sdl-freerdp3(1)

📦

version 3.16.0 · 4 versions

✨ NAME ✨

sdl-freerdp3 — the FreeRDP SDL client 💖

Like, that's the whole name section. Short, sweet, iconic, no notes.

🌸 SYNOPSIS 🌸

sdl-freerdp3 [file] [options] [/v:server[:port]]

💅 DESCRIPTION 💅

okay so bestie, sdl-freerdp3 is an SDL Remote Desktop Protocol (RDP) client, and it's part of the FreeRDP project 🖥️✨

And here's the tea: an RDP server is built-in to many editions of Windows 🪟 so you might not even need to install one. But if you do, the alternative servers out there include ogon, gnome-remote-desktop, xrdp and VRDP (VirtualBox) 💁‍♀️

🎀 OPTIONS 🎀

okay buckle up bestie, there's a LOT here. every single one, no skips, let's go 🏃‍♀️💨

/a:addin[,options], /addin:addin[,options] — Addin 🧩
/azure:[tenantid:id],[use-tenantid[:[on|off]],[ad:url][avd-access:format string],[avd-token:format string],[avd-scope:format string] — AzureAD options ☁️
/action-script:file-name — Action script, and the default is ~/.config/freerdp/action.sh 📜
/admin, /console — Admin (or console) session 👑
+aero — desktop composition, and it's off by default 🪟
/app:program:[path|||alias],cmd:command,file:filename,guid:guid,icon:filename,name:name,workdir:directory,hidef:[on|off] — Remote application program 📱
/assistance:password — Remote assistance password 🤝
/auto-request-control: — Automatically request remote assistance input control 🎮
+async-channels — Asynchronous channels, and heads up it's experimental, off by default 🧪
+async-update — Asynchronous update, off by default 🔄
/audio-mode:mode — Audio output mode 🔊
+auth-only — Authenticate only, off by default 🔐
/auth-pkg-list:!ntlm,kerberos — Authentication package filter. It's a comma-separated list, and you use ! to exclude stuff 🚫
-authentication — Authentication, experimental, and it's on by default ✨
+auto-reconnect — Automatic reconnection, off by default 🔁
/auto-reconnect-max-retries:retries — Automatic reconnection maximum retries. 0 means unlimited, and the range is [0,1000] 🔢
/bpp:depth — Session bpp (color depth), default is 16 🎨
/buildconfig — Print the build configuration 🛠️
/cache:[bitmap[:on|off],codec[:rfx|nsc],glyph[:on|off],offscreen[:on|off],persist,persist-file:filename]
/cert:[deny,ignore,name:name,tofu,fingerprint:hash:hash as hex[,fingerprint:hash:another hash]] — Certificate accept options. Use with care! 😬
- deny ... Automatically abort connection if the certificate does not match, no user interaction. 🙅‍♀️
- ignore ... Ignore the certificate checks altogether (overrules all other options) 💀
- name ... Use the alternate <name> instead of the certificate subject to match locally stored certificates 🏷️
- tofu ... Accept certificate unconditionally on first connect and deny on subsequent connections if the certificate does not match 🫣
- fingerprints ... A list of certificate hashes that are accepted unconditionally for a connection 🫆
/client-build-number:number — Client Build Number sent to server. it influences smartcard behaviour, see [MS-RDPESC] 💳
/client-hostname:name — Client Hostname to send to server 🏠
/clipboard:[[use-selection:atom],[direction-to:[all|local|remote|off]],[files-to[:all|local|remote|off]]] — Redirect clipboard 📋:
- use-selection:<atom> ... (X11) Specify which X selection to access. Default is CLIPBOARD. PRIMARY is the X-style middle-click selection. 🖱️
- direction-to:[all|local|remote|off] control enabled clipboard direction ↔️
- files-to:[all|local|remote|off] control enabled file clipboard direction (default:on) 📁
-compression, -z — compression, on by default 🗜️
/compression-level:level — Compression level, and the options are 0,1,2 📊
+credentials-delegation — credentials delegation, off by default 🤲
/d:domain — Domain 🌐
-decorations — Window decorations, on by default 🖼️
/disp — Display control 🖥️
/drive:name,path — Redirect directory <path> as named share <name>. Hotplug support is enabled with /drive:hotplug,*. This argument provides the same function as "Drives that I plug in later" option in MSTSC 💾
+drives — Redirect all mount points as shares, off by default 🗂️
/dump:record|replay,file:file[,nodelay] — record or replay dump 🎥
/dvc:channel[,options] — Dynamic virtual channel 🛰️
+dynamic-resolution — Send resolution updates when the window is resized, off by default 📐
/echo, /echo — Echo channel 📢
-encryption — Encryption, experimental, on by default 🔒
/encryption-methods:[40,][56,][128,][FIPS] — RDP standard security encryption methods 🛡️
/f — Fullscreen mode, and <Ctrl>+<Alt>+<Enter> toggles fullscreen 🖥️✨
+fipsmode — FIPS mode, off by default 🇺🇸
/floatbar[:sticky:[on|off],default:[visible|hidden],show:[always|fullscreen|window]] — floatbar is disabled by default, and when you enable it, it defaults to sticky in fullscreen mode 🎚️
-fonts — smooth fonts (ClearType), on by default 🔤
+force-console-callbacks — Use default callbacks (console) for certificate/credential/... , off by default 🎛️
/frame-ack:number — Number of frame acknowledgement 🖞
/args-from:file|stdin|fd:number|env:name — Read command line from a file, stdin or file descriptor. This argument can not be combined with any other. Provide one argument per line 📄
/from-stdin[:force] — Read credentials from stdin. With <force> the prompt is done before connection, otherwise on server request ⌨️
/gateway:g:gateway[:port],u:user,d:domain,p:password,usage-method:[direct|detect],access-token:token,type:[rpc|http[,no-websockets][,extauth-sspi-ntlm]|auto[,no-websockets][,extauth-sspi-ntlm]]|arm,url:wss://url,bearer:oauth2-bearer-token, — Gateway Hostname 🚪
/gw:g:gateway[:port],u:user,d:domain,p:password,usage-method:[direct|detect],access-token:token,type:[rpc|http[,no-websockets][,extauth-sspi-ntlm]|auto[,no-websockets][,extauth-sspi-ntlm]]|arm,url:wss://url,bearer:oauth2-bearer-token — Gateway Hostname 🚪
/gdi:sw|hw — GDI rendering 🎨
/geometry — Geometry tracking channel 📏
+gestures — Consume multitouch input locally, off by default 👆
/gfx[:[progressive[:on|off]|RFX[:on|off]|AVC420[:on|off]AVC444[:on|off]],mask:value,small-cache[:on|off],thin-client[:on|off],progressive[:on|off]]] — RDP8 graphics pipeline 🌈
-grab-keyboard — Grab keyboard focus, forward all keys to remote, on by default ⌨️
-grab-mouse — Grab mouse focus, forward all events to remote, on by default 🖱️
/h:height — Height, default is 768 📏
-heartbeat — Support heartbeat PDUs, on by default 💓
/help, /? — Print help 🆘
+home-drive — Redirect user home as share, off by default 🏡
/ipv4[:[:force]], /4[:[:force]] — Prefer IPv4 A record over IPv6 AAAA record 4️⃣
/ipv6[:[:force]], /6[:[:force]] — Prefer IPv6 AAAA record over IPv4 A record 6️⃣
/jpeg — JPEG codec support 🖼️
/jpeg-quality:percentage — JPEG quality ✨
/kbd:[layout:[0xid|name],lang:0xid,fn-key:value,type:value,subtype:value,unicode[:on|off],remap:key1=value1,remap:key2=value2,pipe:filename] — Keyboard related options ⌨️:
- layout: set the keyboard layout announced to the server 🗺️
- lang: set the keyboard language identifier sent to the server 🌍
- fn-key: Function key value 🔑
- remap: RDP scancode to another one. Use /list:kbd-scancode to get the mapping. Example: To switch 'a' and 's' on a US keyboard: /kbd:remap:0x1e=0x1f,remap:0x1f=0x1e 🔀
- pipe: Name of a named pipe that can be used to type text into the RDP session 🪈
/kerberos:[kdc-url:url,lifetime:time,start-time:time,renewable-lifetime:time,cache:path,armor:path,pkinit-anchors:path,pkcs11-module:name] — Kerberos options 🎫
/load-balance-info:info-string — Load balance info ⚖️
/list:[kbd|kbd-scancode|kbd-lang[:value]|smartcard[:[pkinit-anchors:path][,pkcs11-module:name]]|monitor|tune|timezones] — List available options for subcommand (default:List available options for subcommand) 📋
/log-filters:tag:level[,tag:level[,...]] — Set logger filters, see wLog(7) for details 📝
/log-level:[OFF|FATAL|ERROR|WARN|INFO|DEBUG|TRACE] — Set the default log level, see wLog(7) for details 📊
/max-fast-path-size:size — Specify maximum fast-path update size 🚀
/max-loop-time:time — Specify maximum time in milliseconds spend treating packets ⏱️
+menu-anims — menu animations, off by default ✨
/microphone[:[sys:sys,][dev:dev,][format:format,][rate:rate,][channel:channel]], — Audio input (microphone) 🎤
/mic[:[sys:sys,][dev:dev,][format:format,][rate:rate,][channel:channel]] — Audio input (microphone) 🎤
/monitors:id[,id[,...]] — Select monitors to use, and ngl it's only effective in fullscreen or multimonitor mode 🖥️🖥️
-mouse-motion — Send mouse motion events, on by default 🖱️
+mouse-relative — Send mouse motion with relative addressing, off by default 🖱️
/mouse:[relative:[on|off],grab:[on|off]] — Mouse related options 🐭:
- relative: send relative mouse movements if supported by server ↔️
- grab: grab the mouse if within the window ✊
/multimon[:force] — Use multiple monitors 🖥️🖥️
+multitouch — Redirect multitouch input, off by default 👆
-multitransport — Support multitransport protocol, on by default 🚚
-nego — protocol security negotiation, on by default 🤝
/network:[invalid|modem|broadband|broadband-low|broadband-high|wan|lan|auto] — Network connection type 📶
/nsc, /nscodec — NSCodec support 🎞️
/orientation:[0|90|180|270] — Orientation of display in degrees 🔄
+old-license — Use the old license workflow (no CAL and hwId set to 0), off by default 📜
/p:password — Password 🔑
/parallel[:name[,path]] — Redirect parallel device 🖨️
/parent-window:window-id — Parent window id 🪟
/pcb:blob — Preconnection Blob 🫧
/pcid:id — Preconnection Id 🆔
/pheight:height — Physical height of display (in millimeters) 📐
/play-rfx:pcap-file — Replay rfx pcap file ▶️
/port:number — Server port 🔌
-suppress-output — suppress output when minimized, on by default 🤫
+print-reconnect-cookie — Print base64 reconnect cookie after connecting, off by default 🍪
/printer[:name[,driver[,default]]] — Redirect printer device 🖨️
/proxy:[proto://][user:password@]host[:port] — Proxy settings: override env. var (see also environment variable below). Protocol "socks5" should be given explicitly where "http" is default 🧦
/pth:password-hash, /pass-the-hash:password-hash — Pass the hash (restricted admin mode) 🥷
/pwidth:width — Physical width of display (in millimeters) 📐
/rdp2tcp:executable path[:arg...] — TCP redirection 🔀
/reconnect-cookie:base64-cookie — Pass base64 reconnect cookie to the connection 🍪
/redirect-prefer:FQDN|IP|NETBIOS,[...] — Override the preferred redirection order 🔃
/relax-order-checks, /relax-order-checks — do NOT check that an RDP order was announced during capability exchange. literally only use this when you're connecting to a buggy server 🐛
/restricted-admin, /restrictedAdmin — restricted admin mode ✨
/remoteGuard, /remoteGuard — remote guard credentials 🛡️
/rfx — RemoteFX 💫
/rfx-mode:[image|video] — RemoteFX mode 🎬
/scale:[100|140|180] — scaling factor of the display (default: 100) 🔍
/scale-desktop:percentage — scaling factor for desktop applications, value has to be between 100 and 500 (default: 100) 🖥️
/scale-device:100|140|180 — scaling factor for app store applications (default: 100) 📱
/sec:[rdp[:[on|off]]|tls[:[on|off]]|nla[:[on|off]]|ext[:[on|off]]|aad[:[on|off]]] — force a specific protocol security, bestie. e.g. /sec:nla enables NLA and disables all the others, while /sec:nla:[on|off] just toggles NLA 🔐
/serial[:name[,path[,driver[,permissive]]]], /tty[:name[,path[,driver[,permissive]]]] — redirect a serial device 🔌
/server-name:name — user-specified server name to use for validation (TLS, Kerberos) 🏷️
/shell:shell — alternate shell 🐚
/shell-dir:dir — shell working directory 📁
/size:widthxheight or percent%[wh] — screen size (default: 1024x768) 📐
/smart-sizing[:widthxheight] — scale the remote desktop to the window size 🪟
/smartcard[:str[,str...]] — redirect the smartcard devices that contain any of the str in their names 💳
/smartcard-logon[:[cert:path,key:key,pin:pin,csp:csp name,reader:reader,card:card]] — activates Smartcard (optional certificate) Logon authentication 🔑
/sound[:[sys:sys,][dev:dev,][format:format,][rate:rate,][channel:channel,][latency:latency,][quality:quality]], /audio[:[sys:sys,][dev:dev,][format:format,][rate:rate,][channel:channel,][latency:latency,][quality:quality]] — audio output (sound) 🔊
/span — span the screen over multiple monitors 🖥️🖥️
/spn-class:service-class — SPN authentication service class 🎫
/ssh-agent, /ssh-agent — SSH Agent forwarding channel 🧚
/sspi-module:SSPI module path — SSPI shared library module file path 📚
/winscard-module:WinSCard module path — WinSCard shared library module file path 📚
/disable-output — deactivate ALL graphics decoding in the client session. super useful for load tests with a ton of simultaneous connections 🔥
/t:title, /title:title — window title ✨
-themes — themes (default: on) 🎨
/timeout:time in ms, /timeout:time in ms — advanced setting for high latency links: adjust the connection timeout, use this if you keep hitting timeout failures on your connection (default: 9000) ⏱️
/timezone:windows timezone — use the supplied windows timezone for the connection (requires server support), peep /list:timezones for the allowed values 🌍
/tls:[ciphers|seclevel|secrets-file|enforce] — TLS configuration options:
- ciphers:[netmon|ma|<cipher names>]
- seclevel:<level>, default: 1, range: [0-5] — override the default TLS security level, might be required for older target servers
- secrets-file:<filename>
- enforce[:[ssl3|1.0|1.1|1.2|1.3]] — force use of a specific SSL/TLS version for a connection. some servers have buggy TLS version negotiation and might fail without this. defaults to TLS 1.2 if no argument is supplied. use 1.0 for windows 7 💀
-toggle-fullscreen — Alt+Ctrl+Enter to toggle fullscreen (default: on) 🖼️
/tune:setting:value,setting:value — [experimental] directly manipulate freerdp settings. use with EXTREME caution! (default: ) ⚠️

bestie I am not joking about that one, /tune is giving mad scientist energy 🧪

/u:[[domain]user|user[@domain]] — username 👤
+unmap-buttons — let the server see the real physical pointer button (default: off) 🖱️
/usb:[dbg,][id:vid:pid#...,][addr:bus:addr#...,][auto] — redirect a USB device 🔌
/v:server[:port] — server hostname | URL | IPv4 | IPv6, or /some/path/to/pipe, or |:1234 to pass a TCP socket to use 🌐
/vc:channel[,options] — static virtual channel 📡
/version — print version 📌
/video — video optimized remoting channel 🎥
/prevent-session-lock[:time in sec] — prevent session locking by injecting fake mouse motion events to the server when the connection is idle (default interval: 180 seconds) 🐭
/vmconnect[:vmid] — Hyper-V console (use port 2179, disable negotiation) 🖥️
/w:width — width (default: 1024) 📏
-wallpaper — wallpaper (default: on) 🖼️
+window-drag — full window drag (default: off) ✋
/window-position:xposxypos — window position 📍
/wm-class:class-name — set the WM_CLASS hint for the window instance 🏷️
/workarea — use available work area 🧩

🎀 CONFIGURATION FILE 🎀

📂 Format and Location

The configuration file is stored per user, bestie.

The XDG_CONFIG_HOME environment variable can be used to override the base directory.

This defaults to ~/.config. The location relative to XDG_CONFIG_HOME is $XDG_CONFIG_HOME/freerdp/sdl-freerdp.json

The configuration is stored in JSON format 💾

✨ Supported options

`SDL_KeyModMask`

Defines the key combination required for SDL client shortcuts.

Default KMOD_RSHIFT

An array of SDL_Keymod strings as defined at /SDL_Keymod ⌨️

`SDL_Fullscreen`

Toggles client fullscreen state.

Default SDL_SCANCODE_RETURN.

A string as defined at /SDLScancodeLookup 🖼️

`SDL_Minimize`

Minimizes the client window

Default SDL_SCANCODE_M.

A string as defined at /SDLScancodeLookup ➖

`SDL_Resizeable`

Toggles local window resizeable state.

Default SDL_SCANCODE_R.

A string as defined at /SDLScancodeLookup ↔️

`SDL_Grab`

Toggles keyboard and mouse grab state. If the keyboard is grabbed the local system shortcuts do no longer work and are sent to the remote system. If the Mouse is grabbed (optional) local gesture detection does not work and the mouse might not be able to leave the RDP window. Mouse events are not altered..

Default SDL_SCANCODE_G.

A string as defined at /SDLScancodeLookup 🖱️

`SDL_Disconnect`

Disconnects from the RDP session.

Default SDL_SCANCODE_D.

A string as defined at /SDLScancodeLookup 🚪

🌈 ENVIRONMENT VARIABLES 🌈

`wlog` environment variable

sdl-freerdp3 uses wLog as its log facility, you can refer to the corresponding man page (wlog(7)) for more info. Arguments passed via the /log-level or /log-filters have precedence over the environment variables 👑

💜 GLOBAL CONFIGURATION 💜

📂 Format and Location

The configuration file is stored in global system configuration.

The location is /etc/FreeRDP/FreeRDP/certificates.json

File format is JSON 💾

✨ Supported options

`deny`

JSON boolean

Deny the certificate if the check against the system SSL store was not successful 🚫

`ignore`

JSON boolean

Ignore certificate failures, just ignore the certificate 🙈

`deny-userconfig`

JSON boolean

If the checks in the global configuration do not accept the certificate do not ask the user 🤐

`certificate-db`

JSON array

An array of JSON objects with:

type — JSON string
- a string identifying the hash algorithm used, e.g. sha256
hash — JSON string
- a string of hex integer values representing the certificate hash, e.g. 0123456789abcdef

🌸 EXAMPLES 🌸

sdl-freerdp3 connection.rdp /p:Pwd123! /f

Connect in fullscreen mode using a stored configuration connection.rdp and the password Pwd123! 🖥️

sdl-freerdp3 /u:USER /size:50%h /v:rdp.contoso.com

Connect to host rdp.contoso.com with user USER and a size of 50 percent of the height. If width (w) is set instead of height (h) like /size:50%w. 50 percent of the width is used. 📐

sdl-freerdp3 /u:CONTOSO\\JohnDoe /p:Pwd123! /v:rdp.contoso.com

Connect to host rdp.contoso.com with user CONTOSO\\JohnDoe and password Pwd123! 🔐

sdl-freerdp3 /u:JohnDoe /p:Pwd123! /w:1366 /h:768 /v:192.168.1.100:4489

Connect to host 192.168.1.100 on port 4489 with user JohnDoe, password Pwd123!. The screen width is set to 1366 and the height to 768 🖥️

sdl-freerdp3 /u:JohnDoe /p:Pwd123!
/vmconnect:C824F53E-95D2-46C6-9A18-23A5BB403532 /v:192.168.1.100

Establish a connection to host 192.168.1.100 with user JohnDoe, password Pwd123! and connect to the Hyper-V console (use port 2179, disable negotiation) with VMID C824F53E-95D2-46C6-9A18-23A5BB403532 🧚

+clipboard

Activate clipboard redirection 📋

/drive:home,/home/user

Activate drive redirection of /home/user as home drive 💾

/smartcard:<device>

Activate smartcard redirection for device device 💳

/printer:<device>,<driver>

Activate printer redirection for printer device using driver driver 🖨️

/serial:<device>

Activate serial port redirection for port device 🔌

/parallel:<device>

Activate parallel port redirection for port device 🧷

/sound:sys:alsa

Activate audio output redirection using device sys:alsa 🔊

/microphone:sys:alsa

Activate audio input redirection using device sys:alsa 🎤

/multimedia:sys:alsa

Activate multimedia redirection using device sys:alsa 🎬

/usb:id,dev:054c:0268

Activate USB device redirection for the device identified by 054c:0268 🔌

🔗 LINKS 🔗

http://www.freerdp.com/ ⭐

👑 AUTHOR 👑

The FreeRDP Team 💖

okay bestie that's the whole thing, no cap 🫶 this is sdl-freerdp3(1) from the freerdp source, dated 2026-06-12 — go forth and remote desktop, you absolute icon 💅✨

📦 where this page comes from

ubuntu questing: freerdp3-sdl 3.16.0+dfsg-2ubuntu0.5
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-10-18: a language model's rewrite of the original, under its terms

sdl-freerdp3(1)

✨ NAME ✨

🌸 SYNOPSIS 🌸

💅 DESCRIPTION 💅

🎀 OPTIONS 🎀

🎀 CONFIGURATION FILE 🎀

📂 Format and Location

✨ Supported options

SDL_KeyModMask

SDL_Fullscreen

SDL_Minimize

SDL_Resizeable

SDL_Grab

SDL_Disconnect

🌈 ENVIRONMENT VARIABLES 🌈

wlog environment variable

💜 GLOBAL CONFIGURATION 💜

📂 Format and Location

✨ Supported options

deny

ignore

deny-userconfig

certificate-db

🌸 EXAMPLES 🌸

🔗 LINKS 🔗

👑 AUTHOR 👑

`SDL_KeyModMask`

`SDL_Fullscreen`

`SDL_Minimize`

`SDL_Resizeable`

`SDL_Grab`

`SDL_Disconnect`

`wlog` environment variable

`deny`

`ignore`

`deny-userconfig`

`certificate-db`