Microsoft fixed a failure that made the new security notices when opening Remote Desktop files (.rdp) appear wrong in teams with several monitors and different scale settings: displaced buttons, illegible text and, in extreme cases, unable to interact with the dialogue. The problem, reported after the April 2026 cumulative updates, affects all supported versions of Windows and was addressed in the optional previous update KB5083631 for Windows 11; Microsoft documents the specific patches and their notes on the knowledge pages linked from its support center, as KB5083769.
The warnings added in April seek to mitigate a real risk: .rdp files can redirect local resources (units, clipboard, devices) and have been exploited in phishing campaigns and espionage operations - including activity attributed to groups such as APT29 - to extract credentials and data. With new protections, Windows first shows an information message and, from then on, a security box that deactivates the readdresses by default and shows whether the file is digitally signed, remote address and requested resources.

However, the dissonance between usability and safety has been made clear: a warning window that cannot be read or with inaccessible buttons can push administrators or users to look for shortcuts (disable controls, reverse updates) and thus cancel the protection. In addition, some users have reported additional problems following April updates, such as VSS waiting times that have affected backup solutions in certain Windows 11 versions, and Microsoft had to post off-cycle updates to correct restart and installer failures on servers.

What to do now depends on your environment, but there are immediate practical measures: if you manage desks with multiple monitors, try first the previous update KB5083631 in a laboratory or pilot group before being deployed in production; verifies the integrity of backup and consults with your VSS problem patch backup providers; considers digitally signing the .rdp files used by the organization and strengthening perimeter controls to minimize RDP exposure. To better understand the structure and options of RDP files and how to safely configure them, official documentation is a useful reference: .rdp file documentation in Microsoft Learn, and for remote access mitigation and hardening measures you can review the CISA public guidelines on RDP: CISA - Remote Desktop Protocol (RDP).
It is also important to remember complementary controls that reduce risk even if the warning interface fails: require multifactor authentication in remote accesses, apply Network Level Authentication for RDP sessions, use jump hosts or gateways managed instead of direct exposures, and restrict the opening of .rdp files received by mail or downloaded from external sources. Finally, it communicates the change to the users: a brief guide to why these warnings appear and what behaviors to avoid reduces the likelihood that a poorly rendered window will result in a bad safety decision.
In summary, Microsoft's correction measures a problem of accessibility of RDP warnings that, if not solved, could turn a security improvement into an operational friction point. The practical recommendation is to test the update in controlled environments, verify compatibility with backup software and strengthen remote access with technical policies and user training while monitoring new updates and manufacturer notices.
Related
More news on the same subject.

18-year-old Ukrainian youth leads a network of infostealers that violated 28,000 accounts and left $250,000 in losses
The Ukrainian authorities, in coordination with US agents. They have focused on an operation of infostealer which, according to the Ukrainian Cyber Police, was allegedly adminis...

RAMPART and Clarity redefine the safety of IA agents with reproducible testing and governance from the start
Microsoft has presented two open source tools, RAMPART and Clarity, aimed at changing the way the safety of IA agents is tested: one that automates and standardizes technical te...

The digital signature is in check: Microsoft dismands a service that turned malware into apparently legitimate software
Microsoft announced the disarticulation of a "malware-signing-as-a-service" operation that exploited its device signature system to convert malicious code into seemingly legitim...

A single GitHub workflow token opened the door to the software supply chain
A single GitHub workflow token failed in the rotation and opened the door. This is the central conclusion of the incident in Grafana Labs following the recent wave of malicious ...

WebWorm 2025: the malware that is hidden in Discord and Microsoft Graphh to evade detection
The latest observations by cyber security researchers point to a change in worrying tactics of an actor linked to China known as WebWorm: in 2025 it has incorporated back doors ...

Identity is no longer enough: continuous verification of the device for real-time security
Identity remains the backbone of many security architectures, but today that column is cracking under new pressures: advanced phishing, real-time proxyan authentication kits and...

The dark matter of identity is changing the rules of corporate security
The Identity Gap: Snapshot 2026 report published by Orchid Security puts numbers to a dangerous trend: the "dark matter" of identity - accounts and credentials that are neither ...