mstsc command: every Remote Desktop switch, custom ports and .rdp file settings

mstsc (short for Microsoft Terminal Services Client) is the command behind Remote Desktop Connection, the RDP client built into every edition of Windows. Run on its own it opens the familiar connection window; with switches it connects straight to a server, opens in full screen or across several monitors, joins the administrative session, shadows another user, or opens a saved .rdp file for editing. This guide lists every switch Microsoft documents today, says which old ones no longer work, and explains the .rdp file settings you will actually want to change.

mstsc is only the client. The computer you connect to must have Remote Desktop switched on and allowed through its firewall, and Windows Home editions can connect out but never accept an RDP connection. To set up the other end, see how to enable RDP on Windows Server.

What switches does mstsc have?

The full syntax from Microsoft’s command reference, with optional parts in square brackets:

mstsc.exe [<connectionfile>] [/v:<server>[:<port>]] [/g:<gateway>] [/admin]
          [/f[ullscreen]] [/w:<width> /h:<height>] [/public] [/span] [/multimon]
          [/l] [/restrictedAdmin] [/remoteGuard] [/prompt]
          [/shadow:<sessionID> [/control] [/noConsentPrompt]]
mstsc.exe /edit <connectionfile>

Two switches you will still find in older guides are gone. /console stopped working with Remote Desktop Connection 6.1 in 2008 (next section). /migrate, which converted connection files from the Windows 2000 era Client Connection Manager, is no longer in Microsoft’s reference. If a switch from an old script does nothing, run mstsc /? on that PC: the dialog lists exactly what its version understands.

How do I connect to a different port with mstsc?

Put the port after the address with a colon. The same form works in the Computer field of the window and in the full address line of an .rdp file:

mstsc /v:203.0.113.10:13389
mstsc /v:rdp.example.com:13389 /f

Without a port, mstsc uses 3389. A host name only works if your PC can resolve it, through DNS or an entry in the hosts file; otherwise use the IP address. If the connection fails on a custom port, check that the server really listens there and that its firewall allows that port, not only 3389: changing the port in the registry does not open it in Windows Firewall.

Full screen, window size and multiple monitors

mstsc /v:203.0.113.10 /f                # full screen on the current monitor
mstsc /v:203.0.113.10 /w:1600 /h:900    # window of 1600 x 900 pixels
mstsc /v:203.0.113.10 /multimon         # use every monitor, each one separately
mstsc /v:203.0.113.10 /span             # one wide desktop over all monitors
mstsc /l                                # list monitor IDs for selectedmonitors

In a session, Ctrl+Alt+Pause switches between window and full screen, and Ctrl+Alt+End sends Ctrl+Alt+Del to the server (the Ctrl+Alt+Del in Remote Desktop guide has the Mac and laptop variants). The text after # above is a PowerShell comment; in Command Prompt, leave it out, because cmd would hand it to mstsc as an argument.

/span and /multimon sound alike but build different desktops:

To use two of three monitors, run mstsc /l, note the IDs it shows, and put them in the connection file as selectedmonitors:s:1,2 together with use multimon:i:1. The monitors you pick must sit next to each other, and the first ID becomes the remote primary monitor.

What does mstsc /admin do, and what happened to /console?

Up to Windows Server 2003, mstsc /console connected you to the server’s physical console, session 0. Windows Server 2008 moved services into session 0 and stopped letting users sign in there, so Remote Desktop Connection 6.1 (Windows Vista SP1, Windows Server 2008, Windows XP SP3) replaced the switch with /admin, which connects to the session meant for administering the server. Microsoft’s KB 947723 describes how an old /console behaves today:

• On the command line it is ignored without a warning: you get a normal session, not an error. Scripts that still use it look as if they work.
• Typed into the Computer field of the window, it fails with an unknown parameter error.
• In an .rdp file, the old “connect to console” setting is ignored. The setting that counts now is administrative session:i:1.

In an /admin session the server does not use Remote Desktop licensing, so it needs no RDS CAL. Time zone redirection, Session Broker redirection, Plug and Play device redirection and Easy Print are switched off for that session, and the theme falls back to Windows Classic. Against a Windows Server 2003 machine, /admin still lands on the physical console, which is why older guides treat the two switches as one. On a Windows Server without the Remote Desktop Session Host role, two administrators can be connected at the same time either way; for more users at once, see multiple RDP sessions on Windows Server.

rem old, silently ignored since 2008
mstsc /v:203.0.113.10 /console
rem current
mstsc /v:203.0.113.10 /admin

How do I shadow a session with mstsc /shadow?

Shadowing lets an administrator watch, or with /control also operate, the session of another user on the same server, for support or training. It needs administrator rights on the server, and Windows asks the user for permission unless policy says otherwise.

1. 1Find the session ID

   On the server, or remotely with /server:, list the sessions and note the number in the ID column of the user you want to see:

   query session
   query session /server:203.0.113.10

2. 2Start the shadow session

   mstsc /v:203.0.113.10 /shadow:3
   mstsc /v:203.0.113.10 /shadow:3 /control

   The first line only watches, the second also hands you mouse and keyboard. The user sees a prompt and has to accept. On a single server, the simplest route is to connect over RDP as Administrator and run mstsc /shadow:3 /control inside that session, without /v.

3. 3Skip the prompt only where policy allows it

   /noConsentPrompt works only if Set rules for remote control of Remote Desktop Services user sessions is set to one of the “without user’s permission” options. It sits in the Group Policy editor under Computer Configuration, Administrative Templates, Windows Components, Remote Desktop Services, Remote Desktop Session Host, Connections. Its other options are no remote control, full control or view only with the user’s permission.

Shadowing from another PC also needs the server’s firewall to allow it; Windows Server has a built-in rule for it in the Remote Desktop group, Remote Desktop - Shadow (TCP-In). Use it only with the user’s knowledge: watching someone’s screen without telling them can break workplace and privacy law, whatever the policy setting allows.

Restricted Admin, Remote Credential Guard and saved passwords

A normal RDP login sends your password to the server, which keeps it in memory for the session. Two switches avoid that, with different trade-offs:

• /restrictedAdmin logs you in without handing over your credentials. In the session, you reach other servers as the server itself, not as you. It needs an account in the server’s Administrators group and has to be allowed on the server: the policy Remote host allows delegation of nonexportable credentials, or the registry value DisableRestrictedAdmin set to 0 under HKLM\SYSTEM\CurrentControlSet\Control\Lsa.
• /remoteGuard (Remote Credential Guard) also keeps the password on your PC but sends Kerberos requests back to it, so single sign-on from the session still works. The server must be joined to an Active Directory domain and both sides must authenticate with Kerberos; a lone VPS in a workgroup cannot use it. The server also needs the same delegation policy as Restricted Admin.

To save a password for a server once, without typing it on the command line, store it in Credential Manager with cmdkey. With /pass and no value, it asks for the password instead of keeping it in your shell history:

cmdkey /generic:TERMSRV/203.0.113.10 /user:Administrator /pass
mstsc /v:203.0.113.10

rem list and remove saved RDP credentials
cmdkey /list
cmdkey /delete:TERMSRV/203.0.113.10

After a server reinstall with a new password, delete the old entry first, or mstsc keeps sending the old one. On a PC that others use, connect with /public and do not save credentials at all. For the server side of the same problem, see the Windows RDP security checklist.

.rdp files: create, edit and the settings that matter

An .rdp file is a plain text file, one setting per line in the form name:type:value, where the type is s for text and i for a number. The quickest way to make one is the window itself: run mstsc, click Show Options, set the address and the tabs, then Save As. Windows saves it in your Documents folder unless you pick another place. To change it later, open it with mstsc /edit or in Notepad.

Where is Default.rdp?

Every user has a hidden Default.rdp in Documents. It holds the settings of the last connection made from the plain mstsc window, which is why the window opens with your last server and screen size. If Documents is synced to OneDrive, the file lives in the OneDrive copy. This finds it either way:

$docs = [Environment]::GetFolderPath('MyDocuments')
Get-Item -Force "$docs\Default.rdp"
notepad "$docs\Default.rdp"

Deleting Default.rdp resets the window to its factory settings; mstsc writes a fresh one on the next connection.

The .rdp settings worth knowing

A complete file for one server looks like this. Save it as server.rdp and double-click it, or start it with mstsc server.rdp:

full address:s:203.0.113.10:3389
username:s:Administrator
screen mode id:i:1
desktopwidth:i:1600
desktopheight:i:900
dynamic resolution:i:1
use multimon:i:0
redirectclipboard:i:1
drivestoredirect:s:
redirectprinters:i:0
audiomode:i:0
autoreconnection enabled:i:1
authentication level:i:2

Keep drivestoredirect empty unless you need it: a redirected drive lets the server read and write files on your PC. The file never needs to hold your password; keep that in Credential Manager as shown above.

Why does Windows warn when I open an .rdp file?

Since the April 2026 security update (CVE-2026-26151), Remote Desktop Connection shows a security dialog every time you open an .rdp file, before it connects. Attackers had been mailing .rdp files that connect to their own server and share the victim’s drives and clipboard. The dialog shows the remote address and one check box per resource the file asks for, and all of them start switched off: the clipboard line in your file only takes effect once you tick it there. An unsigned file is labeled “Caution: Unknown remote connection”; a file signed with rdpsign and a code signing certificate shows its publisher instead. The first time after the update, an extra dialog explains RDP files once per account.

Typing a computer name directly into Remote Desktop Connection is unchanged, per Microsoft. Administrators can bring back the old dialog for a while with the registry value RedirectionWarningDialogVersion = 1 under HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\Client, but Microsoft warns that a later update may remove that switch. Never open an .rdp file you did not expect, even from a known sender.

How do I run mstsc from PowerShell or a script?

mstsc is a window program, so the prompt returns at once while the session keeps running. Use Start-Process -Wait when a script has to wait until the window closes:

# connect and wait until the RDP window is closed
Start-Process mstsc -ArgumentList '/v:203.0.113.10', '/f' -Wait

# open one window per server
'203.0.113.10', '203.0.113.11:13389' | ForEach-Object {
    Start-Process mstsc -ArgumentList "/v:$_"
}

# write an .rdp file and open it
@(
  'full address:s:203.0.113.10:3389'
  'username:s:Administrator'
  'screen mode id:i:1'
  'redirectclipboard:i:1'
) | Set-Content -Path "$env:USERPROFILE\Desktop\server.rdp" -Encoding Unicode
mstsc "$env:USERPROFILE\Desktop\server.rdp"

From a batch file, start "" /wait mstsc /v:203.0.113.10 does the same as -Wait. Quote every path that contains a space, such as a file on the desktop of a user whose name has one. For many servers, a saved file per server or a manager such as RDCMan is easier to keep tidy than a long script.

How do I clear the mstsc connection history?

The Computer drop-down keeps up to ten recent servers in the registry under HKCU\Software\Microsoft\Terminal Server Client\Default (values MRU0 to MRU9). The Servers key next to it holds one subkey per server with the last user name and the accepted certificate. Close all Remote Desktop windows first, then:

# forget the recent servers in the Computer list
Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Terminal Server Client\Default' -Name 'MRU*'

# forget the user name and certificate of one server
Remove-Item -Path 'HKCU:\Software\Microsoft\Terminal Server Client\Servers\203.0.113.10' -Recurse

That empties the drop-down, but the window can still open with the last server filled in: the hidden Default.rdp keeps it in its full address line. Delete that file too; mstsc writes a fresh one on the next connection:

Remove-Item -Force "$([Environment]::GetFolderPath('MyDocuments'))\Default.rdp"

The saved password lives elsewhere, in Credential Manager; remove it with cmdkey /delete:TERMSRV/203.0.113.10. The taskbar and Start menu Jump List of Remote Desktop Connection keeps recent servers as well: right-click an entry there and choose Remove from this list.

Is mstsc.exe safe, and what if it does not start?

The real mstsc.exe is part of Windows and lives in C:\Windows\System32, with a 32-bit copy in C:\Windows\SysWOW64 on 64-bit Windows. A file of that name anywhere else, for example in a Temp or AppData folder, is not the Windows program and deserves a malware scan. Check the location and the signature in PowerShell:

Get-Command mstsc | Select-Object Source
Get-AuthenticodeSignature C:\Windows\System32\mstsc.exe | Format-List Status, SignerCertificate

Status : Valid with a Microsoft certificate means the file is genuine. If mstsc crashes or will not open at all, repair the system files from an administrator prompt with sfc /scannow; if that reports files it could not fix, run DISM /Online /Cleanup-Image /RestoreHealth and then sfc /scannow again.

mstsc connects to anything that speaks RDP, including a Windows 10 or 11 PC patched with RDP Wrapper. If that PC refuses every connection, see RDP Wrapper says Not listening.

Frequently asked