OpenThinRDP is a thin client operating system for organisations that publish Windows desktops with Remote Desktop: RDS session hosts, VDI collections behind an RD Connection Broker, or Windows VMs on Hyper-V, Proxmox, VMware or any cloud. It runs on the PCs and thin clients you already own, is managed from a shared folder you already have, and costs nothing per device.
- What your users get
- What IT gets
- Security
- Coming from IGEL OS, Dell ThinOS or another thin client OS
- What it costs
- In production, with the evidence
- Rolling it out
- Power on, sign in, work. The device starts in seconds into a sign-in form with your logo, then the Windows desktop in full screen. No local desktop to get lost in.
- Smooth on Wi-Fi, VPNs and busy lines. RDP over UDP is built in: at 50% packet loss the desktop still runs at 19-21 frames per second, where TCP is frozen (the numbers).
- Their devices work. USB sticks as drives; signature keys, tachograph keys and instruments passed whole, also when plugged in during the session; webcams and headsets in Teams and Zoom; smart cards; several monitors; touch.
- Clear messages instead of error codes: "Waiting for Windows" while a VM restarts, "Session opened elsewhere" with Resume here, and a session that comes back by itself after a network drop.
- Zero-touch from the domain. A new device needs a domain account and nothing else: it finds its management folder in the domain by itself (how).
- No management server. Settings, status and updates live in a shared folder (SMB). No agent, no database, nothing to install or license on the server side; the settings are text files you can read and back up.
- Updates you control. Signed packages, installed in the background and applied when the session ends. A new version on a few pilot devices first, then on all; back to the version before in one click, for the fleet or one device (management).
- A free manager for Windows that shows every device, who cannot sign in and why, and the remote screen of any device; and a Health Center for the infrastructure behind the desktops: Hyper-V and clusters, brokers, AD and DNS, SQL Server, backups, iDRAC, Proxmox, vSphere, Veeam, Citrix and certificates (the manager).
- Help desk diagnostics on every device without a PIN: network, brokers, time, management folder, last events.
- No desktop, no terminal, no text consoles; the settings dialog behind a PIN.
- Signed updates, with your own signing key if you want it; Debian security updates by themselves; FreeRDP security releases within 7 days (SECURITY.md).
- Kerberos with NTLM as fallback or Kerberos only; RD Gateway; WireGuard or OpenVPN for devices outside the office.
- 802.1X on the cable and WPA2/WPA3-Enterprise Wi-Fi (PEAP or EAP-TLS with your CA).
- Device secrets sealed in the TPM when there is one; SSH with keys only, off by default.
The model and its limits: security.
OpenThinRDP installs on the same x86-64 hardware: Dell Wyse and OptiPlex Thin Clients, HP t-series, Fujitsu Futro, IGEL x86-64 models, office PCs (which ones). It speaks RDP: for Windows Remote Desktop it does what they do and adds RDP over UDP; for Citrix or Omnissa Horizon, keep them for now and tell us what you need.
- From Dell ThinOS: replacing Dell ThinOS, with the settings to copy.
- Side by side with IGEL OS, ThinOS, Stratodesk, ThinStation and openthinclient: the alternatives.
Nothing per device, no subscription, no account: the thin client is open source (GPLv3), the manager free for any use. Microsoft's licences apply as for any Remote Desktop client (RDS CALs, or VDA for Windows virtual desktops); OpenThinRDP adds none of its own. The hardware is often what you already have.
OpenThinRDP runs the whole thin client fleet of the company that built it: Dell OptiPlex 3000 Thin Clients at desks, tills, a laboratory, weighing stations and a wall screen on Wi-Fi, on a Windows 11 VDI on Hyper-V behind two RD Connection Brokers. Every release reaches them through their management folder. Rollback, an interrupted update, a network cut and zero-touch were tested on a device of that fleet: production readiness, and what is still missing: status.
- Try it live from a USB stick on one device: nothing is written to the disk.
- Create the management folder and run the manager (getting started).
- Name the folder in the domain: every new device then sets itself up with a domain account.
- Install with Unattended install from a stick, device by device; updates and settings arrive from the folder.
This page is docs/guides/business.md as published on GitHub, where the documentation, the releases and the discussions are.