Linux remote desktop to Windows: Remmina, FreeRDP and the ERRCONNECT errors

Short answer: to remote into Windows from Linux, install Remmina with its RDP plugin (sudo apt install remmina remmina-plugin-rdp) or use FreeRDP on the command line: xfreerdp3 /v:203.0.113.10 /u:Administrator /dynamic-resolution /cert:tofu. Windows must be a Pro, Enterprise, Education or Server edition with Remote Desktop switched on, and its RDP port must be reachable from your machine.

# Ubuntu 24.04 and 26.04, Debian 13
sudo apt install -y remmina remmina-plugin-rdp freerdp3-x11
xfreerdp3 /v:203.0.113.10 /u:Administrator /dynamic-resolution +clipboard /cert:tofu

# Fedora
sudo dnf install -y remmina remmina-plugins-rdp freerdp
xfreerdp /v:203.0.113.10 /u:Administrator /dynamic-resolution +clipboard /cert:tofu

Replace 203.0.113.10 with the Windows machine’s address. FreeRDP asks for the password when you leave out /p:, which keeps it out of your shell history. The Linux part of the general RDP guide covers the first connection; this page goes further: Remmina profiles with NLA and a gateway, FreeRDP’s options for monitors, sound and drives, and what each ERRCONNECT error means. It is written from the FreeRDP man pages (xfreerdp 2.10 on Debian 12, xfreerdp3 on Debian 13), FreeRDP’s source for the error names, Remmina’s documentation and the distributions’ package lists, as of October 2026.

Which RDP client should you use on Linux?

rdesktop is still in Debian’s archive, but its own README says the project is no longer maintained, and its last release, 1.9.0, dates from 2019. Old tutorials still use it; use FreeRDP instead, whose options are similar enough that the translation takes a minute.

What Windows needs before you connect

• The right edition. Per Microsoft Learn, Windows Pro, Enterprise and Education accept Remote Desktop connections, and so does Windows Server. Windows Home can connect out, but nobody can connect in.
• Remote Desktop on, and your user allowed. Settings → System → Remote Desktop on a PC; on a server, see enabling RDP on Windows Server. Administrators may always connect; other accounts go in the Remote Desktop Users group.
• A reachable port. TCP 3389 by default. Test from Linux with nc -vz -w 5 203.0.113.10 3389; if that times out, no client setting will help, and Remote Desktop can’t connect goes through the server side.
• Network Level Authentication. It is on by default, and both Remmina and FreeRDP support it, so leave it on. Network Level Authentication explains what it checks.
• From outside the network, a VPN or an SSH tunnel is safer than forwarding port 3389 of a home PC to the internet.

How do you connect with Remmina?

sudo apt install -y remmina remmina-plugin-rdp remmina-plugin-secret     # Debian, Ubuntu
sudo dnf install -y remmina remmina-plugins-rdp remmina-plugins-secret   # Fedora
flatpak install flathub org.remmina.Remmina                               # any distribution

The secret plugin stores saved passwords in your desktop’s keyring instead of in Remmina’s own files. The Flatpak build follows Remmina’s releases more closely than an LTS distribution does.

1. 1Create a profile

   Click the + button for a new connection profile, give it a name and set the protocol to RDP.

2. 2Fill in the Basic tab

   Server takes the IP address or host name, with :13389 after it if RDP listens on another port. Enter the user name and password; leave Domain empty for a local Windows account. Pick a resolution (the client’s own resolution is the easy choice), and add a shared folder here if you want one.

3. 3Check the Advanced tab

   Leave Security protocol negotiation on automatic; pick NLA, TLS or RDP only to test which one fails. Make sure Turn off clipboard sync is not ticked, and set the audio output to local if you want the server’s sound. The Remote Desktop Gateway settings matter only if your company uses one.

4. 4Connect and accept the certificate

   Save and double-click the profile. The first connection shows the server’s certificate; accept it if the fingerprint is the one you expect (see certificate prompts).

How do you connect with FreeRDP from the command line?

The FreeRDP 3 client is called xfreerdp3 on Debian and Ubuntu, so that it can be installed next to FreeRDP 2’s xfreerdp. Fedora ships FreeRDP 3 under the old name. xfreerdp3 /version tells you which one you have.

xfreerdp3 /v:203.0.113.10 /u:Administrator /size:1600x900 /cert:tofu
xfreerdp3 /v:203.0.113.10:13389 /u:alice /d:EXAMPLE /f /cert:tofu     # other port, domain user, full screen
xfreerdp3 /v:203.0.113.10 /u:Administrator /dynamic-resolution +clipboard /drive:share,/home/you/share

Ctrl+Alt+Enter toggles full screen. On Debian 13 and Fedora, the SDL client (sdl-freerdp3 or sdl-freerdp) takes largely the same options and is the one to try on a Wayland desktop if the X11 client misbehaves there.

NLA and the right user name

With NLA, Windows checks the user name and password before it opens a session, so a wrong one ends the connection with an error instead of a Windows login screen. Most failures there come down to the user name format:

• Local account on a standalone server or PC: /u:Administrator, no domain.
• Domain account: /u:alice /d:EXAMPLE, or '/u:EXAMPLE\alice' in single quotes so that the shell keeps the backslash.
• A PC that signs in with a Microsoft account: the account’s e-mail address and its password, not the Windows Hello PIN. If that fails although the password is right, sign in to the PC once with the password itself.

A password with characters the shell treats specially ($, !, quotes) is another reason to leave out /p: and type it at the prompt.

Certificate prompts

Windows protects RDP with a self-signed certificate unless someone installed a real one, so the first connection always asks. FreeRDP prints the certificate’s details, notes that “the above X.509 certificate could not be verified”, and asks Do you trust the above certificate? (Y/T/N): Y stores it, T accepts it for this connection only, N aborts. /cert:tofu stores it without asking the first time. If the certificate later changes, FreeRDP warns:

!!!Certificate for 203.0.113.10:3389 (RDP-Server) has changed!!!
...
The above X.509 certificate does not match the certificate used for previous connections.
This may indicate that the certificate has been tampered with.
Please contact the administrator of the RDP server and clarify.

After a reinstall of Windows that is expected, because a new system makes a new certificate: accept the new one. If nothing changed on the server, do not connect. FreeRDP 3 keeps the accepted certificates under ~/.config/freerdp/server/, one file per host and port; FreeRDP 2 uses ~/.config/freerdp/known_hosts2. Remmina shows the same choice as a dialog.

Monitors, sound, clipboard and drives

Several monitors

/multimon spreads the Windows desktop over all your monitors in full screen. /list:monitor prints their ids, and /monitors:0,1 uses only those. /span instead makes one large desktop across them, which some applications handle better. Remmina offers the same multi-monitor choice in the connection profile.

Sound and microphone

/sound plays the Windows session’s audio on your Linux machine, through PulseAudio or PipeWire’s PulseAudio layer, and /microphone sends your microphone to Windows. If nothing plays from a Windows Server, check that the Windows Audio service is running there: Get-Service Audiosrv in PowerShell, and Set-Service Audiosrv -StartupType Automatic; Start-Service Audiosrv if it is not.

Clipboard

+clipboard shares copy and paste in both directions. When it stops working, the cause is usually on the server; the copy and paste guide walks through the policy and the rdpclip process.

Local folders on the server

/drive:share,/home/you/share makes that folder appear in the Windows session, in File Explorer under This PC and as \\tsclient\share. /home-drive shares your whole home folder. Share only what you need: the Windows side can read and write whatever you redirect, and a compromised server can reach into it.

Connecting through a Remote Desktop Gateway

Companies often put RDP behind a Remote Desktop Gateway, which carries the session inside HTTPS on port 443 and lets only authenticated users through to the machines behind it. Name the target with /v: and the gateway separately:

xfreerdp3 /v:pc42.corp.example.com /u:alice /d:CORP \
  /gateway:g:rdgw.example.com,u:alice,d:CORP /cert:tofu

FreeRDP 2 takes the older /g:, /gu:, /gd: and /gp: options. In Remmina, the profile has its own fields for the gateway server, user, password, domain and transport type (http, rpc or auto).

ERRCONNECT errors and other failures

FreeRDP ends a failed connection with a log line that names the error and its code, for example ERRCONNECT_LOGON_FAILURE [0x00020014]. Remmina reports the same failures in its own words; to see FreeRDP’s name for one, repeat the connection with xfreerdp3 in a terminal and add /log-level:DEBUG if the reason is still unclear. The descriptions below are FreeRDP’s own:

• Wrong characters, such as Y and Z swapped. FreeRDP sends your keyboard layout when the session starts. Pass it explicitly with /kbd:layout:0x00000407 (German here; /list:kbd prints the ids), or set the layout inside Windows.
• Blurry or tiny on a high-resolution screen. Use /dynamic-resolution so that Windows renders at your window’s real size, and /scale-desktop:150 to make Windows draw text and icons larger.

Connecting to a Windows VPS from Linux

A VMHeaven Windows VPS is an ordinary Windows Server, so everything above applies: put its IPv4 address in Remmina or after /v: and sign in as Administrator. If RDP does not answer yet, the VNC console in the panel still shows the screen, which is the way back in after a firewall rule or a changed port. Once it works, the RDP hardening guide is the next step. Going the other way, a desktop on a Linux server that you reach with the same clients, is what xrdp on Ubuntu and Debian sets up.

Frequently asked