sdl-freerdp(1)

📦
version 3.32.1 · 11 versions
, in ubuntu stonking

🦋 sdl-freerdp(1) — FreeRDP SDL client 🦋

💖 NAME 💖

sdl-freerdp — the FreeRDP SDL client. That's it, that's the name, bestie. ✨

🌈 SYNOPSIS 🌈

okay so the whole vibe is literally:

sdl-freerdp [file] [options] [/v:server[:port]]

🌸 DESCRIPTION 🌸

<pink>sdl-freerdp</pink> is an SDL Remote Desktop Protocol (RDP) client, and it's part of the FreeRDP project. No cap. An RDP server is built-in to many editions of Windows. Alternative servers included ogon, gnome-remote-desktop, xrdp and VRDP (VirtualBox). 🫶

💅 OPTIONS 💅

Here's the whole menu — every flag, every default, every little bracket. No skips, no cap. 🎀

  • /a:addin[,options], /addin:addin[,options] — Addin
  • /azure:[tenantid:id],[use-tenantid[:[on|off]],[ad:url][avd-access:format string],[avd-token:format string],[avd-scope:format string],[auth-helper:path|autodetect] — AzureAD options
  • /action-script:file-name — Action script (default:~/.config/freerdp/action.sh)
  • /admin, /console — Admin (or console) session
  • +aero — desktop composition (default:off)
  • /app:program:[path|||alias],cmd:command,file:filename,guid:guid,icon:filename,name:name,workdir:directory,hidef:[on|off] — Remote application program
  • /assistance:password — Remote assistance password
  • /auto-request-control: — Automatically request remote assistance input control
  • +async-channels — Asynchronous channels (experimental) (default:off)
  • +async-update — Asynchronous update (default:off)
  • /audio-mode:[[none|2]|[server|1]|[redirect|0]] — Audio output mode
  • +auth-only — Authenticate only (default:off)
  • /auth-pkg-list:[[none],]!ntlm,kerberos,!u2u — Authentication package filter (comma-separated list, use ! to disable). By default all methods are enabled. Use explicit none as first argument to disable all methods, selectively enabling only the ones following.
  • -authentication — Authentication (experimental) (default:on)
  • +auto-reconnect — Automatic reconnection (default:off)
  • /auto-reconnect-max-retries:retries — Automatic reconnection maximum retries, 0 for unlimited [0,1000]
  • /bpp:depth — Session bpp (color depth) (default:16)
  • /buildconfig — Print the build configuration
  • /cache:[bitmap[:on|off],codec[:rfx|nsc],glyph[:on|off],offscreen[:on|off],persist,persist-file:filename] — cache option (this page doesn't give it an extra one-liner, bestie 🫶)
  • /cert:[deny,ignore,name:name,tofu,fingerprint:hash:hash as hex[,fingerprint:hash:another hash]] — Certificate accept options. Use with care! ⚠️
    • deny ... Automatically abort connection if the certificate does not match, no user interaction.
    • ignore ... Ignore the certificate checks altogether (overrules all other options)
    • name ... Use the alternate name instead of the certificate subject to match locally stored certificates
    • tofu ... Accept certificate unconditionally on first connect and deny on subsequent connections if the certificate does not match
    • fingerprints ... A list of certificate hashes that are accepted unconditionally for a connection
  • /client-build-number:number — Client Build Number sent to server (influences smartcard behaviour, see [MS-RDPESC])
  • /client-hostname:name — Client Hostname to send to server
  • /clipboard:[[use-selection:atom],[direction-to:[all|local|remote|off]],[files-to[:all|local|remote|off]]] — Redirect clipboard:
    • use-selection:<atom> ... (X11) Specify which X selection to access. Default is CLIPBOARD. PRIMARY is the X-style middle-click selection.
    • direction-to:[all|local|remote|off] control enabled clipboard direction
    • files-to:[all|local|remote|off] control enabled file clipboard direction (default:on)
  • -compression, -z — compression (default:on)
  • /compression-level:level — Compression level (0,1,2)
  • +credentials-delegation — credentials delegation (default:off)
  • /d:domain — Domain
  • -decorations — Window decorations (default:on)
  • /disp — Display control
  • /drive:name,path — Redirect directory path as named share name. Hotplug support is enabled with /drive:hotplug,*. This argument provides the same function as "Drives that I plug in later" option in MSTSC.
  • +drives — Redirect all mount points as shares (default:off)
  • /dump:record|replay,file:file[,nodelay] — record or replay dump
  • /dvc:channel[,options] — Dynamic virtual channel
  • +dynamic-resolution — Send resolution updates when the window is resized (default:off)
  • /echo, /echo — Echo channel
  • -encryption — Encryption (experimental) (default:on)
  • /encryption-methods:[40,][56,][128,][FIPS] — RDP standard security encryption methods
  • /endpointfedauth:token — Endpoint FedAuth token for Hyper-V VM console-connect scenarios
  • /f — Fullscreen mode (Ctrl+Alt+Enter toggles fullscreen)
  • +fipsmode — FIPS mode (default:off)
  • /floatbar[:sticky:[on|off],default:[visible|hidden],show:[always|fullscreen|window]] — floatbar is disabled by default (when enabled defaults to sticky in fullscreen mode)
  • -fonts — smooth fonts (ClearType) (default:on)
  • +force-console-callbacks — Use default callbacks (console) for certificate/credential/... (default:off)
  • /frame-ack:number — Number of frame acknowledgement
  • /args-from:file:file|stdin|fd:number|env:name — Read command line from a file, stdin or file descriptor. This argument can not be combined with any other. Provide one argument per line.
  • /from-stdin[:force] — Read credentials from stdin. With force the prompt is done before connection, otherwise on server request.
  • /gateway:g:gateway[:port],u:user,d:domain,p:password,usage-method:[direct|detect],access-token:token,type:[rpc|http[,no-websockets][,extauth-sspi-ntlm]|auto[,no-websockets][,extauth-sspi-ntlm]]|arm,url:wss://url,bearer:oauth2-bearer-token,timeout:1-600000ms, /gw:g:gateway[:port],u:user,d:domain,p:password,usage-method:[direct|detect],access-token:token,type:[rpc|http[,no-websockets][,extauth-sspi-ntlm]|auto[,no-websockets][,extauth-sspi-ntlm]]|arm,url:wss://url,bearer:oauth2-bearer-token,timeout:1-600000ms — Gateway Hostname
  • /gdi:sw|hw — GDI rendering
  • /geometry — Geometry tracking channel
  • +gestures — Consume multitouch input locally (default:off)
  • /gfx[:[progressive[:on|off]|RFX[:on|off]|AVC420[:on|off]AVC444[:on|off]],mask:value,small-cache[:on|off],thin-client[:on|off],progressive[:on|off]]] — RDP8 graphics pipeline
  • -grab-keyboard — Grab keyboard focus, forward all keys to remote (default:on)
  • -grab-mouse — Grab mouse focus, forward all events to remote (default:on)
  • /h:height — Height (default:768)
  • -heartbeat — Support heartbeat PDUs (default:on)
  • /help, /? — Print help
  • +home-drive — Redirect user home as share (default:off)
  • /ipv4[:[:force]], /4[:[:force]] — Prefer IPv4 A record over IPv6 AAAA record
  • /ipv6[:[:force]], /6[:[:force]] — Prefer IPv6 AAAA record over IPv4 A record
  • /jpeg — JPEG codec support
  • /jpeg-quality:percentage — JPEG quality
  • /kbd:[layout:[0xid|name],lang:0xid,fn-key:value,type:value,subtype:value,unicode[:on|off],remap:key1=value1,remap:key2=value2,pipe:filename] — Keyboard related options:
    • layout: set the keyboard layout announced to the server
    • lang: set the keyboard language identifier sent to the server
    • fn-key: Function key value
    • remap: RDP scancode to another one. Use /list:kbd-scancode to get the mapping. Example: To switch 'a' and 's' on a US keyboard: /kbd:remap:0x1e=0x1f,remap:0x1f=0x1e
    • pipe: Name of a named pipe that can be used to type text into the RDP session
  • /kerberos:[kdc-url:url,lifetime:time,start-time:time,renewable-lifetime:time,cache:path,armor:path,pkinit-anchors:path,pkcs11-module:name] — Kerberos options
  • /load-balance-info:info-string — Load balance info
  • /list:[kbd|kbd-scancode|kbd-lang[:value]|smartcard[:[pkinit-anchors:path][,pkcs11-module:name]]|monitor|tune|timezones] — List available options for subcommand (default:List available options for subcommand)
  • /log-filters:tag:level[,tag:level[,...]] — Set logger filters, see wLog(7) for details
  • /log-level:[OFF|FATAL|ERROR|WARN|INFO|DEBUG|TRACE] — Set the default log level, see wLog(7) for details
  • /max-fast-path-size:size — Specify maximum fast-path update size
  • /max-loop-time:time — Specify maximum time in milliseconds spend treating packets
  • +menu-anims — menu animations (default:off)
  • /microphone[:[sys:sys,][dev:dev,][format:format,][rate:rate,][channel:channel]], /mic[:[sys:sys,][dev:dev,][format:format,][rate:rate,][channel:channel]] — Audio input (microphone)
  • /monitors:id[,id[,...]] — [experimental] Select monitors to use (only effective in fullscreen or multimonitor mode)
  • -mouse-motion — Send mouse motion events (default:on)
  • +mouse-relative — Send mouse motion with relative addressing (default:off)
  • /mouse:[relative:[on|off],grab:[on|off]] — Mouse related options:
    • relative: send relative mouse movements if supported by server
    • grab: grab the mouse if within the window
  • /multimon:on|off|force — Use multiple monitors (default:off)
  • +multitouch — Redirect multitouch input (default:off)
  • -multitransport — Support multitransport protocol (default:on)
  • -nego — protocol security negotiation (default:on)
  • /network:[invalid|modem|broadband|broadband-low|broadband-high|wan|lan|auto] — Network connection type
  • /nsc, /nscodec — NSCodec support
  • /orientation:[0|90|180|270] — Orientation of display in degrees
  • +old-license — Use the old license workflow (no CAL and hwId set to 0) (default:off)
  • /p[:password] — Password. Pass /p without arguments to silence interactive password prompts if no credentials are required for the connection.
  • /parallel[:name[,path]] — Redirect parallel device
  • /parent-window:window-id — Parent window id
  • /pcb:blob — Preconnection Blob
  • /pcid:id — Preconnection Id
  • /pheight:height — Physical height of display (in millimeters)
  • /play-rfx:pcap-file — Replay rfx pcap file
  • /port:number — Server port
  • -suppress-output — suppress output when minimized (default:on)
  • +print-reconnect-cookie — Print base64 reconnect cookie after connecting (default:off)
  • /printer[:name[,driver[,default]]] — Redirect printer device
  • /proxy:[proto://][user:password@]host[:port] — Proxy settings: override env. var (see also environment variable below). Protocol socks5 should be given explicitly where http is default.
  • /pth:password-hash, /pass-the-hash:password-hash — pass-the-hash, aka restricted admin mode 💅
  • /pwidth:width — physical width of the display, in millimeters (yes, millimeters, it's giving metric system 🎀)
  • /rdp2tcp:executable path[:arg...] — TCP redirection
  • /reconnect-cookie:base64-cookie — hand the connection a base64 reconnect cookie
  • /redirect-prefer:FQDN|IP|NETBIOS,[...] — override the preferred redirection order
  • /relax-order-checks, /relax-order-checks — bestie, this one does NOT check whether an RDP order was announced during capability exchange. Only use it when you're connecting to a buggy server, fr fr
  • /restricted-admin, /restrictedAdmin — restricted admin mode
  • /remoteGuard, /remoteGuard — remote guard credentials
  • /rfx — RemoteFX
  • /rfx-mode:[image|video] — RemoteFX mode
  • /scale:[100|140|180] — scaling factor of the display (default: 100)
  • /scale-desktop:percentage — scaling factor for desktop applications, value between 100 and 500 (default: 100)
  • /scale-device:100|140|180 — scaling factor for app store applications (default: 100)
  • /sec:rdp[:[on|off]]|tls[:[on|off]]|nla[:[on|off]]|ext[:[on|off]]|aad[:[on|off]] — force a specific protocol security. Like, /sec:nla enables NLA and disables all the others, while /sec:nla:[on|off] just toggles NLA 👑
  • /serial[:name[,path[,driver[,permissive]]]], /tty[:name[,path[,driver[,permissive]]]] — redirect a serial device
  • /server-name:name — user-specified server name to use for validation (TLS, Kerberos)
  • /shell:shell — alternate shell
  • /shell-dir:dir — shell working directory
  • /size:widthxheight or percent%[wh] — screen size (default: 1024x768)
  • /smart-sizing:widthxheight|on|off — scale the remote desktop to the window size (default: off)
  • /smartcard[:str[,str...]] — redirect the smartcard devices that have any of the str in their names 🎀
  • /smartcard-logon[:[[cert:path|cert:base64(PEM)],[key:path|key:base64(PEM)],pin:pin,csp:csp name,reader:reader,card:card]] — activates Smartcard (with optional certificate) Logon authentication
  • /sound[:[sys:sys,][dev:dev,][format:format,][rate:rate,][channel:channel,][latency:latency,][quality:quality]], /audio[:[sys:sys,][dev:dev,][format:format,][rate:rate,][channel:channel,][latency:latency,][quality:quality]] — audio output (sound) 🔊
  • /span — span the screen over multiple monitors
  • /spn-class:service-class — SPN authentication service class
  • /ssh-agent, /ssh-agent — SSH Agent forwarding channel
  • /sspi-module:SSPI module path — SSPI shared library module file path
  • /winscard-module:WinSCard module path — WinSCard shared library module file path
  • /disable-output — deactivates ALL graphics decoding in the client session. Genuinely useful for load tests with many simultaneous connections 🔥
  • /t:title, /title:title — window title
  • -themes — themes (default: on)
  • /timeout:time in ms, /timeout:time in ms — advanced setting for high latency links: adjusts the connection timeout, use it if you're getting timeout failures on your connection (default: 9000)
  • /timezone:windows timezone — use the supplied windows timezone for the connection (requires server support), check /list:timezones for the allowed values
  • /tls:[ciphers|seclevel|secrets-file|enforce] — TLS configuration options, and here's the breakdown:
    • ciphers:[netmon|ma|<cipher names>]
    • seclevel:<level>, default: 1, range: [0-5]. Overrides the default TLS security level, might be required for older target servers. Details at https://docs.openssl.org/3.0/man3/SSL_CTX_set_security_level/
    • secrets-file:<filename>
    • enforce[:[ssl3|1.0|1.1|1.2|1.3]] — force the use of a specific SSL/TLS version for a connection. Some servers have buggy TLS version negotiation and might fail without this. Defaults to TLS 1.2 if no argument is supplied. Use 1.0 for windows 7
  • -toggle-fullscreen — Alt+Ctrl+Enter to toggle fullscreen (default: on)
  • /tune:setting:value,setting:value — [experimental] directly manipulates freerdp settings, use with extreme caution! (default: )
⚠️ bestie I'm serious, /tune is not a playground. Extreme caution, no cap.
  • /u:[[domain]user|user[@domain]] — username
  • +unmap-buttons — let the server see the real physical pointer button (default: off)
  • /usb:[dbg,][id:vid:pid#...,][addr:bus:addr#...,][auto] — redirect a USB device
  • /v:server[:port] — server hostname | URL | IPv4 | IPv6, or vsock://<number>, or /some/path/to/pipe, or |:1234 to pass a TCP socket to use
  • /vc:channel[,options] — static virtual channel
  • /version — print version
  • /video — video optimized remoting channel 🎬
  • /prevent-session-lock[:time in sec] — prevents session locking by injecting fake mouse motion events to the server while the connection is idle (default interval: 180 seconds) 🐭
  • /vmconnect[:vmid] — Hyper-V console (use port 2179, disable negotiation)
  • /w:width — width (default: 1024)
  • -wallpaper — wallpaper (default: on)
  • +window-drag — full window drag (default: off)
  • /window-position:xposxypos — window position
  • /wm-class:class-name — sets the WM_CLASS hint for the window instance
  • /workarea — use the available work area

🌸 ENVIRONMENT VARIABLES 🌸

wlog environment variables

sdl-freerdp uses wLog as its log facility, so you can go peek at the matching man page (wlog(7)) for more. Anything you pass through /log-level or /log-filters takes precedence over the environment variables 💅

freerdp environment variables

Lowkey a bunch of the core library's configuration can be set with environment variables too. Consult (freerdp(7)) for the details 🫶

FREERDP_ASKPASS

Sets a program to ask for passwords, similar to SSH_ASKPASS.

FREERDP_WLROOTS_HACK

If defined as 0, it disables the multimonitor detection hack entirely. Set it to 1 to enable it for fullscreen sessions. Set it to force to enable it for all sessions.

💀 WARNING: setting force only works for fullscreen or multimonitor sessions — windowed sessions will start to misbehave!

By default it falls back to detection of sway or other wlroots based compositors by evaluating XDG_SESSION_DESKTOP and XDG_CURRENT_DESKTOP.

Rationale: wlroots based compositors do not expose display information to invisible windows, so we have no proper way to query the current monitor layout. With this hack enabled we fall back and try to determine the resolutions by querying less reliable display resolution and scaling details 🙈

🎀 CONFIGURATION FILE 🎀

Format and Location:

The configuration file is stored per user 🫶

The XDG_CONFIG_HOME environment variable can be used to override the base directory.

This defaults to ~/.config. The location relative to XDG_CONFIG_HOME is $XDG_CONFIG_HOME/freerdp/sdl-freerdp.json

The configuration is stored in JSON format ✨

Supported options:

SDL_KeyModMask

Defines the key combination required for SDL client shortcuts.

Default KMOD_RSHIFT

An array of SDL_Keymod strings as defined at https://wiki.libsdl.org/SDL3/SDL_Keymod — use KEYMOD_NONE to disable hotkeys.

SDL_Fullscreen

Toggles client fullscreen state.

Default SDL_SCANCODE_RETURN.

A string as defined at https://wiki.libsdl.org/SDL3/SDL_Scancode

SDL_Minimize

Minimizes the client window.

Default SDL_SCANCODE_M.

A string as defined at https://wiki.libsdl.org/SDL3/SDL_Scancode

SDL_Resizeable

Toggles local window resizeable state.

Default SDL_SCANCODE_R.

A string as defined at https://wiki.libsdl.org/SDL3/SDL_Scancode

SDL_Grab

Toggles keyboard and mouse grab state.

If the keyboard is grabbed, the local system shortcuts do no longer work and are sent to the remote system.

If the Mouse is grabbed (optional) local gesture detection does not work and the mouse might not be able to leave the RDP window. Mouse events are not altered..

Default SDL_SCANCODE_G.

A string as defined at https://wiki.libsdl.org/SDL3/SDL_Scancode

SDL_Disconnect

Disconnects from the RDP session.

Default SDL_SCANCODE_D.

A string as defined at https://wiki.libsdl.org/SDL3/SDL_Scancode

👑 GLOBAL CONFIGURATION (client common) 👑

Format and Location:

The configuration files are stored in global system configuration.

The common certificate settings location is /etc/FreeRDP/certificates.json

File format is JSON ✨

Supported options:

deny

JSON boolean

Deny the certificate if the check against the system SSL store was not successful.

ignore

JSON boolean

Ignore certificate failures, just ignore the certificate.

deny-userconfig

JSON boolean

If the checks in the global configuration do not accept the certificate, do not ask the user.

certificate-db

JSON array

An array of JSON objects with:

  • type JSON string

a string identifying the hash algorithm used, e.g. sha256

  • hash JSON string

a string of hex integer values representing the certificate hash, e.g. 0123456789abcdef

🌈 GLOBAL CONFIGURATION (SDL3 client) 🌈

The SDL3 client configuration location is /etc/FreeRDP/sdl-freerdp.json

File format is JSON ✨

Supported options:

isUserConfigEnabled

JSON boolean

Allow or block per user configuration file support.

All user level options from CONFIGURATION FILE can be set here too 🫶

✨ EXAMPLES ✨

okay bestie this is the part where it all clicks 💖 these are real, copy-pasteable vibes — go off:

sdl-freerdp connection.rdp /p:Pwd123! /f

Connect in fullscreen mode using a stored configuration connection.rdp and the password Pwd123! 🖥️✨

sdl-freerdp /u:USER /size:50%h /v:rdp.contoso.com

Connect to host rdp.contoso.com with user USER and a size of 50 percent of the height. And listen — if width (w) is set instead of height (h) like /size:50%w, then 50 percent of the width is used instead. either/or, pick your fighter 💅

sdl-freerdp /u:CONTOSO\\JohnDoe /p:Pwd123! /v:rdp.contoso.com

Connect to host rdp.contoso.com with user CONTOSO\\JohnDoe and password Pwd123! 🫶

sdl-freerdp /u:JohnDoe /p:Pwd123! /w:1366 /h:768 /v:192.168.1.100:4489

Connect to host 192.168.1.100 on port 4489 with user JohnDoe, password Pwd123!. The screen width is set to 1366 and the height to 768 🔥

sdl-freerdp /u:JohnDoe /p:Pwd123! /vmconnect:C824F53E-95D2-46C6-9A18-23A5BB403532 /v:192.168.1.100

Establish a connection to host 192.168.1.100 with user JohnDoe, password Pwd123! and connect to the Hyper-V console (use port 2179, disable negotiation) with VMID C824F53E-95D2-46C6-9A18-23A5BB403532 — yeah that's a whole UUID, she's built different 😭👑

+clipboard

Activate clipboard redirection 📋💖

/drive:home,/home/user

Activate drive redirection of /home/user as the home drive 🗂️

/smartcard:<device>

Activate smartcard redirection for device device 💳

/printer:<device>,<driver>

Activate printer redirection for printer device using driver driver 🖨️

/serial:<device>

Activate serial port redirection for port device 🔌

/parallel:<device>

Activate parallel port redirection for port device 🔌

/sound:sys:alsa

Activate audio output redirection using device sys:alsa 🔊

/microphone:sys:alsa

Activate audio input redirection using device sys:alsa 🎤

/multimedia:sys:alsa

Activate multimedia redirection using device sys:alsa 🎬

/usb:id,dev:054c:0268

Activate USB device redirection for the device identified by 054c:0268 🔥

the one and only link, no cap:

http://www.freerdp.com/

👑 AUTHOR 👑

The FreeRDP Team 💜 go follow them, they ate

okay that's the whole page bestie, you're officially a FreeRDP girlie now 🎀✨ this was freerdp — the SDL client — and the page is dated 2026-09-28, manual section sdl-freerdp(1). iykyk 💅 mwah, go connect to something 🦋

📦 where this page comes from