Why can't I set the certificate for "RD Connection Broker Enable Single Sign On" using a script?

Question

Hello, I am trying to apply certificates to my remote desktop service for RD connection broker - Enable Single Sign On, RD Connection Broker - Publishing, RD web access. MY script has successfully worked for Publishing and Web Access but I am unable to get the RD Connection broker SSO to apply.

Here is the script:

Set-ExecutionPolicy RemoteSigned

# Ask for user input for the RD Connection Broker name

$connectionBrokerName = Read-Host -Prompt "Enter the RD Connection Broker name"

# Ask for the password for the .pfx certificate

$pfxPassword = Read-Host -Prompt "Enter the password for the .pfx certificate" -AsSecureString

# Define the path where the .pfx certificates are stored

$pfxFilePath = "C:\Windows\ServiceProfiles\LocalService*.pfx"

# Import the certificate(s) into the LocalMachine Personal store

Get-ChildItem -Path $pfxFilePath | ForEach-Object {

    # Import each PFX certificate to LocalMachine\My (Personal) store

    $importedCert = Import-PfxCertificate -FilePath $_.FullName -CertStoreLocation Cert:\LocalMachine\My -Password $pfxPassword

    

    # Get the thumbprint of the imported certificate

    $certificateThumbprint = $importedCert.Thumbprint

    Write-Host "Certificate imported: $($importedCert.Subject)"

    

    # Assign the certificate to RD Web Access

    Write-Host "Assigning certificate to RD Web Access..."

    Set-RDCertificate -Role RDWebAccess -ConnectionBroker $connectionBrokerName -Thumbprint $certificateThumbprint

    # Assign the certificate to RD Publishing

    Write-Host "Assigning certificate to RD Publishing..."

    Set-RDCertificate -Role RDPublishing -ConnectionBroker $connectionBrokerName -Thumbprint $certificateThumbprint

    # Assign the certificate to RD Connection Broker (via RD Licensing)

    Write-Host "Assigning certificate to RD Connection Broker..."

    

    # Set the RD Connection Broker certificate

    $rdConnectionBroker = Get-RDConnectionBroker -ConnectionBroker $connectionBrokerName

    if ($rdConnectionBroker) {

        Set-RDConnectionBroker -ConnectionBroker $connectionBrokerName -CertificateThumbprint $certificateThumbprint

        Write-Host "Certificate successfully applied to RD Connection Broker."

    } else {

        Write-Host "RD Connection Broker not found or unable to assign certificate."

    }

    Write-Host "Certificate successfully applied to RDS roles."

}

Write-Host "Process complete. Certificate(s) imported and assigned to RDS roles."

Here is the Error:

Assigning certificate to RD Connection Broker...

Get-RDConnectionBroker : The term 'Get-RDConnectionBroker' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is 

correct and try again.

At line:22 char:27

+     $rdConnectionBroker = Get-RDConnectionBroker -ConnectionBroker $c ...

+                           ~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : ObjectNotFound: (Get-RDConnectionBroker:String) [], CommandNotFoundException

    + FullyQualifiedErrorId : CommandNotFoundException

Is "Get-RDConnectionBroker" a legitimate cmdlet from the RemoteDesktop Module? Besides doing it manually is there a way to set the RD Connection Broker - Enable Single Sign On certificate?

Answer 1

Hello，

Answer your questions directly:

• Is “Get-RDConnectionBroker” a legitimate cmdlet from the RemoteDesktop Module?

No—it isn’t a valid cmdlet. You’ll find cmdlets such as Set-RDCertificate for some roles, but there isn’t one for RD Connection Broker SSO.

• Besides doing it manually, is there a way to set the RD Connection Broker – Enable Single Sign On certificate?

At this time Microsoft does not expose an official scripting method (cmdlet) to set the RD Connection Broker SSO certificate. Any supported configuration of this certificate is done interactively (or via other less-documented methods that are not recommended for production use).

If your environment requires automation for updating this certificate, you might need to consider alternate approaches such as automating GUI interactions or investigating supported configuration management channels (for example, using Group Policy or the native RDS management APIs), but as far as PowerShell cmdlets go, only the roles for RD Web Access and RD Publishing have direct support.

---

If the Answer is helpful, please click "Accept Answer" and upvote it.