WSLg triggers "RemoteApp security warning" / "Unknown publisher" via background mstsc.exe /wslg connection

[Dictation354]

Windows build number:

26200

Your Distribution version:

24.04

Your WSL versions:

2.6.3.0

Steps to reproduce:

1. Use WSL with WSLg enabled on Windows 11.
2. Install the recent April 2026 Windows updates.
3. Start WSL/WSLg, or launch any Linux GUI application.
4. A Windows dialog titled "RemoteApp security warning" appears.
5. The dialog shows:
   • Unknown remote connection
   • Unknown publisher
   • a RemoteApp path like dummy-entry
   • an app ID / GUID
6. At the same time, PowerShell shows that WSLg has started mstsc.exe in the background using C:\Program Files\WSL\wslg.rdp.

WSL logs:

No response

WSL dumps:

No response

Expected behavior:

WSLg should establish its background RDP connection silently, or otherwise as a trusted internal connection, without showing an end-user RemoteApp security warning.

Actual behavior:

A RemoteApp security warning is shown for the WSLg background connection, even though I did not manually open any .rdp file. From the user perspective, this looks like an untrusted RemoteApp launch triggered by WSLg.

Additional information

• The issue started after installing recent Windows 11 April 2026 updates.
• I initially suspected %USERPROFILE%\Documents\Default.rdp, but that does not appear to be the source of the warning:
  • Default.rdp is auto-generated by mstsc as expected
  • it contains remoteapplicationmode:i:0
  • it does not contain obvious RemoteApp fields such as remoteapplicationfile or remoteapplicationprogram
• The warning appears to be tied to the WSLg-launched background RDP connection instead.

This is the PowerShell command I used to inspect the process:

Get-CimInstance Win32_Process | Where-Object {$_.Name -match 'mstsc|msrdc'} | Select-Object Name, CommandLine

[Murazaki]

Is that normal behavior then ? Is there anything to worry about with this alert ? (in this specific case of WSL asking for RemoteApp permissions ofc)

[R-Bower]

Also experiencing this.

Is that normal behavior then ? Is there anything to worry about with this alert ? (in this specific case of WSL asking for RemoteApp permissions ofc)

The problem is that it seems to pop up several times, even if you allow the connection. I've seen it 6 or 7 times after a fresh reboot, and it continues to happen unless I restart WSL2 and then open a wslg GUI app. More of an annoyance than anything.

[daviewales]

Adding the following to ~/.wslconfig prevents the dialog from appearing (no good if I want GUI apps):

[wsl2]
guiApplications=false

Adding | Format-List to the PowerShell command in the original post prevents truncation of the output:

Get-CimInstance Win32_Process | Where-Object {$_.Name -match 'mstsc|msrdc'} | Select-Object Name, CommandLine | Format-List

Relevant Windows documentation for the recent update:
https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/remotepc/understanding-security-warnings

[BrianHolsen]

Hi, David Wales (@daviewales),
Do you have WSLG_USE_MSTSC=true config in .wlsgconfig ? I added this config to prevent WSL from generating a lot log files in %TEMP%\DiagOutputDir\RdClientAutoTrace\, by removing it solved the warning problem for me, but I have to deal with the log files.

[daviewales]

Thanks BrianHolsen@outlook.com (@BrianHolsen)! Yes, I do have WSLG_USE_MSTSC=true in ~/.wslgconfig.
I don't recall why I enabled this, but disabling it does avoid the warning dialog.