Step 1
Remove the expired RDP cert
Open Certificates (Local Computer)
Expand Remote Desktop --> Certificates
Delete the expired certificate
If there is no cert listed, that is fine.
Step 2
Fix the owner on the corrupt file.
Browse to C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
Locate the file starting with f686aace
Right click and select properties --> Security --> Advanced
Change the owner to "Administrators" or "SYSTEM"
Click OK
Backup the file (optional)
Rename or delete the file starting with f686aace
Open services
Restart "Remote Desktop Service"
source:
https://levitrares.com/host-https-social.technet.microsoft.com/Forums/ie/en-US/a9c734c1-4e68-4f45-be46-8cae44c95257/unable-to-remote-desktop-to-windows-server-2012-due-to-failed-to-create-self-signed-certificate?forum=winserverTS
