2026.1.0.8-1 RDP issues

Hello

The errors related to OpenH264 are benign, it's an optional component that'll be loaded at runtime if it's found (and enabled in RDM). Unfortunately, FreeRDP logs the failure to locate the binary at ERROR level when really it should be INFO or at least WARN. This has been a bit of a headache for us as it's commonly misinterpreted, so I'll try and raise that with the upstream project when I have chance.

That doesn't solve your problem, which sounds strange. I think the first thing to rule out is a connection problem (although realistically any further errors should've been caught when you checked journalctl).

Can you try launching RDM with the environment variable WLOG_LEVEL set to DEBUG or TRACE, recreate the problem, and share the resulting log data with me?

Thanks and kind regards,

Just now seeing your reply, I installed 2025.3.2.3-1 and it works with the old version; see output attached as old version log.

Reinstalling 2026.1.0.8-1 now.


Here's what I get export WLOG_LEVEL="DEBUG"
remotedesktopmanager
MESA: warning: Support for this platform is experimental with Xe KMD, bug reports may be ignored.
[09:55:50:681] [84828:00014b67] [DEBUG][com.winpr.timezone] - [winpr_get_timezone_from_link]: tzid: America/New_York
[09:55:50:681] [84828:00014b67] [DEBUG][com.winpr.timezone] - [winpr_get_timezone_from_link]: tzid: America/New_York
[09:55:50:681] [84828:00014b67] [DEBUG][com.winpr.timezone] - [winpr_get_timezone_from_link]: tzid: America/New_York
[09:55:50:681] [84828:00014b67] [DEBUG][com.winpr.timezone] - [winpr_get_timezone_from_link]: tzid: America/New_York
[09:55:50:690] [84828:00014b67] [INFO][Devolutions.Rdp.Credentials] - [Parse]: parsing "b******", "c***********" (Mstsc) => "Username: "b******" Domain: "c***********""
[09:55:50:691] [84828:00014b67] [DEBUG][com.freerdp.core] - [freerdp_connect_begin]: resetting error state
[09:55:50:691] [84828:00014b67] [DEBUG][com.freerdp.client.common.cmdline] - [freerdp_client_load_static_channel_addin]: loading channelEx rdpdr
[09:55:50:691] [84828:00014b67] [DEBUG][com.freerdp.client.common.cmdline] - [freerdp_client_load_static_channel_addin]: loading channelEx rdpsnd
[09:55:50:691] [84828:00014b67] [DEBUG][com.freerdp.client.common.cmdline] - [freerdp_client_load_static_channel_addin]: loading channelEx RDMJump
[09:55:50:691] [84828:00014b67] [DEBUG][com.freerdp.client.common.cmdline] - [freerdp_client_load_static_channel_addin]: loading channelEx RDMCmd
[09:55:50:691] [84828:00014b67] [DEBUG][com.freerdp.client.common.cmdline] - [freerdp_client_load_static_channel_addin]: loading channelEx RDMLog
[09:55:50:691] [84828:00014b67] [DEBUG][com.freerdp.channels.cliprdr.client] - [cliprdr_VirtualChannelEntryEx]: VirtualChannelEntryEx
[09:55:50:691] [84828:00014b67] [DEBUG][com.freerdp.client.common.cmdline] - [freerdp_client_load_static_channel_addin]: loading channelEx cliprdr
[09:55:50:691] [84828:00014b67] [DEBUG][com.freerdp.channels.drdynvc.client] - [drdynvc_VirtualChannelEntryEx]: VirtualChannelEntryEx
[09:55:50:691] [84828:00014b67] [DEBUG][com.freerdp.client.common.cmdline] - [freerdp_client_load_static_channel_addin]: loading channelEx drdynvc
[09:55:50:692] [84828:00014b67] [DEBUG][com.freerdp.settings] - [log_monitor_configuration]: [BEGIN] MonitorDefArray[1]
[09:55:50:692] [84828:00014b67] [DEBUG][com.freerdp.settings] - [log_monitor]: [0] [primary] {0x0-1974x953} [0] {1000x1000, orientation: 0, desktopScale: 100, deviceScale: 100}
[09:55:50:692] [84828:00014b67] [DEBUG][com.freerdp.settings] - [log_monitor_configuration]: [END] MonitorDefArray[1]
[09:55:50:692] [84828:00014b67] [DEBUG][com.freerdp.client.common.cmdline] - [freerdp_client_load_static_channel_addin]: loading channelEx rdpdr
[09:55:50:692] [84828:00014b67] [DEBUG][com.freerdp.client.common.cmdline] - [freerdp_client_load_static_channel_addin]: loading channelEx rdpsnd
[09:55:50:692] [84828:00014b67] [DEBUG][com.freerdp.client.common.cmdline] - [freerdp_client_load_static_channel_addin]: loading channelEx RDMJump
[09:55:50:692] [84828:00014b67] [DEBUG][com.freerdp.client.common.cmdline] - [freerdp_client_load_static_channel_addin]: loading channelEx RDMCmd
[09:55:50:692] [84828:00014b67] [DEBUG][com.freerdp.client.common.cmdline] - [freerdp_client_load_static_channel_addin]: loading channelEx RDMLog
[09:55:50:692] [84828:00014b67] [DEBUG][com.freerdp.channels.cliprdr.client] - [cliprdr_VirtualChannelEntryEx]: VirtualChannelEntryEx
[09:55:50:692] [84828:00014b67] [DEBUG][com.freerdp.client.common.cmdline] - [freerdp_client_load_static_channel_addin]: loading channelEx cliprdr
[09:55:50:692] [84828:00014b67] [DEBUG][com.freerdp.channels.drdynvc.client] - [drdynvc_VirtualChannelEntryEx]: VirtualChannelEntryEx
[09:55:50:692] [84828:00014b67] [DEBUG][com.freerdp.client.common.cmdline] - [freerdp_client_load_static_channel_addin]: loading channelEx drdynvc
[09:55:50:693] [84828:00014b67] [ERROR][com.freerdp.channels.virtual.channel] - [virtchan_virtual_channel_init_event_ex]: Unhandled event type 0
[09:55:50:693] [84828:00014b67] [ERROR][com.freerdp.channels.virtual.channel] - [virtchan_virtual_channel_init_event_ex]: Unhandled event type 0
[09:55:50:693] [84828:00014b67] [ERROR][com.freerdp.channels.virtual.channel] - [virtchan_virtual_channel_init_event_ex]: Unhandled event type 0
[09:55:50:693] [84828:00014b67] [DEBUG][com.freerdp.primitives] - [primitives_autodetect_best]: primitives benchmark: only one backend, skipping...
[09:55:50:693] [84828:00014b67] [DEBUG][com.freerdp.primitives] - [primitives_autodetect_best]: primitives autodetect, using optimized
[09:55:50:695] [84828:00014b67] [DEBUG][com.freerdp.codec] - [openh264_library_path_from_environment]: no environment variable 'FREERDP_OPENH264_LIBRARY_PATH'
[09:55:50:695] [84828:00014b67] [DEBUG][com.freerdp.codec] - [openh264_init]: No FREERDP_OPENH264_LIBRARY_PATH set, using default search
[09:55:50:696] [84828:00014b67] [INFO][com.freerdp.codec] - [openh264_load_functionpointers]: loaded libopenh264.so.7 2.6.0
[09:55:50:710] [84828:00014b67] [INFO][com.freerdp.codec] - [openh264_load_functionpointers]: loaded libopenh264.so.7 2.6.0
[09:55:50:712] [84828:00014b67] [WARN][com.freerdp.core.rdp] - [log_build_warn][0x7fc1d8057d30]: *************************************************
[09:55:50:712] [84828:00014b67] [WARN][com.freerdp.core.rdp] - [log_build_warn][0x7fc1d8057d30]: This build is using [runtime-check] build options:
[09:55:50:712] [84828:00014b67] [WARN][com.freerdp.core.rdp] - [log_build_warn][0x7fc1d8057d30]: * 'WITH_VERBOSE_WINPR_ASSERT=ON'
[09:55:50:712] [84828:00014b67] [WARN][com.freerdp.core.rdp] - [log_build_warn][0x7fc1d8057d30]: *
[09:55:50:712] [84828:00014b67] [WARN][com.freerdp.core.rdp] - [log_build_warn][0x7fc1d8057d30]: [runtime-check] build options might slow down the application
[09:55:50:712] [84828:00014b67] [WARN][com.freerdp.core.rdp] - [log_build_warn][0x7fc1d8057d30]: *************************************************
[09:55:50:712] [84828:00014b67] [WARN][com.freerdp.core.rdp] - [log_build_warn_cipher][0x7fc1d8057d30]: *************************************************
[09:55:50:712] [84828:00014b67] [WARN][com.freerdp.core.rdp] - [log_build_warn_cipher][0x7fc1d8057d30]: [SSL] {Cipher} build or configuration missing:
[09:55:50:712] [84828:00014b67] [WARN][com.freerdp.core.rdp] - [log_build_warn_cipher][0x7fc1d8057d30]: * des-ede3-cbc: RDP security FIPS mode will not work
[09:55:50:712] [84828:00014b67] [WARN][com.freerdp.core.rdp] - [log_build_warn_cipher][0x7fc1d8057d30]: *************************************************
[09:55:50:712] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_set_negotiation_enabled]: Enabling security layer negotiation: TRUE
[09:55:50:712] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_set_restricted_admin_mode_required]: Enabling restricted admin mode: FALSE
[09:55:50:712] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_set_RCG_required]: Enabling remoteCredentialGuards: FALSE
[09:55:50:712] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_enable_rdp]: Enabling RDP security: TRUE
[09:55:50:712] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_enable_tls]: Enabling TLS security: TRUE
[09:55:50:712] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_enable_nla]: Enabling NLA security: TRUE
[09:55:50:712] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_enable_ext]: Enabling NLA extended security: FALSE
[09:55:50:712] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_enable_rdstls]: Enabling RDSTLS security: FALSE
[09:55:50:712] [84828:00014b67] [WARN][com.freerdp.core.nego] - [nego_enable_aad]: This build does not support AAD security, disabling.
[09:55:50:712] [84828:00014b67] [DEBUG][com.freerdp.core.rdp] - [rdp_client_transition_to_state][0x7fc1d8057d30]: CONNECTION_STATE_INITIAL --> CONNECTION_STATE_NEGO
[09:55:50:712] [84828:00014b67] [DEBUG][com.freerdp.core] - [freerdp_tcp_is_hostname_resolvable]: resetting error state
[09:55:50:712] [84828:00014b67] [DEBUG][com.freerdp.core] - [freerdp_tcp_default_connect]: resetting error state
[09:55:50:712] [84828:00014b67] [DEBUG][com.freerdp.core] - [freerdp_tcp_default_connect]: connecting to peer x.x.x.x
[09:55:50:716] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_connect]: state: NEGO_STATE_NLA
[09:55:50:716] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_attempt_nla]: Attempting NLA security
[09:55:50:716] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_send_negotiation_request]: RequestedProtocols: [SSL|HYBRID][0x00000003]
[09:55:50:743] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_process_negotiation_response]: RDP_NEG_RSP::flags = { [0x1f] |EXTENDED_CLIENT_DATA_SUPPORTED|DYNVC_GFX_PROTOCOL_SUPPORTED|RDP_NEGRSP_RESERVED|RESTRICTED_ADMIN_MODE_SUPPORTED|REDIRECTED_AUTHENTICATION_MODE_SUPPORTED }
[09:55:50:743] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_recv]: selected_protocol: [HYBRID][0x00000002]
[09:55:50:743] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_attempt_nla]: state: NEGO_STATE_FINAL
[09:55:50:743] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_connect]: Negotiated [HYBRID][0x00000002] security
[09:55:50:743] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_try_connect]: nego_security_connect with PROTOCOL_HYBRID
[09:55:50:767] [84828:00014b67] [DEBUG][com.freerdp.core.nla] - [nla_set_early_user_auth]: Early User Auth active: false
[09:55:50:767] [84828:00014b67] [DEBUG][com.freerdp.core.nla] - [nla_set_state]: -- NLA_STATE_INITIAL --> NLA_STATE_INITIAL
[09:55:50:767] [84828:00014b67] [INFO][com.freerdp.core.auth] - [auth_resolve_sspi_table]: Using SSPI Module: /usr/lib/devolutions/RemoteDesktopManager/libDevolutionsSspi.so
[09:55:50:768] [84828:00014b67] [DEBUG][com.freerdp.core.auth] - [credssp_auth_init]: Using package: Negotiate (cbMaxToken: 48000 bytes)
[09:55:50:768] [84828:00014b67] [DEBUG][com.freerdp.core.auth] - [credssp_auth_setup_client]: Acquired client credentials

Well this is interesting... I didn't touch it but directly after (though several minutes later) the above, I got the below.

[09:55:50:768] [84828:00014b67] [DEBUG][com.freerdp.core.auth] - [credssp_auth_init]: Using package: Negotiate (cbMaxToken: 48000 bytes)
[09:55:50:768] [84828:00014b67] [DEBUG][com.freerdp.core.auth] - [credssp_auth_setup_client]: Acquired client credentials
[10:01:50:886] [84828:00014b67] [DEBUG][com.freerdp.core.auth] - [credssp_auth_authenticate]: Authentication in progress... (output token size: 57)
[10:01:50:886] [84828:00014b67] [DEBUG][com.freerdp.core.nla] - [nla_send]: ----->> sending...
[10:01:50:886] [84828:00014b67] [DEBUG][com.freerdp.core.nla] - [nla_send]: ----->> protocol version 6
[10:01:50:886] [84828:00014b67] [DEBUG][com.freerdp.core.nla] - [nla_write_octet_string]: ----->> negoToken
[10:01:50:886] [84828:00014b67] [DEBUG][com.freerdp.core.nla] - [nla_write_octet_string]: ----->> client nonce
[10:01:50:886] [84828:00014b67] [DEBUG][com.freerdp.core.nla] - [nla_send]: [110 bytes]
[10:01:50:886] [84828:00014b67] [ERROR][com.freerdp.core.transport] - [transport_default_write]: BIO_should_retry returned a system error 104: Connection reset by peer
[10:01:50:886] [84828:00014b67] [ERROR][com.freerdp.core] - [transport_default_write]: ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
[10:01:50:886] [84828:00014b67] [ERROR][com.freerdp.core.transport] - [transport_connect_nla]: NLA begin failed
[10:01:50:886] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_connect]: Failed to connect with [HYBRID][0x00000002] security
[10:01:50:888] [84828:00014b67] [DEBUG][com.freerdp.core.rdp] - [rdp_finalize_reset_flags][0x7fc1d8057d30]: [CONNECTION_STATE_NEGO] reset finalize_sc_pdus
[10:01:50:888] [84828:00014b67] [DEBUG][com.freerdp.core.rdp] - [rdp_client_transition_to_state][0x7fc1d8057d30]: CONNECTION_STATE_NEGO --> CONNECTION_STATE_INITIAL
[10:01:50:893] [84828:00014b67] [INFO][com.freerdp.codec] - [openh264_load_functionpointers]: loaded libopenh264.so.7 2.6.0
[10:01:50:906] [84828:00014b67] [INFO][com.freerdp.codec] - [openh264_load_functionpointers]: loaded libopenh264.so.7 2.6.0
[10:01:50:907] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_set_negotiation_enabled]: Enabling security layer negotiation: TRUE
[10:01:50:907] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_set_restricted_admin_mode_required]: Enabling restricted admin mode: FALSE
[10:01:50:907] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_set_RCG_required]: Enabling remoteCredentialGuards: FALSE
[10:01:50:907] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_enable_rdp]: Enabling RDP security: TRUE
[10:01:50:907] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_enable_tls]: Enabling TLS security: TRUE
[10:01:50:907] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_enable_nla]: Enabling NLA security: TRUE
[10:01:50:907] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_enable_ext]: Enabling NLA extended security: FALSE
[10:01:50:907] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_enable_rdstls]: Enabling RDSTLS security: FALSE
[10:01:50:907] [84828:00014b67] [WARN][com.freerdp.core.nego] - [nego_enable_aad]: This build does not support AAD security, disabling.
[10:01:50:907] [84828:00014b67] [DEBUG][com.freerdp.core.rdp] - [rdp_client_transition_to_state][0x7fc1d8057d30]: CONNECTION_STATE_INITIAL --> CONNECTION_STATE_NEGO
[10:01:50:907] [84828:00014b67] [DEBUG][com.freerdp.core] - [freerdp_tcp_is_hostname_resolvable]: resetting error state
[10:01:50:907] [84828:00014b67] [DEBUG][com.freerdp.core] - [freerdp_tcp_default_connect]: resetting error state
[10:01:50:907] [84828:00014b67] [DEBUG][com.freerdp.core] - [freerdp_tcp_default_connect]: connecting to peer x.x.x.x
[10:01:50:910] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_connect]: state: NEGO_STATE_NLA
[10:01:50:910] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_attempt_nla]: Attempting NLA security
[10:01:50:910] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_send_negotiation_request]: RequestedProtocols: [SSL|HYBRID][0x00000003]
[10:01:50:933] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_process_negotiation_response]: RDP_NEG_RSP::flags = { [0x1f] |EXTENDED_CLIENT_DATA_SUPPORTED|DYNVC_GFX_PROTOCOL_SUPPORTED|RDP_NEGRSP_RESERVED|RESTRICTED_ADMIN_MODE_SUPPORTED|REDIRECTED_AUTHENTICATION_MODE_SUPPORTED }
[10:01:50:933] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_recv]: selected_protocol: [HYBRID][0x00000002]
[10:01:50:933] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_attempt_nla]: state: NEGO_STATE_FINAL
[10:01:50:933] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_connect]: Negotiated [HYBRID][0x00000002] security
[10:01:50:933] [84828:00014b67] [DEBUG][com.freerdp.core.nego] - [nego_try_connect]: nego_security_connect with PROTOCOL_HYBRID
[10:01:50:956] [84828:00014b67] [DEBUG][com.freerdp.core.nla] - [nla_set_early_user_auth]: Early User Auth active: false
[10:01:50:956] [84828:00014b67] [DEBUG][com.freerdp.core.nla] - [nla_set_state]: -- NLA_STATE_INITIAL --> NLA_STATE_INITIAL
[10:01:50:956] [84828:00014b67] [INFO][com.freerdp.core.auth] - [auth_resolve_sspi_table]: Using SSPI Module: /usr/lib/devolutions/RemoteDesktopManager/libDevolutionsSspi.so
[10:01:50:956] [84828:00014b67] [DEBUG][com.freerdp.core.auth] - [credssp_auth_init]: Using package: Negotiate (cbMaxToken: 48000 bytes)
[10:01:50:956] [84828:00014b67] [DEBUG][com.freerdp.core.auth] - [credssp_auth_setup_client]: Acquired client credentials

Pulled out the IPs to protect the innocent ;)

Hello

The log is a bit weird but let's try and get things unblocked first.

Do you still have 2025.3.x installed? If yes, go to Settings > Session types > RDP > SSPI and change the "SSPI Module" to "Portable". Do you now get the same issue with 2025.3? If so, that confirm the fix we need so go back to 2026.1.x and in the same settings, ensure it's set to "System". And let me know if that resolves the problem.

(If you've currently got 2026.1.x installed, go to that setting and ensure it's set to "System" - I just wanted to prevent you having to do an uninstall/reinstall dance to check).

Let me know if that resolves the problem and I'll come back with more information. Equally, let me know if something isn't clear or you have other questions.

Kind regards,

Sorry, had to reboot to Windows (yuck) to work on RDM there. Back on Linux, I am running 2026.1 again. As a reminder, 2025.3.x works with no issues. SSPI is currently set to Portable in 2026.1; changing it to now to System instead. I saved the config. Shutdown RDM...running RDM from terminal....zomg it worked...why did that work? Thank you so much.

Hello

Ok, I'm glad that worked for you and you're back up-and-running.

In RDP, Network Level Authentication supports different security packages (like plugins) called SSPs. The security package to use is negotiated between the client and the server. Historically we only ship a build of FreeRDP that supports NTLM via its internal SSPs. This is the "System" SSPI module in RDM. We also provide our own SSP module ("Portable" in RDM) that supports NTLM and Kerberos.

This is starting to become very relevant as we see Microsoft is becoming serious about deprecating NTLM in the future. In RDM 2026.1 we made the "Portable" SSP the default and that seems to have caused an issue in your environment.

With the "System" SSP, RDM tells the server it supports NTLM, the server agrees that it is supported, so that is used.

With the "Portable" SSP, RDM tells the server it supports NTLM and Kerberos, and if the server supports Kerberos that is what will be used (it's preferred by the server because it's more secure). Kerberos implies some additional client side setup (especially for non-Windows, non-domain machine) and if that early setup fails for some reason, the client should fall back to NTLM and continue as normal (assuming the server allows it).

What makes this really strange in your case is that the negotiation handshake is failing, but not in a normal way - we don't get an error response or continuation from the server after starting NLA, instead the server just closes the connection. That's something I haven't seen before and implies one of (or both) a bug on our side or a strange interaction with your Windows environment.

Since Kerberos is clearly not a requirement in your domain, there's nothing wrong with continuing as you have it - leave the SSPI Module set to "System" and keep using NTLM. If it's something that you're interested in troubleshooting further (either now, or at some point in the future), I'd be happy to investigate that with you.

In the meantime please don't hesitate if you have other questions or comments, and I do apologize for the inconvenience

Kind regards,

I just wanted to add that I had this same issue and setting it back to system resolved it for me. Running the Flatpak version of 2026.1.0.8