There are several ways to check the RDP encryption level: through Group Policy, Registry Editor, PowerShell or Windows Terminal Services Configuration (on old Windows Server versions). The encryption level determines how securely data travels between the Remote Desktop client and the remote computer. Using a higher encryption level helps protect sensitive information from interception during an RDP session.
In this guide, you’ll learn multiple methods to verify your current RDP encryption level and understand what each encryption option means.
What Is RDP Encryption Level?
Remote Desktop Protocol (RDP) encryption protects data transmitted between the client and server.
Windows supports several encryption levels:
| Encryption Level | Security | Recommended |
|---|---|---|
| Low | Encrypts client-to-server traffic only | ❌ No |
| Client Compatible | Uses the highest encryption supported by the client | ✅ Yes |
| High | Uses strong encryption for both directions | ✅ Yes |
| FIPS Compliant | Uses FIPS-approved cryptography | ✅ For government & compliance |
Most modern Windows systems prefer to use TLS (Transport Layer Security) over the traditional RDP encryption where possible.
Why Check the RDP Encryption Level?
Checking your RDP encryption level helps you:
- Verify secure Remote Desktop connections
- Meet compliance requirements
- Prevent weak encryption usage
- Protect login credentials
- Secure sensitive business data
- Improve remote access security
Method 1: Check RDP Encryption Level Using Group Policy
This is the easiest method.
Step 1
Press
Windows + R
Type
gpedit.msc
Press Enter.
Step 2
Navigate to:
Computer Configuration Administrative Templates Windows Components Remote Desktop Services Remote Desktop Session Host Security
Step 3
Open
Set client connection encryption level
If enabled, you’ll see one of these values:
- Low
- Client Compatible
- High
- FIPS Compliant
If the policy is Not Configured, Windows uses its default behavior.
Method 2: Check RDP Encryption Level Using Registry Editor
Press
Windows + R
Type
regedit
Go to:
HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Terminal Server WinStations RDP-Tcp
Find:
MinEncryptionLevel
Possible values:
| Registry Value | Encryption |
|---|---|
| 1 | Low |
| 2 | Client Compatible |
| 3 | High |
| 4 | FIPS |
Method 3: Check Using PowerShell
Run PowerShell as Administrator.
Execute:
</> PowerShell Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" | Select MinEncryptionLevel
Example output:
MinEncryptionLevel ------------------ 3
Value meanings:
- 1 = Low
- 2 = Client Compatible
- 3 = High
- 4 = FIPS
Method 4: Check Using Command Prompt
Open Command Prompt as Administrator.
Run:
</> cmd reg query "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v MinEncryptionLevel
Example:
MinEncryptionLevel REG_DWORD 0x3
That means:
High Encryption
Method 5: Verification Using the Resultant Set of Policy (RSOP)
Open:
rsop.msc
Navigate to:
Computer Configuration Administrative Templates Windows Components Remote Desktop Services Remote Desktop Session Host Security
If a Group Policy is applied, you’ll see the active encryption level.
Method 6: Check Active TLS Encryption
Modern Windows uses TLS for RDP encryption instead of the classic RDP encryption.
Run:
</> PowerShell Get-TlsCipherSuite
Or inspect the RDP listener certificate in:
Local Computer Remote Desktop Certificates
If TLS is enabled, your RDP session is using stronger transport encryption.
Understanding Encryption Levels
Low Encryption
- Encrypts client-to-server traffic only
- Weak protection
- Not recommended
Client Compatible
- Negotiates the highest encryption both client and server support
- Default on many systems
- Recommended for most organizations
High Encryption
- Uses 128-bit encryption
- Encrypts both directions
- Suitable for sensitive environments
FIPS Encryption
Uses Federal Information Processing Standards (FIPS).
Recommended for:
- Government
- Military
- Healthcare
- Financial institutions
Verify RDP Security Layer
Besides encryption, check the Security Layer.
Group Policy location:
Remote Desktop Session Host Security Require use of particular security layer for remote (RDP) connections
Available options:
- RDP
- SSL (TLS)
- Negotiate
TLS (SSL) is recommended.
Check Encryption with Event Viewer
Open:
eventvwr.msc
Navigate to:
Applications and Services Logs Microsoft Windows TerminalServices-RemoteConnectionManager Operational
Review RDP connection events for security-related information.
Best Practices for Secure RDP Encryption
Follow these recommendations to keep your Remote Desktop environment secure:
- Use TLS whenever possible.
- Set encryption level to High or Client Compatible.
- Avoid Low encryption.
- Enable Network Level Authentication (NLA).
- Make sure your Windows has the latest security patches installed.
- Restrict RDP access using a firewall or VPN.
- Protect your accounts by using secure passwords and enabling multi-factor authentication (MFA).
- Monitor Remote Desktop logs for suspicious activity.
- Disable RDP if it is not required.
Common Problems
Encryption Level Is Not Configured
This usually means Windows is using the default encryption settings. Configure the policy manually if you need a specific level.
Registry Value Missing
Some Windows editions create the registry value only after a policy has been configured.
TLS Not Working
Check:
- Server certificate validity
- Windows updates
- Group Policy settings
- RDP service configuration
Client Cannot Connect
High encryption or FIPS mode might prevent older RDP clients from connecting. Ensure both the client and server support the selected encryption standard.
Conclusion
It is a simple yet important step to protect remote desktop connections by checking your RDP encryption level. Whether you use Group Policy, Registry Editor, PowerShell, or Command Prompt, verifying your encryption settings ensures your data is protected while in transit.
For the best security, configure TLS, enable Network Level Authentication (NLA), choose High or Client Compatible encryption, and keep your Windows systems up to date. These practices help reduce the risk of unauthorized access and improve the overall security of your Remote Desktop environment.
