Configure Remote Desktop on RHEL 10 with RDP (TigerVNC Alternative)

If you search for a VNC server on Rocky Linux 10, install TigerVNC on RHEL 10, or an XRDP alternative on AlmaLinux 10, the documented RHEL 10 workflow changed with the platform: tigervnc-server is no longer available on RHEL 10-family systems, installing old RHEL 9 TigerVNC RPMs is not a supported fix, and GNOME Remote Desktop using RDP is the replacement. Windows Remote Desktop, GNOME Connections, Remmina, and FreeRDP can connect to it.

This guide focuses on multi-user Remote Login, the documented RHEL 10 replacement for typical TigerVNC and XRDP multi-user use cases. The procedure was validated on Rocky Linux 10.2 and applies to equivalent EL10 GNOME environments where the same packages and services are available.

Tested on: Rocky Linux 10.2 (Red Quartz) with the distribution-provided gnome-remote-desktop 49.3 package. Package versions can differ across other EL10 distributions; only Rocky Linux 10.2 was exercised directly in this lab.

Why TigerVNC is not available on RHEL 10

RHEL 10 removed the TigerVNC packages. It also removed the xorg-x11-server package as part of the platform's transition to Wayland. GNOME Remote Desktop using RDP is the documented replacement for graphical remote access. On Rocky Linux 10.2 with only the standard repositories enabled, these packages are not available:

dnf info tigervnc-server

Sample output:

Error: No matching Packages to list

dnf info xrdp

Sample output:

Error: No matching Packages to list

With only the standard Rocky Linux 10 repositories enabled, dnf info xrdp returned no matching package in this lab. That does not prove xrdp is unavailable from every third-party source, but it is not part of the standard-repository workflow documented and tested here. Do not force-install RHEL 9 TigerVNC RPMs on a RHEL 10-family host.

gnome-connections can still act as a VNC client for older servers, but it does not provide a VNC server on RHEL 10.

Choose the correct GNOME Remote Desktop mode

Desktop sharing connects to the GNOME session of whoever is already logged in at the console. Remote login presents the GNOME login screen so different Linux users can sign in remotely. A single-user headless session uses a separate user-scoped workflow with its own TLS files and RDP credentials. Red Hat's current procedure also lists SELinux permissive mode as a prerequisite.

This article focuses on Remote Login because it replaces the multi-user TigerVNC and XRDP patterns most administrators need. Desktop sharing appears later as a shorter alternative. The complete single-user headless procedure belongs in a dedicated article.

Install GNOME Remote Desktop and GNOME

Confirm the operating system before installing packages:

cat /etc/os-release

Sample output:

NAME="Rocky Linux"
VERSION="10.2 (Red Quartz)"
ID="rocky"
VERSION_ID="10.2"

Install the remote desktop server, display manager, and a command-line RDP client:

sudo dnf install gnome-remote-desktop gdm freerdp

DNF displays the packages, dependencies, transaction summary, and installation result. Confirm the transaction when prompted.

Verify the packages came from the distribution repositories:

rpm -q gnome-remote-desktop gdm freerdp

Sample output:

gnome-remote-desktop-49.3-3.el10_2.x86_64
gdm-47.0-21.el10_2.x86_64
freerdp-3.10.3-12.el10_2.6.x86_64

A minimal server install may not include a full GNOME Workstation environment. Check available environment groups:

dnf group list

Sample output:

Server with GUI
   Workstation

Install the required graphical environment when it is not already present. For a server:

sudo dnf group install "Server with GUI"

For a workstation-oriented environment:

sudo dnf group install "Workstation"

Confirm the boot target:

systemctl get-default

Sample output on a server that still boots to the multi-user target:

multi-user.target

Red Hat requires a reboot after installing gnome-remote-desktop for the multi-user remote-login workflow:

sudo reboot

After the system returns, continue with the TLS and grdctl configuration in the next section. Do not assume a minimal EL10 server already has GNOME, GDM, or graphical.target configured before this sequence completes.

Configure multi-user Remote Login with RDP

Remote Login integrates GNOME Remote Desktop with GDM. Remote clients first authenticate with a system-wide RDP access credential, then sign in with an individual Linux account at the GNOME login screen. Those two credential sets are not necessarily the same.

Create TLS files for the system service

Create the certificate directory as the gnome-remote-desktop service account:

sudo -u gnome-remote-desktop mkdir -p \
  ~gnome-remote-desktop/.local/share/gnome-remote-desktop

Generate a self-signed TLS key and certificate for RDP:

sudo -u gnome-remote-desktop winpr-makecert -silent -rdp \
  -path ~gnome-remote-desktop/.local/share/gnome-remote-desktop tls

The command creates tls.crt and tls.key under /var/lib/gnome-remote-desktop/.local/share/gnome-remote-desktop/.

Register TLS material and RDP credentials

Point the system-wide daemon at the TLS files:

sudo grdctl --system rdp set-tls-key \
  ~gnome-remote-desktop/.local/share/gnome-remote-desktop/tls.key

sudo grdctl --system rdp set-tls-cert \
  ~gnome-remote-desktop/.local/share/gnome-remote-desktop/tls.crt

Set the RDP access credential remote clients use before the GNOME login screen. Run the command without arguments so grdctl prompts interactively:

sudo grdctl --system rdp set-credentials

Enter the system-wide RDP access username and password when prompted. These credentials grant access to the GNOME login screen; users then authenticate again with their individual Linux accounts.

Enable system-wide RDP:

sudo grdctl --system rdp enable

Enable GDM and the remote desktop service

Enable and start GDM and the system remote desktop unit:

sudo systemctl enable --now gdm

sudo systemctl enable --now gnome-remote-desktop.service

Check service state:

systemctl status gnome-remote-desktop.service

Sample output:

● gnome-remote-desktop.service - GNOME Remote Desktop
     Loaded: loaded (/usr/lib/systemd/system/gnome-remote-desktop.service; enabled; preset: disabled)
     Active: active (running)
   Main PID: 50691 (gnome-remote-de)
             └─50691 /usr/libexec/gnome-remote-desktop-daemon --system

Jul 11 18:57:05 rocky1 gnome-remote-de[50691]: RDP server started

Make the graphical target persistent across reboot:

sudo systemctl set-default graphical.target

Verify it:

systemctl get-default

Expected output:

graphical.target

Confirm the RDP configuration after the services are running:

sudo grdctl --system status

Sample output:

Overall:
	Unit status: active
RDP:
	Status: enabled
	Port: 3389
	TLS certificate: /var/lib/gnome-remote-desktop/.local/share/gnome-remote-desktop/tls.crt
	TLS fingerprint: 59:b3:68:b3:7f:41:ff:1e:b5:ea:9c:2e:61:31:88:2c:1a:a8:f5:be:14:db:e1:1f:90:52:1f:1a:fc:fd:a9:39
	TLS key: /var/lib/gnome-remote-desktop/.local/share/gnome-remote-desktop/tls.key
	Username: (hidden)
	Password: (hidden)

If grdctl reports that TPM-backed credential storage is unavailable, inspect the complete message and confirm that credentials were stored successfully. This warning can appear on virtual machines without a virtual TPM.

Confirm the listener:

sudo ss -lntp | grep ':3389'

Sample output:

LISTEN 0      5                  *:3389             *:*    users:(("gnome-remote-de",pid=50691,fd=9))

If gnome-remote-desktop.service does not reach an active state after the required reboot, inspect sudo journalctl -u gnome-remote-desktop.service -b before continuing.

Configure firewalld and secure RDP access

Identify the active zone before opening the port:

sudo firewall-cmd --get-active-zones

Sample output:

public (default)
  interfaces: enp0s3 enp0s8

Open TCP port 3389 in that zone. Replace public with the zone associated with the server interface:

sudo firewall-cmd \
  --permanent \
  --zone=public \
  --add-port=3389/tcp

sudo firewall-cmd --reload

Verify the port in the same zone:

sudo firewall-cmd --zone=public --query-port=3389/tcp

Sample output:

yes

Port behavior:

• Remote Login normally uses TCP 3389
• Desktop Sharing normally uses TCP 3389
• When Remote Login and Desktop Sharing are both enabled, Desktop Sharing moves to TCP 3390

Restrict RDP to a trusted management network, VPN, or bastion path instead of exposing TCP 3389 broadly on the public internet. Self-signed TLS produces a certificate warning until you verify the fingerprint or deploy a trusted certificate. See the firewalld cheat sheet for zone and port management.

Connect from Windows, Linux, or macOS

Connect from Windows

Use Remote Desktop Connection (mstsc) or Windows App on newer Windows releases:

1. Enter the server hostname or IP address.
2. Accept the self-signed certificate warning only after verifying the TLS fingerprint from grdctl --system status.
3. Enter the RDP access credential configured with grdctl --system rdp set-credentials.
4. Sign in with an individual Linux account at the GNOME login screen.

Connect from Linux

GUI clients such as GNOME Connections and Remmina work when you choose RDP, not VNC.

From the command line with FreeRDP:

command -v xfreerdp || command -v xfreerdp3

Use whichever binary the installed FreeRDP package provides.

xfreerdp \
  /v:server.example.com \
  /u:rdpaccess

FreeRDP prompts for the RDP access password and displays the certificate details on the first connection. Compare the presented certificate fingerprint with:

sudo grdctl --system status

Accept the certificate only when the fingerprints match.

When automatic trust on first use is acceptable, FreeRDP also supports:

xfreerdp \
  /v:server.example.com \
  /u:rdpaccess \
  /cert:tofu

This mode records the certificate presented on its first connection and rejects a different certificate on later connections. It does not provide manual verification before the first certificate is trusted.

FreeRDP advises checking the locally installed client help because its command-line interface varies across releases.

Replace server.example.com and rdpaccess with your server and configured RDP access username. After the RDP gate, authenticate with the target Linux user account at the GNOME login screen.

Connect from macOS

Use Windows App or another RDP-compatible client. Select RDP in multi-protocol clients; VNC mode does not apply to GNOME Remote Desktop on EL10.

Enable Desktop Sharing instead of Remote Login

Desktop Sharing is shorter to configure but solves a different problem:

• Shares the GNOME desktop of the currently logged-in user
• Does not present a new multi-user login screen
• Requires an active local GNOME graphical session
• Uses credentials configured in GNOME Settings
• Can allow remote control instead of view-only access when enabled

Navigation:

Settings → System → Remote Desktop → Desktop Sharing

Enable Desktop Sharing, configure Login Details, open TCP 3389, and enable Remote Control when required. If Remote Login is also enabled, Desktop Sharing listens on TCP 3390 instead.

Verify and troubleshoot GNOME Remote Desktop

Use these diagnostics in order:

rpm -q gnome-remote-desktop gdm freerdp

Confirms the expected packages are installed.

sudo grdctl --system status

Shows whether system-wide RDP is enabled, which port is configured, and the TLS fingerprint.

systemctl status gnome-remote-desktop.service

systemctl status gdm

Show whether the remote desktop daemon and display manager are running.

systemctl get-default

Should report graphical.target for persistent graphical remote login.

sudo ss -lntp | grep -E ':3389|:3390'

Confirms RDP listeners on the expected ports.

Identify the active zone:

sudo firewall-cmd --get-active-zones

Inspect the zone attached to the server interface:

sudo firewall-cmd --zone=public --list-all

Replace public with the active zone on your host.

sudo journalctl -u gnome-remote-desktop.service -b

sudo journalctl -u gdm -b

Surface firewall rules and service startup errors from the current boot.

Migrate from TigerVNC or XRDP to GNOME Remote Desktop

These items do not migrate directly:

• vncserver.users
• vncserver-config-defaults
• ~/.vnc/passwd
• ~/.config/tigervnc/config
• vncserver@:<display>.service
• VNC display numbers such as :2
• Firewall ports such as 5902

Migration checklist:

1. Record existing VNC users and access requirements
2. Decide whether each user needs Desktop Sharing, Remote Login, or a single-user headless session
3. Remove or disable obsolete TigerVNC service overrides
4. Install GNOME Remote Desktop and GDM
5. Configure TLS and RDP credentials
6. Replace VNC firewall rules with the appropriate RDP rule
7. Test one regular user
8. Add additional Linux users
9. Remove obsolete VNC secrets only after RDP is verified

Summary

The documented RHEL 10 replacement for the former TigerVNC server workflow is GNOME Remote Desktop using RDP. The procedure in this article was also validated on Rocky Linux 10.2.

• Use Remote Login for multi-user graphical access through GDM
• Use Desktop Sharing for an already logged-in physical session
• Use a dedicated headless workflow when one remote user needs a separate session without the multi-user GDM path

For TigerVNC on older releases, see the TigerVNC server guide. For firewall management, see the firewalld cheat sheet.

References

• Red Hat Enterprise Linux 10 — Remotely accessing the desktop — Desktop Sharing, Remote Login, and multi-user RDP
• Red Hat Enterprise Linux 10 — Removed functionalities — TigerVNC and X.Org removals

Run the locally installed manual and help output so that the options match your package version:

man grdctl

grdctl --help

grdctl --system rdp --help