One-Click RDP: Create clickable .rdp files and save credentials securely for fast, repeatable remote support

If you support multiple companies’ Windows servers/desktops, repeatedly typing RDP details wastes time. The good news: you can create one-click Remote Desktop connections that reuse saved credentials — safely — using Windows’ built-in tools or a credential manager. This article shows practical methods (built-in + scripts), recommended third-party managers, and essential security best practices so you speed up work without creating security holes.

Quick overview — how it works

• A Windows .rdp file stores connection settings (host, display, resources, and username), but not a plain-text password.

• To enable automatic sign-in you store credentials in Windows Credential Manager (manually or via cmdkey), or use an encrypted vault (KeePass, Devolutions, Royal TS).

• Launching the .rdp file (or mstsc with the file) picks up the saved credential and signs you in with one click.

A. Built-in, secure way (recommended for small setups)

1. Open Remote Desktop Connection: Win + R → mstsc.

2. Click Show Options. Enter Computer: (host/IP) and User name: (e.g., DOMAIN\supportuser).

3. Configure Display / Local Resources as needed (drive mapping, clipboard).

4. Click Save As… and store e.g. C:\RDP\Company1.rdp.

5. Double-click the .rdp and connect. When prompted for the password, enter it and check Remember my credentials. That saves a TERMSRV/host entry in Windows Credential Manager.

   • If Group Policy forbids saving credentials, see the Group Policy / GPO section below.

Why use this: no plain-text password in files, uses Windows’ protected store, simple one-click launch.

B. Add credentials programmatically: cmdkey

If you want scripted provisioning (for yourself or a small team), use cmdkey — it stores credentials in Windows Credential Manager.

Example:

cmdkey /generic:TERMSRV\rdp.company1.local /user:COMPANY1\supportuser /pass:MySecretPassword123
start "" "C:\Windows\System32\mstsc.exe" "C:\RDP\Company1.rdp"

PowerShell (safer to prompt once):

$host = "rdp.company1.local"
$user = "COMPANY1\supportuser"
$cred = Get-Credential -UserName $user -Message "Enter password for $user on $host"
$pw = $cred.GetNetworkCredential().Password
cmd /c "cmdkey /generic:TERMSRV/$host /user:$user /pass:$pw"
Start-Process mstsc -ArgumentList "C:\RDP\Company1.rdp"

Warning: embedding passwords in scripts is insecure. Prefer prompting (as above) or using an encrypted vault.

C. Bulk creation from CSV (practical script)

If you manage many hosts, create a CSV with columns: host,user,rdpfile and run a PowerShell script that:

• Prompts for each password once (Get-Credential), or reads none (prompts interactively),

• Runs cmdkey for each host,

• Writes a small .lnk or .cmd that launches the related .rdp.

(If you want, I’ll generate a ready-to-use PowerShell CSV importer in the exact format you prefer.)

D. Third-party managers (best for many hosts / teams)

If you support dozens or hundreds of systems, use a credential-aware RDP manager that encrypts credentials, offers auditing and templates:

• Devolutions Remote Desktop Manager — enterprise features, central vault.

• Royal TS / Royal Server — team sharing, secure vault.

• mRemoteNG — free, multi-protocol (less robust credential vaulting).

• KeePass + RDP plugin / KeeAgent — KeePass stores credentials encrypted; can automate RDP launches via plugin.

These provide one-click connects, secure storage, and better scaling than ad-hoc .rdp + cmdkey files.

E. Group Policy & environment issues

• Some environments block saving credentials via GPO: check Computer Configuration → Administrative Templates → System → Credentials Delegation and the Allow delegating saved credentials policy.

• CredSSP, Remote Credential Guard, and NLA settings affect how credentials are delegated and whether saved credentials are used.

• If auto-login fails, verify:

  • The TERMSRV/hostname entry exists in Credential Manager.

  • Hostname in .rdp matches the cmdkey target (use FQDN).

  • NLA is enabled/compatible.

  • No GPO prevents saving credentials.

F. Security best practices (must read)

1. Never store plaintext passwords in .rdp files or unencrypted scripts.

2. Use Windows Credential Manager (cmdkey) or an encrypted vault (KeePass, Devolutions).

3. Prefer service accounts with least privilege for support tasks and rotate them regularly.

4. Use MFA/MFA for admin portals where possible; secure admin entry points with VPN or RD Gateway.

5. Use Network Level Authentication (NLA) and keep RDP hosts patched.

6. Use PAM/Privileged Access Management for enterprise auditing and access control.

7. Remove stored credentials when access is revoked: cmdkey /delete:TERMSRV/hostname.

8. Log and audit RDP sessions when possible; consider session recording for sensitive systems.

G. Quick checklist you can follow today

• Create C:\RDP folder and save one .rdp per client.

• Configure User name in each .rdp and test connection.

• Save credentials interactively or use cmdkey for each host.

• Make desktop shortcuts that call mstsc "C:\RDP\Client.rdp".

• Evaluate a credential manager if you have >10 hosts or multiple team members.

• Audit Group Policy if saving credentials fails.

Conclusion

For small sets of hosts, .rdp files + Windows Credential Manager (via the UI or cmdkey) give a secure, one-click experience. For many hosts or team environments, use a proper remote-session manager (Devolutions, Royal TS, KeePass with plugin) to centralize encrypted credentials, logging, and role control. Always prioritize credential security and use least-privilege accounts and MFA where possible.

Want next steps?

I can:

• produce a PowerShell CSV importer that creates cmdkey entries and desktop shortcuts,

• or give a ready-to-use step-by-step with exact PowerShell code and comments,

• or recommend a specific third-party manager and compare features for your needs.

Pick one and I’ll generate it now.

#RDP #RemoteDesktop #ITSupport #SysAdmin #Windows #CredentialManager #cmdkey #Automation #OneClick #RemoteAccess #Security #Cybersecurity #NLA #MFA #2FA #PowerShell #BatchScript #Shortcuts #RemoteTools #Devolutions #RoyalTS #mRemoteNG #KeePass #PAM #Vault #PasswordManagement #Encrypted #Audit #Compliance #GPO #GroupPolicy #Troubleshooting #BestPractices #RDGateway #VPN #Firewall #CredSSP #RemoteCredentialGuard #SSO #SessionRecording #AccessControl #LeastPrivilege #ServiceAccount #PasswordRotation #SupportChecklist #Productivity #AdminTools #RemoteSupport #ITAutomation #SecureConfig