Read a .rdp file before you open it

A .rdp file is a list of settings that Remote Desktop Connection applies the moment you double-click it — including which of your drives, printers, smart cards and USB devices the remote computer may use, and which program it starts there. This page shows every setting in the file in plain words, grouped, and flags the ones that hand something of yours to the other side.

Windows saves these files as UTF-16 with a byte order mark; that is handled, and so are UTF-8 and older single-byte files. The file is read in this tab and goes nowhere.

Open or paste the file

Open a .rdp file

Or paste its contents

Nothing is uploaded: the script on this page has no fetch, no XMLHttpRequest and no form submission in it, and the page carries no analytics. A saved password in the file is not displayed, not even in its encrypted form.

The example file — made up, and built to worry you

full address:s:203.0.113.10
username:s:
prompt for credentials:i:0
authentication level:i:0
drivestoredirect:s:*
redirectclipboard:i:1
redirectprinters:i:1
redirectcomports:i:1
redirectsmartcards:i:1
redirectwebauthn:i:1
devicestoredirect:s:*
usbdevicestoredirect:s:*
audiocapturemode:i:1
screen mode id:i:2
remoteapplicationmode:i:1
remoteapplicationname:s:Secure Storage Check
remoteapplicationprogram:s:||storagecheck
remoteapplicationcmdline:s:--user %USERNAME% --host %COMPUTERNAME%
remoteapplicationexpandcmdline:i:0
signscope:s:Full Address,Server Port,RemoteApplicationMode,RemoteApplicationName,RemoteApplicationProgram
signature:s:AQABAAEAAADKCgAAMIIKxgYJKoZIhvcNAQcCoIIKtzCCCrMCAQExDzANBglghkgBZQMEAgEFADAL

Why a .rdp file deserves a look

In October 2024 Microsoft described a spear-phishing campaign that mailed out .rdp files signed with a Let’s Encrypt certificate. Opened, each connected to a server the senders ran and mapped the recipient’s disks, clipboard, printers, connected devices, audio and smart cards into that session (Microsoft Security Blog, 29 October 2024). Nothing in such a file is an exploit. Every line is an ordinary setting, which is why reading the lines is the defence.

A setting that is not in the file is decided by the client — Remote Desktop Connection’s own checkboxes — so a short, innocent-looking file can still share your clipboard. The page names the security-relevant settings a file leaves out.

What the warnings mean

Risk — stop and understand before opening: all drives or drives plugged in later shared, USB devices passed through, authentication level:i:0, Network Level Authentication turned off, a gateway that signs in with your Windows account without asking.
Check — fine when you expect it, odd when you do not: the clipboard, smart cards, printers, serial ports, cameras, the microphone, your location and passkey requests shared; a program started instead of a desktop, with its arguments; a gateway and where your sign-in for it goes; a saved password; settings the signature does not cover; a setting given twice. Each copy of a repeated setting is checked on its own, so a harmless line later in the file cannot hide a risky one.
Note — for the record: the file is signed, it has no address, a line is not a setting.

Names and values follow Microsoft’s list of supported RDP properties and its older RemoteDesktopClientSettings reference. Anything else is shown as it is, under Not recognised.

About signed files

signscope lists the settings the signature covers; signature holds it. This page does not verify the signature and does not show who signed it. That is deliberate: a real certificate can be copied into a file without the key that goes with it, and a name taken from an unchecked signature is worse than no name. Windows verifies the signature when you open the file and names the publisher in its warning — read that name.

What the page does show is which settings sit outside signscope. The signature says nothing about those lines.

Questions people actually ask

Is the file uploaded anywhere?

No. It is read in this tab: the script on this page has no fetch, no XMLHttpRequest and no form submission in it, and the page carries no analytics. A saved password in the file (password 51) is not even displayed — only its length.

Is it safe to open a .rdp file someone sent me?

Only if you know who sent it and its settings match what you expect. A .rdp file can hand your drives, clipboard, smart cards and devices to the computer it names, and start a program there whose window looks like one of yours. Read it here first; if it shares more than the job needs, or names a server you do not recognise, do not open it.

What does drivestoredirect:s:* mean?

Every local drive, including ones connected during the session, is available to the remote computer to read and write. drivestoredirect:s: with nothing after it shares none; a list such as C:\;E:\ shares those drives; DynamicDrives shares the ones you plug in later.

Does a valid signature mean the file is safe?

No. A signature tells you who published the file, if Windows can verify it — not that the settings are harmless. The files in Microsoft’s October 2024 report were signed.

What is authentication level:i:0?

It tells the client to connect without a warning even when the server cannot prove who it is. 2 warns and lets you decide, 1 refuses, 3 sets no requirement. A file from outside your organisation has no reason to carry 0.

How do I read a .rdp file as text?

It is plain text, saved by Windows as UTF-16. Drop it on this page, or open it in any editor that understands UTF-16 — Notepad on Windows does. Each line is name:type:value, where the type is i for a number, s for a string and b for binary.

Where this comes from

Conchshell connects to Windows machines over RDP, and it does not read .rdp files: the connection is set up in its own dialog. Of everything a .rdp file can redirect, the only thing it redirects is the clipboard — drives, printers, smart cards, serial ports, USB devices and sound are not passed through at all. It connects only with Network Level Authentication and pins the key of the server’s certificate on the first connection; a changed one is not used until you confirm the replacement in a system dialog. On Windows and Linux, answer that dialog with one of its buttons: in version 2.16.0, closing it counts as yes.

What it cannot do: it has no Remote Desktop Gateway support and no RemoteApp mode, and a host with Network Level Authentication turned off will not connect. If your file routes through a gateway, keep using Microsoft’s client for that one.

Download Conchshell free