Remote Desktop (RDP)

Beta. Remote Desktop is in beta and free. Known gaps: remote cursor shapes (for example resize cursors), audio, drive redirection and multiple monitors. Feedback is welcome.

Connect to Windows computers over Remote Desktop from inside Kubexer Terminal. The remote desktop opens in a normal tab, next to your terminals and SFTP browsers. You don't need any other software on macOS or Windows. Remote Desktop is free. Only connecting through a jump host needs Pro.

Add an RDP host

Open a vault and add a host (or edit one).
At the top of the form, switch the protocol from SSH to Remote Desktop (RDP). The port changes to 3389, and the SSH-only sections (keys, agent, X11, environment) are hidden.
Enter the Address, the Username and the Password. You can also pick a saved identity, as long as it uses a password. Key-based identities can't sign in to Windows.
If the account belongs to a Windows domain, fill in Domain (for example CORP). Leave it empty for a local account or a Microsoft account.
Adjust RDP settings if you need to, then save.

RDP hosts sync, group, tag and search exactly like SSH hosts. On the host card they carry an RDP badge, and the main action opens a Remote Desktop tab.

You can also type rdp://host or rdp://user@host:port in Quick connect. Kubexer asks for the password, saves the host to a vault, and opens it. Unlike SSH quick connect, an RDP host is always saved.

First connect and the certificate

Windows protects Remote Desktop with a self-signed certificate, so it can't be checked against a certificate authority. Instead, the first time you connect Kubexer shows the certificate's subject, its SHA-256 fingerprint and its expiry date, and asks you to trust it. Choose Trust & connect to pin it on the host.

On every later connect the certificate must match. If it has changed, you get a warning with the old and new fingerprints. That's normal after Windows is reinstalled or its certificate is renewed, but it can also mean someone is intercepting the connection. Only choose Trust the new certificate & connect if you expected the change. This works the same way as SSH host keys.

Settings

Setting	What it does
Resolution	Fit window resizes the remote desktop whenever the tab or window changes size. Fixed size keeps one size, from 800×600 up.
Scale	Fit scales the desktop into the tab. Real size shows it pixel for pixel and scrolls when it's bigger. You can also switch this from the tab's toolbar.
Display scale	How sharp the picture is. Standard is the default and fastest. Sharp sends Retina-sharp pixels at double scale, so text stays the same size but there are about 4× the pixels. Match follows the screen you're on. Hover the ⓘ icon for a summary. See below.
Text size	100 % (default), 125 %, 150 %, 175 % or 200 %. Makes text and icons in Windows bigger, like Windows' own scale setting. See Text size.
Resolution limit	High, the default, caps the remote desktop at about 2.2 megapixels and scales it up to fill the tab: sharp and smooth. Balanced caps it at about 1.4 megapixels: smoothest. Native uses the tab's full size: sharpest, but heaviest on large screens. Only shown for Fit window. See below.
Experience	Which Windows visuals the session shows: Default, Best quality, Balanced, Low bandwidth or Custom. See Experience. Applies on the next connect.
Colour depth	Only with the Custom experience. Auto (default) leaves it to Remote Desktop; 16-bit, 24-bit or 32-bit sets it yourself. See Colour depth. Applies on the next connect.
Network Level Authentication	Auto signs in before the desktop opens (NLA) and falls back to TLS when the server has NLA turned off. Off is only for servers that refuse NLA. Windows then asks for the password on its own sign-in screen.
Clipboard sync	Copy and paste text and images between this computer and the remote desktop. On by default. Turning it off also turns off file transfer.
File transfer	Copy files and folders both ways through the clipboard. See Copying files. On by default. Only available while Clipboard sync is on.
Auto-copy files up to	macOS. Files you copy in Windows up to this size (500 MB by default) go straight onto your Mac clipboard, so ⌘V in Finder pastes them. Bigger copies use Save…. Set it to 0 to always use Save….
Use ⌘ as Ctrl	macOS only. See Keyboard.

Standard or Sharp

On a Retina or other HiDPI screen, Standard draws the remote desktop at normal size. Text is slightly soft, but it's smooth and uses the least bandwidth. Sharp asks Windows for a desktop with twice the pixels in each direction at 200 % scaling. Text is crisp, but there are roughly four times as many pixels to send and draw, so scrolling and video can get choppy.

To try Sharp without editing the host, use the Std / Sharp switch in the tab's toolbar. It applies straight away and only lasts for that tab. The switch only appears on HiDPI screens, when the resolution is Fit window.

Balanced, High or Native

The work of drawing the remote desktop grows with its number of pixels. A full-screen tab on a large monitor can ask Windows for well over three megapixels, and dragging a window around then gets choppy. High, the default, keeps the remote desktop at up to about 2.2 megapixels and scales it up to fill the tab: sharp, and still noticeably lighter than the full size. Smaller tabs are under the limit and aren't changed.

Balanced goes further, to about 1.4 megapixels, roughly what a normal-sized tab uses. The picture is a little softer, but it moves the most smoothly; pick it on slower computers. Choose Native when you need every pixel, for example for small text or detailed images on a big screen.

On a 2560×1440 monitor in full screen, the tab is 2560×1321 and each setting asks Windows for:

Setting	Remote desktop
Balanced	about 1646×849
High	about 2064×1065
Native	2560×1321

The limit applies to Sharp too, so for really sharp text on a large Retina screen use Sharp together with Native. Both cost more to draw.

To switch without editing the host, use the Bal / High / Native switch in the tab's toolbar. It applies straight away and only lasts for that tab, including after Reconnect. It only appears when the resolution is Fit window.

Experience

Experience decides which Windows visuals the remote desktop shows. Fewer visuals mean less to send, so the desktop feels faster on a slow link. The presets follow the Experience tab of Microsoft's own Remote Desktop client:

Preset	Wallpaper	Themes	Font smoothing	Desktop composition	Window contents while dragging	Animations	Cursor shadow
Default	on	on	on	off	off	off	on
Best quality	on	on	on	on	on	on	on
Balanced	off	on	on	off	off	off	on
Low bandwidth	off	off	off	off	off	off	off

Default is what every host uses until you change it, and it's exactly how Remote Desktop looked before this setting existed.
Best quality suits a fast local network. Low bandwidth suits slow connections, an RD Gateway or a long chain of jump hosts.
Custom shows a checkbox for each visual, plus a Colour depth choice. When you switch to it, the boxes start from the preset you had selected, so you only change what you need.

Windows can still override some of these with its own policies, for example a wallpaper set by group policy.

Colour depth

Colour depth is how many bits each pixel uses. It's a Custom option: the presets leave it to Remote Desktop. Auto, the default, doesn't ask for one. In principle 16-bit needs the least bandwidth but can show bands in gradients and photos, while 24-bit and 32-bit look smoother. In practice Windows usually compresses the screen with RemoteFX whatever depth you pick, so it rarely changes what you see. If you switch away from Custom, the colour depth is dropped when you save.

The experience and colour depth are sent once, when the session starts. A change applies on the next connect: save the host, then click Reconnect in an open tab (or open a new one). There's no toolbar switch for them.

Keyboard

While the remote desktop has focus, keys go to Windows and Kubexer's own shortcuts are paused. Keys are sent by their position on the keyboard, so the keyboard layout chosen in Windows decides which characters you get.

⌘ as Ctrl (macOS). With Use ⌘ as Ctrl on (the default), ⌘ acts as Ctrl, so ⌘C, ⌘V, ⌘X, ⌘A, ⌘Z, ⌘F and ⌘S do what you'd expect. Option is Alt. With the option off, ⌘ is the Windows key.
Special keys. Some combinations never reach an app, because your own computer grabs them first. Use the toolbar buttons instead: Ctrl+Alt+Del (the Windows security screen), Win (Start menu), Alt+Tab (switch remote apps) and Win+R (Run).
Give the keyboard back. Press ⌘+Ctrl+Option on macOS or Ctrl+Alt+Shift on Windows to release the keyboard without using the mouse. Clicking anywhere outside the desktop, or switching tabs, does the same. Click the desktop to capture the keyboard again.
Caps Lock and Num Lock are synced with Windows each time the desktop gets focus.

Full screen

Click the full-screen button at the right of the tab's toolbar. The Kubexer window goes full screen and the remote desktop fills it, with only its toolbar at the top. Esc goes to Windows like any other key, so it closes dialogs and menus over there instead of leaving full screen.

To leave full screen:

Click the same toolbar button.
On macOS, press ⌃⌘F or use the green window button. While the remote desktop has the keyboard, ⌃⌘F goes to Windows too, so release the keyboard first with ⌘+Ctrl+Option.

Switching to another tab, disconnecting or closing the tab also leaves full screen. If the Kubexer window was already full screen before you clicked the button, it stays full screen and only the remote desktop's layout changes back.

On macOS, full screen keeps a strip clear at the top for the menu bar, which slides down when your pointer reaches the top edge. Alternatively, set System Settings → Control Center → Automatically hide and show the menu bar to Never so the menu bar stays put instead of sliding over the window.

Clipboard

With Clipboard sync on, text and images flow both ways:

Copy text or an image on Windows (for example in Paint or the Snipping Tool), then paste it on this computer.
Copy text or an image on this computer (a screenshot, for example), then click into the remote desktop (or switch back to Kubexer) and paste it on Windows.

Images travel as PNG, up to 32 MB. A bigger image isn't copied, and Kubexer tells you so. Turn Clipboard sync off on a host to keep its clipboard and yours completely separate. That also turns off file transfer.

Copying files

With File transfer on (the default), you can copy files and folders in both directions with the usual copy and paste keys:

From Windows to your Mac. Copy files or folders in File Explorer (Ctrl+C, or ⌘C with Use ⌘ as Ctrl). A bar under the toolbar shows what was copied, for example 3 files in 1 folder copied in Windows. If the copy is within the Auto-copy files up to limit (500 MB by default), Kubexer copies it to your Mac right away. The bar shows Copying 3 files to your Mac clipboard… 40%, then on your Mac clipboard, paste in Finder with ⌘V. Open a Finder window and press ⌘V.
Bigger copies, or a folder of your choice. Click Save… in the same bar, pick a folder (Downloads is suggested), and the files are saved there with their folder structure. Save… is always there, also for copies that were copied to your clipboard. A copy over the limit shows too large to auto-copy, use Save…. The bar shows progress for each file and overall, and you can Cancel. When it's done, Show in Finder (or Show in folder) opens the result. Existing files are never overwritten: a name that's already taken gets a number, as in report (1).pdf.
From your Mac to Windows. Copy files or folders in Finder with ⌘C, click into the remote desktop (or switch back to Kubexer), then paste in File Explorer with Ctrl+V (⌘V with Use ⌘ as Ctrl). Kubexer says when the files are ready, and the bar shows the progress while Windows copies them.
Drag and drop still works. Drag files or folders from Finder (or Explorer) onto the remote desktop, then paste in File Explorer. You can paste the same files again while the bar is showing.

Good to know:

Copying something else, on either side, replaces the files on offer. Copy them again if you still need them. If you copy something new in Windows while an earlier copy is still on its way to your Mac clipboard, the earlier one is stopped.
Files copied to your Mac clipboard are kept in a temporary folder only while the Remote Desktop tab is open. After you close the tab or quit Kubexer, paste them again from Windows, or use Save… to keep a copy.
Copying from Windows straight to the clipboard needs macOS. On Windows and Linux, use Save…. Copying in Explorer or a Linux file manager and pasting in the remote desktop works for one file at a time; drag several files onto the desktop instead.
When you copy a folder on your Mac, up to 1000 items and 32 folder levels are sent. Links that point outside the copied folder, and items Kubexer can't read, are left out, and Kubexer tells you.
Windows keeps copied files available for a limited time. If a large save stops with The copy in Windows expired, copy the files in Windows again and click Save… again.
Files are streamed straight to disk, so their size doesn't matter for memory. Large files take as long as your connection needs.
Names that Windows doesn't allow (such as a:b.txt) get a _ instead of the bad character on the way to Windows. On the way here, names are cleaned so that nothing can be written outside the folder you picked.

In a Windows domain (Active Directory), Remote Desktop can sign you in with Kerberos instead of NTLM. Some companies require it, because they block or audit NTLM. It's free, like the rest of Remote Desktop.

Kerberos is off until you set it up, so existing hosts keep signing in exactly as before. To turn it on, open the host, and under the Domain field open Domain sign-in (Kerberos):

Domain: the domain's DNS name, for example lab.test or corp.example. The short name (LAB, CORP) only works for NTLM.
Server name (FQDN): the Windows computer's full name, for example win11.lab.test. Kerberos identifies the server by this name, so an IP address doesn't work. The Address can stay an IP: Kubexer still connects to the address, and uses the server name only for sign-in.
Sign-in: Auto (the default) uses Kerberos as soon as the server name and a DNS domain are set, and NTLM otherwise. NTLM never uses Kerberos. Kerberos also warns you when Windows fell back to NTLM.
KDC: where Kerberos requests go (the domain controller, or KDC). Auto uses the domain's own name on port 88 (lab.test:88), which reaches a domain controller in most networks. Host names a specific domain controller, for example dc1.lab.test or 10.0.0.10:88. Proxy URL sends requests to a company KDC proxy, for example https://kdc.corp.example/KdcProxy.

The user name can be written as alice, alice@lab.test or LAB\alice.

Kubexer must be able to reach the domain controller on port 88. Any of these works:

You're on the company network, or on a VPN.
The host uses Jump hosts: Kerberos requests then go through the same SSH tunnel as Remote Desktop, and the bastion reaches the domain controller.
Your company runs a KDC proxy (HTTPS). Use Proxy URL.

Which method was used

When a host has domain sign-in set up, the Remote Desktop toolbar shows a small Kerberos or NTLM badge once you're connected. Windows falls back to NTLM on its own when Kerberos doesn't work, so the badge is the only way to tell. Hosts without domain sign-in show no badge.

If it shows NTLM

The server name doesn't match. It must be the computer's own name in the domain (the service name TERMSRV/<name> must exist). On the domain controller, setspn -L <computer> (or samba-tool spn list <computer>$) lists the names. An IP address or an alias always falls back to NTLM.
The clock is off. Kerberos needs this computer's clock within 5 minutes of the domain controller's.
The domain controller can't be reached. Check the VPN, the jump hosts, or set KDC to a specific Host.
The domain is the short name. Use the DNS name (lab.test), not LAB.

With Sign-in set to Kerberos, a message names the likely cause when Kubexer can tell.

Through a jump host (Pro)

If the Windows computer can only be reached from behind a Linux bastion, add that bastion to the RDP host's Jump hosts, just as for SSH. Kubexer opens the jump chain and runs Remote Desktop through the SSH tunnel. Nothing needs to be installed on the bastion beyond SSH.

This uses the Jump Chains feature, so it needs Kubexer Pro. A Windows computer you can reach directly works on the free plan. If a hop drops in the middle of a session, the tab shows SSH tunnel lost with a Reconnect button.

RD Gateway (Beta)

Many companies don't expose Windows computers directly. Instead they publish them through a Remote Desktop Gateway (RD Gateway): one HTTPS address, such as https://gateway.corp.example, that lets signed-in users reach internal computers. Kubexer can connect through it, like Microsoft's Remote Desktop app does. It's free, like the rest of Remote Desktop.

To use it, open the RDP host, and under the Domain field open RD Gateway:

Gateway address: the gateway your IT team gave you, for example https://gateway.corp.example. A bare name means HTTPS on port 443. Leave it empty to connect directly. Hosts without a gateway connect exactly as before.
Address: the Windows computer as the gateway knows it, usually its name on the company network (win11.corp.example). The gateway's resource policy decides which names are allowed.
Gateway sign-in: Auto (the default) uses NTLM when the gateway offers it, and Basic otherwise. NTLM never sends the password itself. Basic sends the user name and password, protected by the gateway's HTTPS connection.
Gateway credentials: Same as host signs in to the gateway with the host's own user name and password, which is what most company gateways expect. Custom uses a separate user name, password and optional domain.

The gateway password is stored with the host, encrypted in your vault, and it's only used to sign in to the gateway. Windows itself still checks your password (NLA) after the gateway has let you through. The toolbar shows via and the gateway's name while you're connected through it.

The gateway's certificate

A gateway normally has a certificate from a public certificate authority, and then there's nothing to confirm. If your company uses its own certificate authority, or the gateway uses a self-signed certificate, Kubexer shows the gateway's certificate the first time and asks you to trust it, just like a Windows certificate. It's then pinned on the host. A certificate that isn't valid for the gateway's name is always refused.

Notices from the gateway

Some gateways show a notice (for example acceptable-use terms) before they connect you. Kubexer shows it with Accept & connect and Decline. Declining, or not answering within two minutes, cancels the connection. Messages from the gateway's administrator appear as notifications.

If the gateway refuses

Rejected the gateway user name or password: the gateway sign-in failed. Check the gateway credentials (or the host's, with Same as host).
Connection policy (RD CAP): your account or device isn't allowed to use the gateway. Ask your IT team.
Resource policy (RD RAP): the gateway doesn't allow this computer. Check that the Address is the name your IT team expects, not an IP.
Doesn't offer NTLM sign-in: the gateway only allows a method Kubexer doesn't support yet, such as smart card or web sign-in.

Gateway limits

The gateway support is in beta:

Only the WebSocket transport is supported (Windows Server 2016 and later). The older HTTP and RPC transports aren't supported yet.
Gateway sign-in is NTLM or Basic. NTLM uses a standard library that doesn't send the newer integrity checks (MIC or channel binding), so a gateway that requires Extended Protection refuses it.
Kerberos sign-in to the gateway, multi-factor or web sign-in (PAA, Entra ID, Azure Virtual Desktop) and smart cards aren't supported.
It has been tested against the open-source gateway rdpgw, not yet against Microsoft's own RD Gateway. Please report any gateway that doesn't work.

macOS: Local Network permission

macOS doesn't let apps reach computers on your local network or in a virtual machine until you allow it. If a connection to a LAN address or a VM fails with Can't reach the server, open System Settings → Privacy & Security → Local Network and turn on Kubexer Terminal. Then reconnect. The same permission applies to SSH hosts on your local network.

Background renderer (Beta)

Normally every Remote Desktop tab is drawn on the same thread as the rest of the app. One busy session, such as a video or a large screen at Native, can keep that thread almost fully busy, and several busy tabs then compete for it.

To try drawing each tab on its own background thread instead, open Settings → Terminal → Remote Desktop and turn on Render Remote Desktop in the background. It's off by default and applies to this computer only.

It takes effect the next time a tab connects. Tabs that are already open keep the renderer they started with, so press Reconnect to switch one.
Everything else works the same: input, the clipboard, copying files, the display settings and the error messages.
Each tab runs separately, so if one tab's session crashes, the others keep running.
If the background renderer can't start, the tab connects the usual way and Kubexer shows a notification.

If a tab looks or behaves wrong with it on, turn it off, reconnect, and let us know.

When something goes wrong

The tab tells you what failed and offers Reconnect:

Sign-in failed: the user name or password is wrong.
Sign-in refused: Windows refused the account. It may be locked, disabled, have an expired password, or be outside its allowed logon hours.
Access denied: the account isn't allowed to use Remote Desktop. Add it to the server's Remote Desktop Users group.
Connection refused: Remote Desktop is off on that computer, the port is wrong, or a firewall blocks it.
NLA required: the server insists on Network Level Authentication. Set the host's NLA option to Auto.
Certificate not trusted: you cancelled the certificate prompt.

Limits

No sound, microphone, drive or printer redirection, or multiple monitors yet. To move files, use Copying files.
Clipboard images are limited to 32 MB.
Video and fast-moving screens need a lot of bandwidth, because Kubexer doesn't use H.264 yet. Remote Desktop works best for admin work rather than watching media, especially over a slow link.
Azure AD (Entra ID) sign-in and smart cards aren't supported. RD Gateway support is in beta, see its limits.
RDP tabs can't be split into panes, recorded or used by Kubexy.