Windows VM: RDP connection hangs on Arch due to FreeRDP 3 Kerberos/NLA bug

[estebankt]

System details

Omarchy 3.3.3

What's wrong?

When launching Windows VM via Walker (Super+Space → "Windows"), the RDP connection hangs and the window never appears. The xfreerdp3 process gets stuck in the
wait_for_rdp_ready authentication check loop.

[estebankt]

Likely Root Cause

FreeRDP 3 on Arch Linux has a known bug where NLA (Network Level Authentication) using Kerberos hangs indefinitely when credentials are passed via command line (/p:
parameter).

Related upstream issue: FreeRDP/FreeRDP#10138

Current Behavior

In omarchy-windows-vm, the launch_windows function uses:

xfreerdp3 /u:"$WIN_USER" /p:"$WIN_PASS" /v:127.0.0.1:3389 ...

This hangs during NLA authentication on Arch Linux with FreeRDP 3.

Interestingly, if you omit /p: and enter the password interactively, it works fine.

Solution

Adding /sec:tls bypasses NLA and allows the connection to succeed:

xfreerdp3 /u:"$WIN_USER" /p:"$WIN_PASS" /v:127.0.0.1:3389 /sec:tls ...

Suggested Fix

In bin/omarchy-windows-vm, add /sec:tls to both xfreerdp3 calls:

1. The auth check in wait_for_rdp_ready:
timeout 5s xfreerdp3 /auth-only /cert:ignore /u:"$WIN_USER" /p:"$WIN_PASS" /v:127.0.0.1:3389 /sec:tls

2. The main connection in launch_windows:
xfreerdp3 /u:"$WIN_USER" /p:"$WIN_PASS" /v:127.0.0.1:3389 /sec:tls -grab-keyboard /sound /microphone ...

Environment

- Arch Linux (rolling)
- FreeRDP 3.x (freerdp package from official repos)
- Omarchy with Windows VM installed via omarchy-windows-vm installFreeRDP 3 on Arch Linux has a known bug where NLA (Network Level Authentication) using Kerberos hangs indefinitely when credentials are passed via command line (`/p:`
parameter).

Related upstream issue: https://github.com/FreeRDP/FreeRDP/issues/10138

[ryanrhughes]

Did you actually verify this suggested fix made a difference?

[estebankt]

Yep, I have done the fix on my personal omarchy machine

[visch]

RDP works for me on 3.3.3 for what it's worth! I didn't change anything you're mentioning

[DylanRothHuck]

This is still broken on Omarchy 4.0.0 with FreeRDP 3. The /sec:tls fix proposed here was likely never merged or there was a regression — the xfreerdp3 call in bin/omarchy-windows-vm still doesn't include it:
xfreerdp3 /u:"$WIN_USER" /p:"$WIN_PASS" /v:127.0.0.1:3389 -grab-keyboard ...
Without /sec:tls, xfreerdp3 tries Kerberos/NLA authentication which fails or hangs against the dockur/windows container. Adding /sec:tls fixes it immediately:
xfreerdp3 /u:"$WIN_USER" /p:"$WIN_PASS" /v:127.0.0.1:3389 /sec:tls -grab-keyboard ...
Tested on:

• Omarchy 4.0.0
• FreeRDP 3.x (Arch repos)
• dockurr/windows container
  (Diagnosed with AI assistance)