XFREERDP(1)

📦 version 2.11.7, in opensuse-leap 16.0

🦋 NAME 🦋

okay bestie, this is xfreerdp(1) — the manual page for xfreerdp, aka the FreeRDP X11 client — and yes, the manual name is literally right there in the title vibe. 💅

🌈 SYNOPSIS 🌈

here’s the tiny summoning spell, no cap:

xfreerdp [file] [options] [/v:server[:port]]

🎀 DESCRIPTION 🎀

xfreerdp is an X11 Remote Desktop Protocol (RDP) client which is part of the FreeRDP project. An RDP server is built-in to many editions of Windows. Alternative servers included xrdp and VRDP (VirtualBox).

✨ OPTIONS ✨

okay bestie, grab a snack — this is the full option menu, no skips, no cap. 🍓

  • /a:addin[,options], /addin:addin[,options] — Addin
  • /action-script:file-name — Action script (default:~/.config/freerdp/action.sh)
  • /admin, /console — Admin (or console) session
  • +aero — desktop composition (default:off)
  • /app:path or ||alias — Remote application program
  • /app-cmd:parameters — Remote application command-line parameters
  • /app-file:file-name — File to open with remote application
  • /app-guid:app-guid — Remote application GUID
  • /app-icon:icon-path — Remote application icon for user interface
  • /app-name:app-name — Remote application name for user interface
  • /app-workdir:workspace path — Remote application workspace path
  • /assistance:password — Remote assistance password
  • /auto-request-control: — Automatically request remote assistance input control
  • +async-channels — Asynchronous channels (experimental) (default:off)
  • +async-input — Asynchronous input (default:off)
  • +async-update — Asynchronous update (default:off)
  • /audio-mode:mode — Audio output mode
  • +auth-only — Authenticate only (default:off)
  • -authentication — Authentication (experimental) (default:on)
  • +auto-reconnect — Automatic reconnection (default:off)
  • /auto-reconnect-max-retries:retries — Automatic reconnection maximum retries, 0 for unlimited [0,1000]
  • +bitmap-cache — bitmap cache (default:off)
  • /bpp:depth — Session bpp (color depth) (default:16)
  • /buildconfig — Print the build configuration
  • /cert:[deny,ignore,name:name,tofu,fingerprint:hash:hash as hex[,fingerprint:hash:another hash]] — Certificate accept options. Use with care!
    • deny — Automatically abort connection if the certificate does not match, no user interaction.
    • ignore — Ignore the certificate checks altogether (overrules all other options)
    • name — Use the alternate <name> instead of the certificate subject to match locally stored certificates
    • tofu — Accept certificate unconditionally on first connect and deny on subsequent connections if the certificate does not match
    • fingerprints — A list of certificate hashes that are accepted unconditionally for a connection
  • /cert-deny — [deprecated, use /cert:deny] Automatically abort connection for any certificate that can not be validated.
  • /cert-ignore — [deprecated, use /cert:ignore] Ignore certificate
  • /cert-name:name — [deprecated, use /cert:name:<name>] Certificate name
  • /cert-tofu — [deprecated, use /cert:tofu] Automatically accept certificate on first connect
  • /client-build-number:number — Client Build Number sent to server (influences smartcard behaviour, see [MS-RDPESC])
  • /client-hostname:name — Client Hostname to send to server
  • /clipboard:[use-selection:atom] — Redirect clipboard.
    • use-selection:<atom> — (X11) Specify which X selection to access. Default is CLIPBOARD. PRIMARY is the X-style middle-click selection. (default:on)
  • /codec-cache:[rfx|nsc|jpeg] — Bitmap codec cache
  • -compression, -z — compression (default:on)
  • /compression-level:level — Compression level (0,1,2)
  • +credentials-delegation — credentials delegation (default:off)
  • /d:domain — Domain
  • -decorations — Window decorations (default:on)
  • /disp — Display control
  • /drive:name,path — Redirect directory <path> as named share <name>. Hotplug support is enabled with /drive:hotplug,*. This argument provides the same function as "Drives that I plug in later" option in MSTSC.
  • +drives — Redirect all mount points as shares (default:off)
  • /dvc:channel[,options] — Dynamic virtual channel
  • /dynamic-resolution — Send resolution updates when the window is resized
  • /echo, /echo — Echo channel
  • -encryption — Encryption (experimental) (default:on)
  • /encryption-methods:[40,][56,][128,][FIPS] — RDP standard security encryption methods
  • /f — Fullscreen mode (<Ctrl>+<Alt>+<Enter> toggles fullscreen)
  • -fast-path — fast-path input/output (default:on)
  • +fipsmode — FIPS mode (default:off)
  • /floatbar[:sticky:[on|off],default:[visible|hidden],show:[always|fullscreen||window]] — floatbar is disabled by default (when enabled defaults to sticky in fullscreen mode)
  • -fonts — smooth fonts (ClearType) (default:on)
  • /frame-ack:number — Number of frame acknowledgement
  • /from-stdin[:force] — Read credentials from stdin. With <force> the prompt is done before connection, otherwise on server request.
  • /g:gateway[:port] — Gateway Hostname
  • /gateway-usage-method:[direct|detect], /gum:[direct|detect] — Gateway usage method
  • /gd:domain — Gateway domain
  • /gdi:sw|hw — GDI rendering
  • /geometry — Geometry tracking channel
  • +gestures — Consume multitouch input locally (default:off)
  • /gfx[:RFX] — RDP8 graphics pipeline
  • +gfx-progressive — RDP8 graphics pipeline using progressive codec (default:off)
  • +gfx-small-cache — RDP8 graphics pipeline using small cache mode (default:off)
  • +gfx-thin-client — RDP8 graphics pipeline using thin client mode (default:off)
  • +glyph-cache — Glyph cache (experimental) (default:off)
  • /gp:password — Gateway password
  • -grab-keyboard — Grab keyboard (default:on)
  • -grab-mouse — Grab mouse (default:on)
  • /gt:[rpc|http[,no-websockets]|auto[,no-websockets]] — Gateway transport type
  • /gu:[[domain\]user|user[@domain]] — Gateway username
  • /gat:access token — Gateway Access Token
  • /h:height — Height (default:768)
  • -heartbeat — Support heartbeat PDUs (default:on)
  • /help, /? — Print help
  • +home-drive — Redirect user home as share (default:off)
  • /ipv6, /6 — Prefer IPv6 AAA record over IPv4 A record
  • /kbd:0xid or name — Keyboard layout
  • /kbd-lang:0xid — Keyboard active language identifier
  • /kbd-fn-key:value — Function key value
  • /kbd-list — List keyboard layouts
  • /kbd-lang-list — List keyboard languages
  • /kbd-remap:List of key=value,... pairs to remap scancodes — Keyboard scancode remapping
  • /kbd-subtype:id — Keyboard subtype
  • /kbd-type:id — Keyboard type
  • /load-balance-info:info-string — Load balance info
  • /log-filters:tag:level[,tag:level[,...]] — Set logger filters, see wLog(7) for details
  • /log-level:[OFF|FATAL|ERROR|WARN|INFO|DEBUG|TRACE] — Set the default log level, see wLog(7) for details
  • /max-fast-path-size:size — Specify maximum fast-path update size
  • /max-loop-time:time — Specify maximum time in milliseconds spend treating packets
  • +menu-anims — menu animations (default:off)
  • /microphone[:[sys:sys,][dev:dev,][format:format,][rate:rate,][channel:channel]], /mic[:[sys:sys,][dev:dev,][format:format,][rate:rate,][channel:channel]] — Audio input (microphone)
  • /monitor-list — List detected monitors
  • /monitors:id[,id[,...]] — Select monitors to use
  • -mouse-motion — Send mouse motion (default:on)
  • /multimon[:force] — Use multiple monitors
  • +multitouch — Redirect multitouch input (default:off)
  • +multitransport — Support multitransport protocol (default:off)
  • -nego — protocol security negotiation (default:on)
  • /network:[modem|broadband|broadband-low|broadband-high|wan|lan|auto] — Network connection type
  • /nsc, /nscodec — NSCodec support
  • +offscreen-cache — offscreen bitmap cache (default:off)
  • /orientation:[0|90|180|270] — Orientation of display in degrees
  • +old-license — Use the old license workflow (no CAL and hwId set to 0) (default:off)
  • /p:password — Password
  • /parallel[:name[,path]] — Redirect parallel device
  • /parent-window:window-id — Parent window id
  • +password-is-pin — Use smart card authentication with password as smart card PIN (default:off)
  • /pcb:blob — Preconnection Blob
  • /pcid:id — Preconnection Id
  • /pheight:height — Physical height of display (in millimeters)
  • /play-rfx:pcap-file — Replay rfx pcap file
  • /port:number — Server port
  • -suppress-output — suppress output when minimized (default:on)
  • +print-reconnect-cookie — Print base64 reconnect cookie after connecting (default:off)
  • /printer[:name[,driver]] — Redirect printer device
  • /proxy:[proto://][user:password@]host:port — Proxy settings: override env. var (see also environment variable below). Protocol "socks5" should be given explicitly where "http" is default.
  • /pth:password-hash, /pass-the-hash:password-hash — Pass the hash (restricted admin mode)
  • /pwidth:width — Physical width of display (in millimeters)
  • /rdp2tcp:executable path[:arg...] — TCP redirection
  • /reconnect-cookie:base64-cookie — Pass base64 reconnect cookie to the connection
  • /redirect-prefer:FQDN|IP|NETBIOS,[...] — Override the preferred redirection order
  • /relax-order-checks, /relax-order-checks — Do not check if a RDP order was announced during capability exchange, only use when connecting to a buggy server
  • /restricted-admin, /restrictedAdmin — Restricted admin mode
  • /rfx — RemoteFX
  • /rfx-mode:[image|video] — RemoteFX mode
  • /scale:[100|140|180] — Scaling factor of the display (default:100)
  • /scale-desktop:percentage — Scaling factor for desktop applications (value between 100 and 500) (default:100)
  • /scale-device:100|140|180 — Scaling factor for app store applications (default:100)
  • /sec:[rdp|tls|nla|ext] — Force specific protocol security
  • +sec-ext — NLA extended protocol security (default:off)
  • -sec-nla — NLA protocol security (default:on)
  • -sec-rdp — RDP protocol security (default:on)
  • -sec-tls — TLS protocol security (default:on)
  • /serial[:name[,path[,driver[,permissive]]]], /tty[:name[,path[,driver[,permissive]]]] — Redirect serial device
  • /shell:shell — Alternate shell
  • /shell-dir:dir — sets the shell working directory, bestie. Which directory the shell starts in. That's it, that's the whole vibe 🐚
  • /size:widthxheight or percent%[wh] — screen size, lowkey the main character of window setup. Default is 1024x768. You can also do the percent thing: %h for percent of height, %w for percent of width ✨
  • /smart-sizing[:widthxheight] — scales the remote desktop to your window size. Resize away, icon 💅
  • /smartcard[:str[,str...]] — redirects the smartcard devices that have any of the <str> in their names. Picky but in a good way 🎀
  • /smartcard-logon — activates Smartcard Logon authentication. Heads up: this one is marked EXPERIMENTAL: NLA not supported — so like, it's giving beta energy, don't @ me if NLA's a no 😭
  • /sound[:[sys:sys,][dev:dev,][format:format,][rate:rate,][channel:channel,][latency:latency,][quality:quality]], /audio[:[sys:sys,][dev:dev,][format:format,][rate:rate,][channel:channel,][latency:latency,][quality:quality]] — audio output (sound). Two spellings, same slay 🔉
  • /span — spans the screen over multiple monitors. Multi-monitor girlies rise 🖥️🖥️
  • /spn-class:service-class — the SPN authentication service class. Fancy auth stuff, iykyk 🔐
  • /ssh-agent, /ssh-agent — SSH Agent forwarding channel. (Yes, it's listed twice in here — iconic of it, honestly 🫶)
  • /t:title, /title:title — sets the window title. Name your window something cute ✨
  • -themes — themes. Default is on, so this bad boy starts enabled and you're toggling it off 💅
  • /timeout:time in ms, /timeout:time in ms — advanced setting for high latency links: adjust the connection timeout, and use this if you keep hitting timeout failures with your connection. Default is 9000. (Also listed twice. We love a repetitive queen 👑)
  • /tls-ciphers:[netmon|ma|ciphers] — allowed TLS ciphers. Keep your crypto cute and correct 🔒
  • /tls-seclevel:level — TLS security level. Defaults to 1, and the default value is 1. So... 1. Ngl, very consistent of it 🌸
  • +enforce-tlsv1_2 — forces TLS1.2 for the connection. Some servers have a buggy TLS version negotiation and will straight-up fail without this. Default is off 💀
  • -toggle-fullscreen — Alt+Ctrl+Enter toggles fullscreen. Default is on 🖵
  • /tune:setting:value,setting:value — [experimental] directly manipulates freerdp settings. Use with extreme caution! For real, this is the "trust me bro, I know what I'm doing" option 🙈 Default is empty 🫠
  • /tune-list — prints the options allowed for /tune. Your cheat sheet 📋
  • /u:[[domain\]user|user[@domain]] — username. Pick your format, bestie 👤
  • +unmap-buttons — lets the server see the real physical pointer button. Default is off 🖱️
  • /v:server[:port] — server hostname. The who-and-where of it all 🗺️
  • /vc:channel[,options] — static virtual channel. Very niche, very valid 💜
  • /version — prints the version. Shoutout to knowing what you're running ✨
  • /video — video optimized remoting channel. Smooth frames only 🎬
  • /vmconnect[:vmid] — Hyper-V console. Use port 2179, disable negotiation 🖥️
  • /w:width — width. Default is 1024 📏
  • -wallpaper — wallpaper. Default is on 🖼️
  • +window-drag — full window drag. Default is off 🪟
  • /window-position:xposxypos — window position. Place her wherever she belongs 📍
  • /wm-class:class-name — sets the WM_CLASS hint for the window instance. Window manager girlies, this one's for you 💅
  • /workarea — uses the available work area 🗂️

🌈 ENVIRONMENT VARIABLES 🌈

the wlog environment variable, bestie

xfreerdp uses wLog as its log facility, and you can refer to the corresponding man page — wlog(7) — for more informations (yes, "informations", we're keeping it 💖).

Important bit, no cap: arguments passed via /log-level or /log-filters have precedence over the environment variables. So the flags win the argument, every time 🫶

✨ EXAMPLES ✨

Okay this is the part where it all comes together. Buckle up, we're doing the whole runway 🦋

  • xfreerdp connection.rdp /p:Pwd123! /f — connect in fullscreen mode using a stored configuration connection.rdp and the password Pwd123! 🖵
  • xfreerdp /u:USER /size:50%h /v:rdp.contoso.com — connect to host rdp.contoso.com with user USER and a size of 50 percent of the height. If width (w) is set instead of height (h) — like /size:50%w — then 50 percent of the width is used 📐
  • xfreerdp /u:CONTOSO\\JohnDoe /p:Pwd123! /v:rdp.contoso.com — connect to host rdp.contoso.com with user CONTOSO\\JohnDoe and password Pwd123! 👑
  • xfreerdp /u:JohnDoe /p:Pwd123! /w:1366 /h:768 /v:192.168.1.100:4489 — connect to host 192.168.1.100 on port 4489 with user JohnDoe, password Pwd123!. The screen width is set to 1366 and the height to 768 📏
  • the Hyper-V console moment, which honestly needs its own code block:
xfreerdp /u:JohnDoe /p:Pwd123!
/vmconnect:C824F53E-95D2-46C6-9A18-23A5BB403532 /v:192.168.1.100

Establish a connection to host 192.168.1.100 with user JohnDoe, password Pwd123! and connect to Hyper-V console (use port 2179, disable negotiation) with VMID C824F53E-95D2-46C6-9A18-23A5BB403532 🧚

  • +clipboard — activates clipboard redirection. Copy-paste girlies, we ate 📋
  • /drive:home,/home/user — activates drive redirection of /home/user as the home drive 💾
  • /smartcard:<device> — activates smartcard redirection for device device 🎀
  • /printer:<device>,<driver> — activates printer redirection for printer device using driver driver 🖨️
  • /serial:<device> — activates serial port redirection for port device 🔌
  • /parallel:<device> — activates parallel port redirection for port device 🧵
  • /sound:sys:alsa — activates audio output redirection using device sys:alsa 🔊
  • /microphone:sys:alsa — activates audio input redirection using device sys:alsa 🎤
  • /multimedia:sys:alsa — activates multimedia redirection using device sys:alsa 🎬
  • /usb:id,dev:054c:0268 — activates USB device redirection for the device identified by 054c:0268 🔥

http://www.freerdp.com/ — go say hi 🌸

👑 AUTHOR 👑

The FreeRDP Team — absolute legends, no notes 🫶

And that's the whole page, bestie! 💖 You officially know more about xfreerdp than like 90% of the people who use it. Go forth and connect ✨

This lil manual page is from the freerdp source and it's dated 2026-04-14 — so if you're reading this in the far future, hi, hope the RDP still slaps 🌈⭐💅

📦 where this page comes from