RDP files are a credential and file theft path, not just a convenience feature. Microsoft is now forcing Windows to warn before opening them and to disable risky resource redirection by default, because a malicious file can silently connect a user to an attacker-controlled system and expose local drives, clipboard data, and authentication material.
The change ships in the April 2026 cumulative updates for Windows 10 KB5082200 and Windows 11 KB5083769 and KB5082052. Microsoft says the new prompts are meant to stop phishing abuse of .rdp files, a technique previously used by APT29 to steal data and credentials from victims.
The protection reduces easy exfiltration through redirected devices, but it can also interrupt admin workflows that depend on redirected resources. The remaining risk is that users still have to recognize and reject malicious connection files before they become a live session.