Set up a remote desktop with Remmina on elementary OS

Remmina is the practical remote desktop client for reaching another computer over a network. On elementary OS it can control a Windows workstation or Windows Server through RDP, giving access to specialist software, office systems or a machine that is easier to manage in another location. That is useful when an Australian business wants to centralise a specialist application without maintaining duplicate Windows installations, or when a support technician needs to help with the “old box in the back office” without asking staff to troubleshoot it over the phone.

Before changing anything, confirm what is running at the far end. The Windows machine must have a supported edition, Remote Desktop enabled, a permitted account and a network path to your elementary OS system. Windows Home does not accept incoming RDP sessions, whereas Pro, Enterprise, Education and Windows Server normally do. Keep the host awake, make sure its firewall permits the connection, and collect the exact address and sign-in details. Those checks prevent the most common failure: a client profile that looks correct but has no service or route to reach.

Check the Windows host and network

First choose how your elementary OS computer will reach the remote Windows machine. The value entered as the server depends on this route, so confirm it with the network or workplace administrator before creating the profile.

A private LAN address is simplest when both computers share an office network. For access from home or a regional office, a VPN creates a private route and keeps TCP port 3389 off the public internet. An RD Gateway suits organisations that publish remote access through a managed service, but its hostname, port and authentication rules must come from the administrator.

Connection choices are shaped by Australian infrastructure. A premises connected through the NBN may use fixed-line copper, fibre or fixed wireless, and the available plan depends on the address; some small businesses also rely on business fibre or a 4G/5G backup. CGNAT can prevent a direct inbound connection even on a broadband service. In that case, use a site-to-site or client VPN that can route to the host even though it cannot accept an inbound connection directly. This arrangement is common in Australian managed-service setups and avoids fragile port forwarding.

Install Remmina and RDP support

Remmina may already be present, particularly on an established elementary OS installation. If it is not visible in the Applications menu, search AppCenter or open Terminal and install both the client and its RDP plugin:

sudo apt update
sudo apt install remmina remmina-plugin-rdp

The separate RDP package matters because it supplies the protocol handler used to negotiate a Windows session. If AppCenter offers only the main Remmina application, the terminal command ensures the missing component is included. The sudo prompt asks for your elementary OS user password, not the remote Windows password.

Launch Remmina from the applications menu after installation. Its window normally shows a list of saved profiles and a prominent button for creating a new one. Choose the new-profile option and confirm that RDP appears in the Protocol menu. If it does not, reopen Remmina after the installation has finished; if it is still absent, repeat the package command and check the Terminal for an installation error. Running remmina from Terminal is handy when the graphical menu fails to reveal a plugin problem.

Create the remote connection profile

Give the profile a clear name, such as the host’s location or role, and place related machines in a Remmina group if you use several systems. Set Protocol to RDP, then enter the server address supplied for your chosen route. Use the private IP or internal DNS name when connected through a VPN, and use the gateway details provided by your workplace administrator for managed access. An unexplained public IP address is rarely the right choice.

Enter the Windows credentials separately from the network address. For a domain-joined machine, the account may need a domain name and a form such as DOMAIN\username; a local account can use the plain username. Running whoami on the Windows host shows the accepted identity format. Select normal authentication and allow Remmina to request the password when it connects, or store it through the desktop keyring rather than embedding it in a shared notes file. If the organisation requires it, add the RD Gateway and network-level authentication settings in the profile’s advanced controls.

Start with a resolution that matches the monitor and a colour depth of 24 bits. Leave the remaining options at their defaults for the first test, then adjust sound, keyboard mapping, drive redirection or clipboard behaviour. Save the profile under the same name shown in the profile list, select Connect, and watch the Remmina status area for negotiation errors. A successful first connection should show a live Windows desktop inside the Remmina window; close it cleanly when finished so the Windows session is disconnected rather than left in a broken state.

Protect and tune the session

Do not forward TCP port 3389 directly from the internet to the Windows host. Automated scanners find exposed RDP services quickly, and a strong password alone is not a sufficient perimeter. Keep 3389 reachable only over a trusted private network or an encrypted VPN, and use RD Gateway with multifactor authentication where the organisation provides it. On the Windows host, allow Remote Desktop through the firewall only from the required network scope.

Keep secure remote desktop settings enabled, particularly network-level authentication and TLS negotiation. If Remmina reports a certificate mismatch, verify the certificate fingerprint with the Windows administrator rather than permanently ignoring server validation. When a legacy server forces weaker compatibility, agree on a temporary exception for that host and document it instead of weakening every profile. Store any saved password in the local keyring, and treat exported connection profiles as sensitive because they may contain names, addresses or secrets.

Australian organisations should also consider what the remote session can expose. If it provides access to personal information, payment data or records covered by the Privacy Act 1988, or systems subject to Australian Prudential Regulation Authority requirements, the remote-access design must support the organisation’s existing privacy and security controls. Limit clipboard and drive redirection where the work does not need them. Remote clipboard synchronisation can move passwords and customer details between machines, while mapped drives can expose more data than intended.

Performance tuning is especially worthwhile across Australia’s long and variable network paths. An office in Perth may have a higher round-trip delay to a host in Sydney or Melbourne than a local user experiences, while an NBN fixed-wireless service may fluctuate under load. If the desktop feels slow, reduce the profile to 1280 by 720 or 1600 by 900, keep 24-bit colour, and disable desktop effects on the Windows side. Lowering the resolution reduces bandwidth and input lag without removing any remote-control features. Local audio can also be left off on constrained links, then enabled after the basic session is stable.

Troubleshoot and keep a usable profile

Work through the failure from the network inward. Confirm that the Windows host is powered on, that its disk has space, and that it has not entered sleep. Check that you are connected to the required VPN, the address is correct, and your account belongs to the permitted Remote Desktop group. You can ping the host as a quick check, although a blocked ICMP response does not prove RDP is down. A TCP check gives a clearer result:

nc -vz 192.0.2.10 3389

Replace the example address with your host and use the gateway’s port when that is the route. Install netcat-openbsd if nc is missing. If the port is reachable but Remmina still fails, test the same details from another RDP client; that quickly separates a server-side problem from a Remmina or elementary OS problem.

Match the symptom to the layer. A missing RDP option means the protocol plugin is absent. Repeated credential prompts often require the exact local or domain account format, while an old server may need administrator-approved compatibility settings. A black or empty Remmina window can sometimes be resolved by testing under an Xorg session if your elementary OS release offers one. Choppy movement calls for a lower resolution and fewer Windows animations. For clipboard failures, test with plain text because some elevated or specialised applications block redirected clipboard data. If Windows reports that the session is already active, remember that a Windows client generally supports one interactive console session; disconnect the old console session before reconnecting.

Keep one profile per host and route rather than overwriting a working profile whenever settings change. Duplicate it before testing a different gateway, resolution or security option, and make a backup export occasionally. Check exported files for embedded credentials before sharing them. When a fault is specific to elementary OS or Remmina, searching existing discussions on the elementary OS community site can reveal a known fix. Include the elementary OS release, Remmina version, connection method and exact error text when asking for help, while removing any sensitive server information.

Open Remmina and save one test profile for the Windows host, then connect once while the host’s console is still accessible.