Remote Desktop Connection Manager & Best RDP Clients for Windows

What remote desktop connection manager means in practice

The phrase covers two things. Literally, Remote Desktop Connection Manager (RDCMan) is a free Microsoft utility, maintained again by the Sysinternals team, that keeps many RDP sessions in a tree of groups with live thumbnails and inherited credentials. Generically, a remote desktop connection manager is any client that wraps the Windows Remote Desktop engine with folders, tabs and a password store. This comparison covers both: RDCMan itself and the six other RDP clients for Windows people actually install in 2026.

All of them speak the same protocol and all but one embed Microsoft's own RDP client control (Royal TS can optionally use FreeRDP), so session quality does not separate them. What differs is how many hosts you can keep organised, where your passwords live, what it costs, and whether anyone still ships security fixes.

The seven RDP clients for Windows, one by one

mstsc.exe (Remote Desktop Connection)

Built into every Windows edition, Home included (Home cannot accept RDP but can connect out). One window per session, no tabs, no tree: your manager is a folder of .rdp files. It is scriptable:

mstsc /v:203.0.113.10:3389 /f
mstsc /v:srv01 /w:1920 /h:1080 /admin
mstsc /edit C:\Users\me\Documents\srv01.rdp
mstsc /v:srv01 /public

/admin targets the console session, /public stops credential and bitmap caching on a shared machine, and /edit opens an .rdp file whose settings are plain text. The full switch list is in our Windows Remote Desktop Connection (mstsc) guide. It is not going anywhere: when Microsoft retired the Store Remote Desktop app in 2025, it said explicitly that Remote Desktop Connection stays.

Windows App (Microsoft Store)

Windows App replaced the Store Remote Desktop app, whose support ended on 27 May 2025. On Windows it was built for Windows 365, Azure Virtual Desktop, Dev Box and Remote Desktop Services feeds; direct Remote PC connections by hostname or IP only began rolling out as a preview in version 2.0.964.0 (February 2026); check your build before assuming it replaces mstsc. On macOS, iOS and Android it has offered Add PC for years, which is why it is the client in our RDP from Mac to Windows guide. Sessions are device cards, not a tree; credentials save per account. Free.

Remote Desktop Connection Manager (RDCMan)

Version 2.7 was retired in March 2020 over an XML external entity flaw in its .rdg parser (CVE-2020-0765). It returned as 2.8 under Sysinternals in June 2021 and has been actively developed since: 3.0 (May 2025) added IPv6, session resizing and updated cryptography; 3.20 (August 2026) added Azure Virtual Desktop workspace feeds and Dev Box support. It needs Windows 11 or Windows Server 2016 and later and runs without installation, even straight from \\live.sysinternals.com\tools\RDCMan.exe.

The model is a tree: files contain groups, groups contain servers, and every setting (credentials, gateway, port, display, redirected drives) is inherited downwards unless overridden. Select a group for live thumbnails of every session; connect or disconnect the whole group at once. Smart groups populate by rule; virtual groups (Connected, Reconnect, Favorites, Recent) keep the working set in view. Limitations: RDP only, no tabs, no sharing beyond passing the file around.

mRemoteNG

The open-source (GPL) fork of mRemote, and the usual pick when the same admin also lives in SSH: RDP, VNC, SSH, Telnet, HTTP/HTTPS, Citrix ICA and PowerShell remoting in a tabbed window with a folder tree and inheritance. Connections live in %APPDATA%\mRemoteNG\confCons.xml, AES-GCM encrypted, but unless you set a master password the key is the well-known default mR3m. Maintenance is the other caveat: the last release tagged stable is 1.76.20 from April 2019; everything since (1.77.x, 1.78.x) ships as a pre-release build. Those builds do get fixes (XXE and SQL injection patches in October 2025, .NET 10 in February 2026), but it is pre-release code, and CVE-2023-30367 showed stored passwords readable from process memory.

Royal TS

The polished commercial option for one admin or a small team: tabs, documents shareable on a file share or cloud drive with credentials referenced by name rather than embedded, a built-in Secure Gateway for SSH tunnelling, and KeePass or LastPass integration. Beyond RDP it covers SSH, VNC, web, FTP/SFTP, Hyper-V and VMware consoles. The free Lite mode is capped at 10 connections, 10 credentials and one document; a single-user licence is listed at 49 euros with no subscription. Actively maintained, with Royal Server as the team back end.

Devolutions Remote Desktop Manager

The heavyweight: more than 150 connection and credential types, a vault with role-based access, two-factor authentication, audit logs, and integrations with KeePass, Bitwarden, 1Password and Keeper. The Free edition is genuinely free, commercial use included, but is meant for one person with no sharing; sharing is what the Team edition sells, as a per-user subscription backed by Devolutions Server (self-hosted) or Devolutions Hub (cloud). Right for a helpdesk or an MSP, overkill for eight servers.

Terminals

A CodePlex-era open-source tabbed client (RDP, VNC, SSH, Telnet, ICA) that still ranks in search results. Its last release, 4.0.1, dates from June 2017; the project declared itself unmaintained in February 2019 and "resurrected" but maintainer-less in October 2022. Recognise it, do not install it.

Comparison table: RDP clients for Windows (2026)

Setting up Remote Desktop Connection Manager in five steps

1. Download and run

Get RDCMan.zip from the Sysinternals download page, unzip and run RDCMan.exe; the only files it creates are the .rdg files you save.

2. Create a file and a group

File > New creates the .rdg; right-click it, choose Add group, then Alt+Enter for its properties. On Logon Credentials untick Inherit from parent and enter domain\user, or [server]\Administrator for hosts with local accounts. A non-default port goes on the Connection Settings tab; moving the port hides nothing from a scanner; the controls that matter are in our RDP port 3389 guide.

3. Add servers in bulk

web[01-10]
{par,fra}-db[1-3]
lab[001-050]

Those patterns go into the Add server dialog and expand to web01 through web10, six database hosts and fifty zero-padded lab machines; a text file with one hostname per line imports too.

4. Choose how passwords are encrypted

By default RDCMan encrypts passwords with CryptProtectData (DPAPI): the file is readable only by the same Windows user on the same machine. If the .rdg must follow you to a second workstation, switch Encryption Settings to a certificate. Microsoft documents this command to create one; export it with its private key to the other machine:

New-SelfSignedCertificate -KeySpec KeyExchange -KeyExportPolicy Exportable -HashAlgorithm SHA1 -KeyLength 2048 -CertStoreLocation "cert:\CurrentUser\My" -Subject "CN=MyRDCManCert"

5. Work from the command line

RDCMan.exe lab.rdg /reconnect
RDCMan.exe lab.rdg /c web01,web02
RDCMan.exe /noopen

/reconnect reopens every session that was live at the last shutdown, /c connects the named servers, /noopen starts empty; Ctrl+Alt+Break toggles full screen.

Where each client stores your passwords

This is where the clients differ most. mstsc keeps saved passwords out of .rdp files and in Windows Credential Manager, DPAPI-protected for your user, which you can pre-seed from a script:

cmdkey /generic:TERMSRV/203.0.113.10 /user:Administrator /pass:YourPassword
cmdkey /list
cmdkey /delete:TERMSRV/203.0.113.10

RDCMan uses the same DPAPI or a certificate you control, and its credential profiles let colleagues share a .rdg while each keeps their own password locally. mRemoteNG protects confCons.xml only once a master password is set. Royal TS and Devolutions RDM keep their own vaults behind a master password or two-factor authentication and, in their team products, per-user access on a server.

None of this replaces host-side hygiene: a vault protects the password at rest on your workstation and does nothing for a weak Windows password reachable from the internet. Keep Network Level Authentication on, set an account lockout policy, and restrict who can reach the port at the firewall.

Which RDP client to choose: three profiles

One server, one workstation

Use mstsc. Save an .rdp file on the desktop with display and drive redirection set the way you want, seed the password with cmdkey, and you have a one-click connection with nothing extra to update. Add Windows App on a Mac or phone if needed.

Sysadmin with 50 hosts

Use RDCMan if the hosts are all Windows: free, current, and no tabbed client matches its thumbnail wall when you are watching ten reboots at once. Add mRemoteNG if you also need SSH tabs and accept a pre-release build with a master password set; if you want both in one supported window, Royal TS at 49 euros is the cheapest maintained answer.

A team that shares access

Stop passing .rdg or confCons.xml files around with passwords inside. Devolutions RDM Team with Devolutions Server or Hub gives each person their own login, role-based vault access and an audit trail; Royal TS with Royal Server is the lighter option for a small team.

Whichever client you settle on, it is only as useful as the Windows machine on the other end. If what you actually need is a Windows box that is always on, with full administrator rights and resources nobody else shares, a hosted Windows RDP server with full admin access is the shortest path: dedicated CPU and RAM, unlimited (fair-use) bandwidth, no KYC, crypto accepted, from $8.99 per month, provisioned about 10 seconds after payment confirms. Drop its IP into RDCMan or mstsc and it behaves like any other host in your tree.

Frequently Asked Questions

Is Remote Desktop Connection Manager still supported by Microsoft?

Yes: RDCMan is maintained by the Sysinternals team, with version 3.20 released in August 2026.

Yes. After the original 2.7 build was pulled in March 2020 over CVE-2020-0765, Microsoft's Sysinternals team relaunched RDCMan as version 2.8 in June 2021 and has kept shipping updates: 3.0 in May 2025 brought IPv6 support and modern cryptography, and 3.20 in August 2026 added Azure Virtual Desktop workspace feeds and Dev Box support. It is free, requires Windows 11 or Windows Server 2016 and later, and downloads from the Sysinternals site or runs directly from Sysinternals Live.

What is the difference between RDCMan and Remote Desktop Connection (mstsc)?

mstsc opens one session per window; RDCMan organises hundreds of sessions in groups with thumbnails and shared credentials.

mstsc.exe is the Remote Desktop Connection client built into Windows: one window per host, settings saved in .rdp files, passwords in Credential Manager. RDCMan wraps that same engine in a management layer: a tree of groups, live thumbnails of every session in a group, credentials and settings inherited from parent groups, bulk import of hosts, and connect-all or reconnect for a whole group. If you manage one or two machines, mstsc is enough; RDCMan starts paying off at around ten hosts.

Can I open multiple RDP sessions in tabs on Windows?

Not with mstsc alone; mRemoteNG, Royal TS and Devolutions RDM add tabs, while RDCMan uses a tree and thumbnails instead.

The built-in client cannot: each mstsc connection is its own window. Tabbed RDP sessions come from third-party managers. mRemoteNG (free, open source), Royal TS (free up to 10 connections) and Devolutions Remote Desktop Manager (Free edition) all put sessions in tabs. RDCMan takes a different approach, a server tree plus a thumbnail wall for each group, which many admins prefer once they are watching dozens of hosts rather than switching between three.

Is mRemoteNG safe to use in 2026?

Usable, with two conditions: set a master password and accept that current builds are pre-release.

It can be, with caveats. The last stable release, 1.76.20, dates from April 2019; the 1.77 and 1.78 builds since then are labelled pre-release even though they carry real fixes, including XXE and SQL injection patches in the October 2025 build and the move to .NET 10 in February 2026. Always set a master password: without one, confCons.xml is encrypted with the public default key mR3m. And keep CVE-2023-30367 in mind, which showed stored passwords readable from process memory.