Marc-André Rouillard

Hello,

The issue has been fixed internally, and should be available in version 2026.2.18.

Regards,

Marc-André Rouillard

Hello,

The feature has been implemented internally, and should be available in version 2026.2.14.

Regards,

Hello,

The feature has been implemented internally, and should be available in version 2026.2.9.

Regards,

@Marc-André Rouillard

Could you please explain where to configure this?

I don't see any changes in the UI regarding to Smart Card Auth and no explanation in the changelog.

BR

Mario

@mariosommer

Certainly, here's how the feature is currently implemented :

Based on an SSH Shell entry's proprieties, the new certificate list prompt appears when all of these conditions are met :

• "Use smart card" is checked

• "Certificate method" is set to "Try all modes"

• More than one certificate is detected when launching the connection.

If there is only one certificate detected, it is automatically selected and used.

Let me know if you have any further questions, or if you're encountering any issues while setting this up.

Regards,

Hello,

An update on the GPO part of this request: we've added a new Group Policy that lets you enforce Enhanced offline security centrally, so you no longer have to rely on each user enabling it manually.

The policy is "Force Enhanced security for Offline mode" (Security category of our ADMX template). When it's enabled:

• RDM forces the offline cache to use Enhanced security.

• If a user hasn't configured an offline password yet, they're prompted to set one before they can continue, the same pattern as our existing "Force application password" policy.

This directly covers the "enable Enhanced Security automatically via GPO" piece you raised, and it'll ship in an upcoming build.

To be clear about the scope so it doesn't get conflated with the broader discussion in this thread: this change is about enforcing/enabling Enhanced security through policy. It does not yet include encrypting the offline cache with Windows Hello (i.e. having Windows Hello cryptographically wrap the offline key). That deeper work, along with the other items Mathieu mentioned earlier (evaluating FIDO2/passkeys/YubiKey, moving to Argon2id, and revisiting the offline password model itself), is still being investigated separately and isn't part of this delivery.

We'll keep the thread updated as those investigations progress.

Regards,

Hello,

The feature has been implemented internally, and should be available in version 2026.3.

Regards,

Hello,

The feature has been implemented internally, and should be available in version 2026.3.0.

Regards,

Hello,

The feature has been implemented internally, and should be available in version 2026.2.10.

Regards,

Hello,

The feature has been implemented internally, and should be available in version 2026.2.10.

Regards,

Hello,

The feature has been implemented internally, and should be available in version 2026.2.9.

Regards,

Hello,

The feature has been implemented internally, and should be available in version 2026.2.9.

Regards,

Hello,

The feature has been implemented internally, and should be available in version 2026.2.9.

Regards,