devices have successfully applied the policy
In progress – Devices are still processing the configuration
Error – The policy failed to apply and requires investigation
Not applicable – The device does not support the configuration
When devices report Succeeded, it confirms that Windows is enforcing the policy Require secure RPC communication, ensuring that Remote Desktop sessions use secure and encrypted RPC communication channels.
This verification step confirms that the remote connection hardening control is successfully deployed and protecting managed Windows endpoints.
Why This Validation Matters
Monitoring the deployment status ensures that the secure RPC communication policy is correctly enforced across managed devices.
It confirms that:
Secure RPC communication is actively applied
Remote Desktop sessions use protected communication channels
There are no deployment failures or unsupported devices
The endpoint security baseline remains consistent across the environment
This final validation step completes the policy lifecycle from configuration and deployment to enforcement and verification.
Security hardening is only effective when it is verified.
Client-Side Verification via Event Viewer
After the device has synced with Intune, you can perform a client-side verification to confirm that the WIN – Endpoint Hardening – Secure RPC for Remote Connections policy was successfully applied.
This validation helps ensure that the secure RPC communication requirement is actively enforced at the operating system level.
Windows records Intune policy processing events locally, allowing administrators to confirm policy enforcement without relying only on the Intune portal.
How to Verify
Open Event Viewer on the target device
Navigate to: Applications and Services Logs ➝ Microsoft ➝ Windows ➝ DeviceManagement-Enterprise-Diagnostics-Provider ➝ Admin
Select Filter Current Log
Look for Event ID 813 or Event ID 814, which indicate successful processing of Intune configuration policies
Open the event details and confirm that the policy Require secure RPC communication was applied
Pro Tip
Match the event timestamp with the device’s most recent Intune sync.
Event IDs 813 and 814 are reliable indicators that the configuration policy was processed by the Windows MDM engine.
If the policy is correctly applied, Windows will enforce secure RPC communication for Remote Desktop sessions, ensuring that communication between remote clients and hosts is properly protected.
Why This Matters for Endpoint Security
Remote administration channels are critical in enterprise environments, but insecure communication can expose remote sessions to potential risks.
By enforcing secure RPC communication through Microsoft Intune and validating the configuration locally, organizations ensure that:
Remote Desktop communication is encrypted and protected
Remote connections are less exposed to interception risks
Administrative sessions follow secure communication requirements
Remote management channels remain aligned with security best practices
This configuration strengthens remote connection security without disrupting legitimate administrative workflows.
Key Takeaway
Security hardening does not always require complex architectures.
Sometimes, a single well-governed configuration can significantly improve security.
By enforcing secure RPC communication through Microsoft Intune, organizations ensure that Remote Desktop sessions use protected communication channels.
Combined with centralized deployment and proper validation, this policy helps transform remote administration into a more secure and controlled process.
And in modern endpoint security, secure communication is a fundamental layer of protection.
More Information
For additional technical details, refer to the official Microsoft documentation below:
https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-terminalserver
https://learn.microsoft.com/en-us/mem/intune/configuration/settings-catalog
https://learn.microsoft.com/en-us/mem/intune/configuration/device-profiles
https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-monitor
https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-troubleshoot
Thank you!
🖥️ Ricardo Barbosa
🎖️ Microsoft MVP | 📘 Microsoft Certified Trainer (MCT)
☁️ Intune & Cloud Architect |💼 Technology Director at Altelix.com