diff --git a/server/Mac/mf_peer.c b/server/Mac/mf_peer.c
index 92a7512ae..066912714 100644
--- a/server/Mac/mf_peer.c
+++ b/server/Mac/mf_peer.c
@@ -180,10 +180,13 @@ static BOOL mf_peer_context_new(freerdp_peer* client, rdpContext* context)
 	if (!(peer->info = mf_info_get_instance()))
 		return FALSE;
 
-	if (!(peer->rfx_context = rfx_context_new_ex(TRUE, settings->ThreadingFlags)))
+	if (!(peer->rfx_context = rfx_context_new_ex(
+	          TRUE, freerdp_settings_get_uint32(settings, FreeRDP_ThreadingFlags))))
 		goto fail;
 
-	rfx_context_reset(peer->rfx_context, settings->DesktopWidth, settings->DesktopHeight);
+	rfx_context_reset(peer->rfx_context,
+	                  freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth),
+	                  freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight));
 	rfx_context_set_mode(peer->rfx_context, RLGR3);
 	rfx_context_set_pixel_format(peer->rfx_context, PIXEL_FORMAT_BGRA32);
 
@@ -276,13 +279,15 @@ static BOOL mf_peer_post_connect(freerdp_peer* client)
 	// mfi->servscreen_height = 1800 / mfi->scale;
 	UINT32 bitsPerPixel = 32;
 
-	if ((settings->DesktopWidth != mfi->servscreen_width) ||
-	    (settings->DesktopHeight != mfi->servscreen_height))
+	if ((freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth) != mfi->servscreen_width) ||
+	    (freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight) != mfi->servscreen_height))
 	{
 	}
 
-	settings->DesktopWidth = mfi->servscreen_width;
-	settings->DesktopHeight = mfi->servscreen_height;
+	if (!freerdp_settings_set_uint32(settings, FreeRDP_DesktopWidth, mfi->servscreen_width))
+		return FALSE;
+	if (!freerdp_settings_set_uint32(settings, FreeRDP_DesktopHeight, mfi->servscreen_height))
+		return FALSE;
 	if (!freerdp_settings_set_uint32(settings, FreeRDP_ColorDepth, bitsPerPixel))
 		return FALSE;
 
@@ -318,7 +323,9 @@ static BOOL mf_peer_activate(freerdp_peer* client)
 	rdpSettings* settings = client->context->settings;
 	WINPR_ASSERT(settings);
 
-	rfx_context_reset(context->rfx_context, settings->DesktopWidth, settings->DesktopHeight);
+	rfx_context_reset(context->rfx_context,
+	                  freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth),
+	                  freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight));
 	context->activated = TRUE;
 	return TRUE;
 }
@@ -380,13 +387,17 @@ static void* mf_peer_main_loop(void* arg)
 	if (!freerdp_settings_set_pointer_len(settings, FreeRDP_RdpServerCertificate, cert, 1))
 		goto fail;
 
-	settings->NlaSecurity = FALSE;
-	settings->RemoteFxCodec = TRUE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_NlaSecurity, FALSE))
+		goto fail;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_RemoteFxCodec, TRUE))
+		goto fail;
 	if (!freerdp_settings_set_uint32(settings, FreeRDP_ColorDepth, 32))
 		goto fail;
 
-	settings->SuppressOutput = TRUE;
-	settings->RefreshRect = FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_SuppressOutput, TRUE))
+		goto fail;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_RefreshRect, FALSE))
+		goto fail;
 
 	client->PostConnect = mf_peer_post_connect;
 	client->Activate = mf_peer_activate;
diff --git a/server/Sample/sfreerdp.c b/server/Sample/sfreerdp.c
index cdb3b3e51..891c0b8fa 100644
--- a/server/Sample/sfreerdp.c
+++ b/server/Sample/sfreerdp.c
@@ -115,7 +115,8 @@ static BOOL test_peer_context_new(freerdp_peer* client, rdpContext* ctx)
 	WINPR_ASSERT(context);
 	WINPR_ASSERT(ctx->settings);
 
-	if (!(context->rfx_context = rfx_context_new_ex(TRUE, ctx->settings->ThreadingFlags)))
+	if (!(context->rfx_context = rfx_context_new_ex(
+	          TRUE, freerdp_settings_get_uint32(ctx->settings, FreeRDP_ThreadingFlags))))
 		goto fail;
 
 	if (!rfx_context_reset(context->rfx_context, SAMPLE_SERVER_DEFAULT_WIDTH,
@@ -231,17 +232,18 @@ static BOOL test_peer_draw_background(freerdp_peer* client)
 	update = client->context->update;
 	WINPR_ASSERT(update);
 
-	if (!settings->RemoteFxCodec && !freerdp_settings_get_bool(settings, FreeRDP_NSCodec))
+	const BOOL RemoteFxCodec = freerdp_settings_get_bool(settings, FreeRDP_RemoteFxCodec);
+	if (!RemoteFxCodec && !freerdp_settings_get_bool(settings, FreeRDP_NSCodec))
 		return FALSE;
 
-	WINPR_ASSERT(settings->DesktopWidth <= UINT16_MAX);
-	WINPR_ASSERT(settings->DesktopHeight <= UINT16_MAX);
+	WINPR_ASSERT(freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth) <= UINT16_MAX);
+	WINPR_ASSERT(freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight) <= UINT16_MAX);
 
 	s = test_peer_stream_init(context);
 	rect.x = 0;
 	rect.y = 0;
-	rect.width = (UINT16)settings->DesktopWidth;
-	rect.height = (UINT16)settings->DesktopHeight;
+	rect.width = (UINT16)freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth);
+	rect.height = (UINT16)freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight);
 	size = rect.width * rect.height * 3ULL;
 
 	if (!(rgb_data = malloc(size)))
@@ -252,7 +254,7 @@ static BOOL test_peer_draw_background(freerdp_peer* client)
 
 	memset(rgb_data, 0xA0, size);
 
-	if (settings->RemoteFxCodec)
+	if (RemoteFxCodec)
 	{
 		WLog_DBG(TAG, "Using RemoteFX codec");
 		if (!rfx_compose_message(context->rfx_context, s, &rect, 1, rgb_data, rect.width,
@@ -261,8 +263,10 @@ static BOOL test_peer_draw_background(freerdp_peer* client)
 			goto out;
 		}
 
-		WINPR_ASSERT(settings->RemoteFxCodecId <= UINT16_MAX);
-		cmd.bmp.codecID = (UINT16)settings->RemoteFxCodecId;
+		const UINT32 RemoteFxCodecId =
+		    freerdp_settings_get_uint32(settings, FreeRDP_RemoteFxCodecId);
+		WINPR_ASSERT(RemoteFxCodecId <= UINT16_MAX);
+		cmd.bmp.codecID = (UINT16)RemoteFxCodecId;
 		cmd.cmdType = CMDTYPE_STREAM_SURFACE_BITS;
 	}
 	else
@@ -270,8 +274,9 @@ static BOOL test_peer_draw_background(freerdp_peer* client)
 		WLog_DBG(TAG, "Using NSCodec");
 		nsc_compose_message(context->nsc_context, s, rgb_data, rect.width, rect.height,
 		                    rect.width * 3ULL);
-		WINPR_ASSERT(settings->NSCodecId <= UINT16_MAX);
-		cmd.bmp.codecID = (UINT16)settings->NSCodecId;
+		const UINT32 NSCodecId = freerdp_settings_get_uint32(settings, FreeRDP_NSCodecId);
+		WINPR_ASSERT(NSCodecId <= UINT16_MAX);
+		cmd.bmp.codecID = (UINT16)NSCodecId;
 		cmd.cmdType = CMDTYPE_SET_SURFACE_BITS;
 	}
 
@@ -313,7 +318,8 @@ static BOOL test_peer_load_icon(freerdp_peer* client)
 	settings = client->context->settings;
 	WINPR_ASSERT(settings);
 
-	if (!settings->RemoteFxCodec && !freerdp_settings_get_bool(settings, FreeRDP_NSCodec))
+	if (!freerdp_settings_get_bool(settings, FreeRDP_RemoteFxCodec) &&
+	    !freerdp_settings_get_bool(settings, FreeRDP_NSCodec))
 	{
 		WLog_ERR(TAG, "Client doesn't support RemoteFX or NSCodec");
 		return FALSE;
@@ -410,16 +416,20 @@ static void test_peer_draw_icon(freerdp_peer* client, UINT32 x, UINT32 y)
 	rect.width = context->icon_width;
 	rect.height = context->icon_height;
 
-	if (settings->RemoteFxCodec)
+	const BOOL RemoteFxCodec = freerdp_settings_get_bool(settings, FreeRDP_RemoteFxCodec);
+	if (RemoteFxCodec)
 	{
-		WINPR_ASSERT(settings->RemoteFxCodecId <= UINT16_MAX);
-		cmd.bmp.codecID = (UINT16)settings->RemoteFxCodecId;
+		const UINT32 RemoteFxCodecId =
+		    freerdp_settings_get_uint32(settings, FreeRDP_RemoteFxCodecId);
+		WINPR_ASSERT(RemoteFxCodecId <= UINT16_MAX);
+		cmd.bmp.codecID = (UINT16)RemoteFxCodecId;
 		cmd.cmdType = CMDTYPE_STREAM_SURFACE_BITS;
 	}
 	else
 	{
-		WINPR_ASSERT(settings->NSCodecId <= UINT16_MAX);
-		cmd.bmp.codecID = (UINT16)settings->NSCodecId;
+		const UINT32 NSCodecId = freerdp_settings_get_uint32(settings, FreeRDP_NSCodecId);
+		WINPR_ASSERT(NSCodecId <= UINT16_MAX);
+		cmd.bmp.codecID = (UINT16)NSCodecId;
 		cmd.cmdType = CMDTYPE_SET_SURFACE_BITS;
 	}
 
@@ -427,7 +437,7 @@ static void test_peer_draw_icon(freerdp_peer* client, UINT32 x, UINT32 y)
 	{
 		s = test_peer_stream_init(context);
 
-		if (settings->RemoteFxCodec)
+		if (RemoteFxCodec)
 			rfx_compose_message(context->rfx_context, s, &rect, 1, context->bg_data, rect.width,
 			                    rect.height, rect.width * 3);
 		else
@@ -450,7 +460,7 @@ static void test_peer_draw_icon(freerdp_peer* client, UINT32 x, UINT32 y)
 
 	s = test_peer_stream_init(context);
 
-	if (settings->RemoteFxCodec)
+	if (RemoteFxCodec)
 		rfx_compose_message(context->rfx_context, s, &rect, 1, context->icon_data, rect.width,
 		                    rect.height, rect.width * 3);
 	else
@@ -660,31 +670,40 @@ static BOOL tf_peer_post_connect(freerdp_peer* client)
 	 * callback returns.
 	 */
 	WLog_DBG(TAG, "Client %s is activated (osMajorType %" PRIu32 " osMinorType %" PRIu32 ")",
-	         client->local ? "(local)" : client->hostname, settings->OsMajorType,
-	         settings->OsMinorType);
+	         client->local ? "(local)" : client->hostname,
+	         freerdp_settings_get_uint32(settings, FreeRDP_OsMajorType),
+	         freerdp_settings_get_uint32(settings, FreeRDP_OsMinorType));
 
-	if (settings->AutoLogonEnabled)
+	if (freerdp_settings_get_bool(settings, FreeRDP_AutoLogonEnabled))
 	{
-		WLog_DBG(TAG, " and wants to login automatically as %s\\%s",
-		         settings->Domain ? settings->Domain : "", settings->Username);
+		const char* Username = freerdp_settings_get_string(settings, FreeRDP_Username);
+		const char* Domain = freerdp_settings_get_string(settings, FreeRDP_Domain);
+		WLog_DBG(TAG, " and wants to login automatically as %s\\%s", Domain ? Domain : "",
+		         Username);
 		/* A real server may perform OS login here if NLA is not executed previously. */
 	}
 
 	WLog_DBG(TAG, "");
 	WLog_DBG(TAG, "Client requested desktop: %" PRIu32 "x%" PRIu32 "x%" PRIu32 "",
-	         settings->DesktopWidth, settings->DesktopHeight,
+	         freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth),
+	         freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight),
 	         freerdp_settings_get_uint32(settings, FreeRDP_ColorDepth));
 #if (SAMPLE_SERVER_USE_CLIENT_RESOLUTION == 1)
 
-	if (!rfx_context_reset(context->rfx_context, settings->DesktopWidth, settings->DesktopHeight))
+	if (!rfx_context_reset(context->rfx_context,
+	                       freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth),
+	                       freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight)))
 		return FALSE;
 
 	WLog_DBG(TAG, "Using resolution requested by client.");
 #else
-	client->settings->DesktopWidth = context->rfx_context->width;
-	client->settings->DesktopHeight = context->rfx_context->height;
-	WLog_DBG(TAG, "Resizing client to %" PRIu32 "x%" PRIu32 "", client->settings->DesktopWidth,
-	         client->settings->DesktopHeight);
+	client->freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth) =
+	    context->rfx_context->width;
+	client->freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight) =
+	    context->rfx_context->height;
+	WLog_DBG(TAG, "Resizing client to %" PRIu32 "x%" PRIu32 "",
+	         client->freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth),
+	         client->freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight));
 	client->update->DesktopResize(client->update->context);
 #endif
 
@@ -760,14 +779,16 @@ static BOOL tf_peer_activate(freerdp_peer* client)
 	WINPR_ASSERT(info);
 
 	context->activated = TRUE;
-	// client->settings->CompressionLevel = PACKET_COMPR_TYPE_8K;
-	// client->settings->CompressionLevel = PACKET_COMPR_TYPE_64K;
-	// client->settings->CompressionLevel = PACKET_COMPR_TYPE_RDP6;
-	settings->CompressionLevel = PACKET_COMPR_TYPE_RDP8;
+	// PACKET_COMPR_TYPE_8K;
+	// PACKET_COMPR_TYPE_64K;
+	// PACKET_COMPR_TYPE_RDP6;
+	if (!freerdp_settings_set_uint32(settings, FreeRDP_CompressionLevel, PACKET_COMPR_TYPE_RDP8))
+		return FALSE;
 
 	if (info->test_pcap_file != NULL)
 	{
-		freerdp_settings_set_bool(settings, FreeRDP_DumpRemoteFx, TRUE);
+		if (!freerdp_settings_set_bool(settings, FreeRDP_DumpRemoteFx, TRUE))
+			return FALSE;
 
 		if (!tf_peer_dump_rfx(client))
 			return FALSE;
@@ -816,19 +837,26 @@ static BOOL tf_peer_keyboard_event(rdpInput* input, UINT16 flags, UINT8 code)
 
 	if (((flags & KBD_FLAGS_RELEASE) == 0) && (code == RDP_SCANCODE_KEY_G)) /* 'g' key */
 	{
-		if (settings->DesktopWidth != 800)
+		if (freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth) != 800)
 		{
-			settings->DesktopWidth = 800;
-			settings->DesktopHeight = 600;
+			if (!freerdp_settings_set_uint32(settings, FreeRDP_DesktopWidth, 800))
+				return FALSE;
+			if (!freerdp_settings_set_uint32(settings, FreeRDP_DesktopHeight, 600))
+				return FALSE;
 		}
 		else
 		{
-			settings->DesktopWidth = SAMPLE_SERVER_DEFAULT_WIDTH;
-			settings->DesktopHeight = SAMPLE_SERVER_DEFAULT_HEIGHT;
+			if (!freerdp_settings_set_uint32(settings, FreeRDP_DesktopWidth,
+			                                 SAMPLE_SERVER_DEFAULT_WIDTH))
+				return FALSE;
+			if (!freerdp_settings_set_uint32(settings, FreeRDP_DesktopHeight,
+			                                 SAMPLE_SERVER_DEFAULT_HEIGHT))
+				return FALSE;
 		}
 
-		if (!rfx_context_reset(tcontext->rfx_context, settings->DesktopWidth,
-		                       settings->DesktopHeight))
+		if (!rfx_context_reset(tcontext->rfx_context,
+		                       freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth),
+		                       freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight)))
 			return FALSE;
 
 		WINPR_ASSERT(update->DesktopResize);
@@ -1050,20 +1078,28 @@ static DWORD WINAPI test_peer_mainloop(LPVOID arg)
 	if (!freerdp_settings_set_pointer_len(settings, FreeRDP_RdpServerCertificate, cert, 1))
 		goto fail;
 
-	settings->RdpSecurity = TRUE;
-	settings->TlsSecurity = TRUE;
-	settings->NlaSecurity = FALSE;
-	settings->EncryptionLevel = ENCRYPTION_LEVEL_CLIENT_COMPATIBLE;
-	/* settings->EncryptionLevel = ENCRYPTION_LEVEL_HIGH; */
-	/* settings->EncryptionLevel = ENCRYPTION_LEVEL_LOW; */
-	/* settings->EncryptionLevel = ENCRYPTION_LEVEL_FIPS; */
-	settings->RemoteFxCodec = TRUE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_RdpSecurity, TRUE))
+		goto fail;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_TlsSecurity, TRUE))
+		goto fail;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_NlaSecurity, FALSE))
+		goto fail;
+	if (!freerdp_settings_set_uint32(settings, FreeRDP_EncryptionLevel,
+	                                 ENCRYPTION_LEVEL_CLIENT_COMPATIBLE))
+		goto fail;
+	/*  ENCRYPTION_LEVEL_HIGH; */
+	/*  ENCRYPTION_LEVEL_LOW; */
+	/*  ENCRYPTION_LEVEL_FIPS; */
+	if (!freerdp_settings_set_bool(settings, FreeRDP_RemoteFxCodec, TRUE))
+		goto fail;
 	if (!freerdp_settings_set_bool(settings, FreeRDP_NSCodec, TRUE) ||
 	    !freerdp_settings_set_uint32(settings, FreeRDP_ColorDepth, 32))
 		goto fail;
 
-	settings->SuppressOutput = TRUE;
-	settings->RefreshRect = TRUE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_SuppressOutput, TRUE))
+		goto fail;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_RefreshRect, TRUE))
+		goto fail;
 
 	client->PostConnect = tf_peer_post_connect;
 	client->Activate = tf_peer_activate;
@@ -1083,7 +1119,9 @@ static DWORD WINAPI test_peer_mainloop(LPVOID arg)
 
 	update->RefreshRect = tf_peer_refresh_rect;
 	update->SuppressOutput = tf_peer_suppress_output;
-	settings->MultifragMaxRequestSize = 0xFFFFFF; /* FIXME */
+	if (!freerdp_settings_set_uint32(settings, FreeRDP_MultifragMaxRequestSize,
+	                                 0xFFFFFF /* FIXME */))
+		goto fail;
 
 	WINPR_ASSERT(client->Initialize);
 	rc = client->Initialize(client);
diff --git a/server/Windows/wf_peer.c b/server/Windows/wf_peer.c
index b679b11f0..50e92fb13 100644
--- a/server/Windows/wf_peer.c
+++ b/server/Windows/wf_peer.c
@@ -123,16 +123,17 @@ static BOOL wf_peer_post_connect(freerdp_peer* client)
 		return FALSE;
 	}
 
-	if ((settings->DesktopWidth != wfi->servscreen_width) ||
-	    (settings->DesktopHeight != wfi->servscreen_height))
+	if ((freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth) != wfi->servscreen_width) ||
+	    (freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight) != wfi->servscreen_height))
 	{
 		/*
 		WLog_DBG(TAG, "Client requested resolution %"PRIu32"x%"PRIu32", but will resize to %dx%d",
-		    settings->DesktopWidth, settings->DesktopHeight, wfi->servscreen_width,
+		    freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth),
+		freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight), wfi->servscreen_width,
 		wfi->servscreen_height);
 		    */
-		settings->DesktopWidth = wfi->servscreen_width;
-		settings->DesktopHeight = wfi->servscreen_height;
+		freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth) = wfi->servscreen_width;
+		freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight) = wfi->servscreen_height;
 		if (!freerdp_settings_set_uint32(settings, FreeRDP_ColorDepth, wfi->bitsPerPixel))
 			return FALSE;
 
@@ -284,11 +285,14 @@ DWORD WINAPI wf_peer_main_loop(LPVOID lpParam)
 	settings = client->context->settings;
 	WINPR_ASSERT(settings);
 
-	settings->RemoteFxCodec = TRUE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_RemoteFxCodec, TRUE))
+		goto fail_peer_init;
 	if (!freerdp_settings_set_uint32(settings, FreeRDP_ColorDepth, 32))
 		goto fail_peer_init;
-	settings->NSCodec = FALSE;
-	settings->JpegCodec = FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_NSCodec, FALSE))
+		goto fail_peer_init;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_JpegCodec, FALSE))
+		goto fail_peer_init;
 
 	if (!wf_peer_read_settings(client))
 		goto fail_peer_init;
diff --git a/server/Windows/wf_update.c b/server/Windows/wf_update.c
index 136cefacd..731ff0352 100644
--- a/server/Windows/wf_update.c
+++ b/server/Windows/wf_update.c
@@ -180,7 +180,8 @@ void wf_update_peer_send(wfInfo* wfi, wfPeerContext* context)
 	WINPR_ASSERT(client->context->update);
 	WINPR_ASSERT(client->context->update->SurfaceBits);
 
-	wfi->cmd.bmp.codecID = client->context->settings->RemoteFxCodecId;
+	wfi->cmd.bmp.codecID =
+	    freerdp_settings_get_uint32(client->context->settings, FreeRDP_RemoteFxCodecId);
 	client->context->update->SurfaceBits(client->context, &wfi->cmd);
 	context->frame_idx++;
 }
diff --git a/server/proxy/modules/capture/cap_main.c b/server/proxy/modules/capture/cap_main.c
index 38f9626a8..d7fd3bff6 100644
--- a/server/proxy/modules/capture/cap_main.c
+++ b/server/proxy/modules/capture/cap_main.c
@@ -162,11 +162,12 @@ static BOOL capture_plugin_send_frame(pClientContext* pc, SOCKET socket, const B
 	settings = pc->context.settings;
 	WINPR_ASSERT(settings);
 
-	frame_size = 1ull * settings->DesktopWidth * settings->DesktopHeight *
+	const size_t DesktopWidth = freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth);
+	const size_t DesktopHeight = freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight);
+	frame_size = DesktopWidth * DesktopHeight *
 	             (freerdp_settings_get_uint32(settings, FreeRDP_ColorDepth) / 8ull);
-	bmp_header =
-	    winpr_bitmap_construct_header(settings->DesktopWidth, settings->DesktopHeight,
-	                                  freerdp_settings_get_uint32(settings, FreeRDP_ColorDepth));
+	bmp_header = winpr_bitmap_construct_header(
+	    DesktopWidth, DesktopHeight, freerdp_settings_get_uint32(settings, FreeRDP_ColorDepth));
 
 	if (!bmp_header)
 		return FALSE;
@@ -282,7 +283,7 @@ static BOOL capture_plugin_server_post_connect(proxyPlugin* plugin, proxyData* p
 		return FALSE;
 	}
 
-	if (!settings->SupportGraphicsPipeline)
+	if (!freerdp_settings_get_bool(settings, FreeRDP_SupportGraphicsPipeline))
 	{
 		WLog_ERR(TAG, "session capture is only supported for GFX clients, denying connection");
 		return FALSE;
diff --git a/server/proxy/modules/capture/cap_protocol.c b/server/proxy/modules/capture/cap_protocol.c
index 69c3fbe6d..aa361fb14 100644
--- a/server/proxy/modules/capture/cap_protocol.c
+++ b/server/proxy/modules/capture/cap_protocol.c
@@ -33,31 +33,35 @@ wStream* capture_plugin_packet_new(UINT32 payload_size, UINT16 type)
 
 wStream* capture_plugin_create_session_info_packet(pClientContext* pc)
 {
-	size_t username_length;
 	wStream* s = NULL;
-	rdpSettings* settings;
 
 	if (!pc)
 		return NULL;
 
-	settings = pc->context.settings;
-
-	if (!settings || !settings->Username)
+	rdpSettings* settings = pc->context.settings;
+	if (!settings)
 		return NULL;
 
-	username_length = strlen(settings->Username);
+	const char* Username = freerdp_settings_get_string(settings, FreeRDP_Username);
+	if (!Username)
+		return NULL;
+
+	const size_t username_length = strlen(Username);
 	if ((username_length == 0) || (username_length > UINT16_MAX))
 		return NULL;
 
+	const UINT32 DesktopWidth = freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth);
+	const UINT32 DesktopHeight = freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight);
+
 	s = capture_plugin_packet_new(SESSION_INFO_PDU_BASE_SIZE + (UINT32)username_length,
 	                              MESSAGE_TYPE_SESSION_INFO);
 	if (!s)
 		return NULL;
 
 	Stream_Write_UINT16(s, (UINT16)username_length);      /* username length (2 bytes) */
-	Stream_Write(s, settings->Username, username_length); /* username */
-	Stream_Write_UINT32(s, settings->DesktopWidth);       /* desktop width (4 bytes) */
-	Stream_Write_UINT32(s, settings->DesktopHeight);      /* desktop height (4 bytes) */
+	Stream_Write(s, Username, username_length);           /* username */
+	Stream_Write_UINT32(s, DesktopWidth);                 /* desktop width (4 bytes) */
+	Stream_Write_UINT32(s, DesktopHeight);                /* desktop height (4 bytes) */
 	Stream_Write_UINT32(
 	    s, freerdp_settings_get_uint32(settings, FreeRDP_ColorDepth)); /* color depth (4 bytes) */
 	Stream_Write(s, pc->pdata->session_id, PROXY_SESSION_ID_LENGTH);   /* color depth (32 bytes) */
diff --git a/server/proxy/pf_client.c b/server/proxy/pf_client.c
index 11b4863d1..4ba866614 100644
--- a/server/proxy/pf_client.c
+++ b/server/proxy/pf_client.c
@@ -159,16 +159,8 @@ static BOOL pf_client_use_peer_load_balance_info(pClientContext* pc)
 	if (!lb_info)
 		return TRUE;
 
-	free(settings->LoadBalanceInfo);
-
-	settings->LoadBalanceInfoLength = lb_info_len;
-	settings->LoadBalanceInfo = malloc(settings->LoadBalanceInfoLength);
-
-	if (!settings->LoadBalanceInfo)
-		return FALSE;
-
-	CopyMemory(settings->LoadBalanceInfo, lb_info, settings->LoadBalanceInfoLength);
-	return TRUE;
+	return freerdp_settings_set_pointer_len(settings, FreeRDP_LoadBalanceInfo, lb_info,
+	                                        lb_info_len);
 }
 
 static BOOL str_is_empty(const char* str)
@@ -255,14 +247,21 @@ static BOOL pf_client_pre_connect(freerdp* instance)
 	 *
 	 * Also, OrderSupport need to be zeroed, because it is currently not supported.
 	 */
-	settings->GlyphSupportLevel = GLYPH_SUPPORT_NONE;
-	ZeroMemory(settings->OrderSupport, 32);
+	if (!freerdp_settings_set_uint32(settings, FreeRDP_GlyphSupportLevel, GLYPH_SUPPORT_NONE))
+		return FALSE;
+
+	void* OrderSupport = freerdp_settings_get_pointer_writable(settings, FreeRDP_OrderSupport);
+	ZeroMemory(OrderSupport, 32);
 
 	if (WTSVirtualChannelManagerIsChannelJoined(ps->vcm, DRDYNVC_SVC_CHANNEL_NAME))
-		settings->SupportDynamicChannels = TRUE;
+	{
+		if (!freerdp_settings_set_bool(settings, FreeRDP_SupportDynamicChannels, TRUE))
+			return FALSE;
+	}
 
 	/* Multimon */
-	settings->UseMultimon = TRUE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_UseMultimon, TRUE))
+		return FALSE;
 
 	/* Sound */
 	if (!freerdp_settings_set_bool(settings, FreeRDP_AudioCapture, config->AudioInput) ||
@@ -277,29 +276,45 @@ static BOOL pf_client_pre_connect(freerdp* instance)
 	if (config->RemoteApp)
 	{
 		if (WTSVirtualChannelManagerIsChannelJoined(ps->vcm, RAIL_SVC_CHANNEL_NAME))
-			settings->RemoteApplicationMode = TRUE;
+		{
+			if (!freerdp_settings_set_bool(settings, FreeRDP_RemoteApplicationMode, TRUE))
+				return FALSE;
+		}
 	}
 
 	if (config->DeviceRedirection)
 	{
 		if (WTSVirtualChannelManagerIsChannelJoined(ps->vcm, RDPDR_SVC_CHANNEL_NAME))
-			settings->DeviceRedirection = TRUE;
+		{
+			if (!freerdp_settings_set_bool(settings, FreeRDP_DeviceRedirection, TRUE))
+				return FALSE;
+		}
 	}
 
 	/* Display control */
-	settings->SupportDisplayControl = config->DisplayControl;
-	settings->DynamicResolutionUpdate = config->DisplayControl;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_SupportDisplayControl, config->DisplayControl))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_DynamicResolutionUpdate,
+	                               config->DisplayControl))
+		return FALSE;
 
 	if (WTSVirtualChannelManagerIsChannelJoined(ps->vcm, ENCOMSP_SVC_CHANNEL_NAME))
-		settings->EncomspVirtualChannel = TRUE;
+	{
+		if (!freerdp_settings_set_bool(settings, FreeRDP_EncomspVirtualChannel, TRUE))
+			return FALSE;
+	}
 
 	if (config->Clipboard)
 	{
 		if (WTSVirtualChannelManagerIsChannelJoined(ps->vcm, CLIPRDR_SVC_CHANNEL_NAME))
-			settings->RedirectClipboard = config->Clipboard;
+		{
+			if (!freerdp_settings_set_bool(settings, FreeRDP_RedirectClipboard, config->Clipboard))
+				return FALSE;
+		}
 	}
 
-	settings->AutoReconnectionEnabled = TRUE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_AutoReconnectionEnabled, TRUE))
+		return FALSE;
 
 	PubSub_SubscribeErrorInfo(instance->context->pubSub, pf_client_on_error_info);
 	PubSub_SubscribeActivated(instance->context->pubSub, pf_client_on_activated);
@@ -579,7 +594,7 @@ static BOOL pf_client_post_connect(freerdp* instance)
 	if (!gdi_init(instance, PIXEL_FORMAT_BGRA32))
 		return FALSE;
 
-	WINPR_ASSERT(settings->SoftwareGdi);
+	WINPR_ASSERT(freerdp_settings_get_bool(settings, FreeRDP_SoftwareGdi));
 
 	pf_client_register_update_callbacks(update);
 
@@ -680,7 +695,8 @@ static BOOL pf_client_should_retry_without_nla(pClientContext* pc)
 	config = pc->pdata->config;
 	WINPR_ASSERT(config);
 
-	if (!config->ClientAllowFallbackToTls || !settings->NlaSecurity)
+	if (!config->ClientAllowFallbackToTls ||
+	    !freerdp_settings_get_bool(settings, FreeRDP_NlaSecurity))
 		return FALSE;
 
 	return config->ClientTlsSecurity || config->ClientRdpSecurity;
@@ -729,11 +745,12 @@ static BOOL pf_client_connect_without_nla(pClientContext* pc)
 	WINPR_ASSERT(settings);
 
 	/* If already disabled abort early. */
-	if (!settings->NlaSecurity)
+	if (!freerdp_settings_get_bool(settings, FreeRDP_NlaSecurity))
 		return FALSE;
 
 	/* disable NLA */
-	settings->NlaSecurity = FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_NlaSecurity, FALSE))
+		return FALSE;
 
 	/* do not allow next connection failure */
 	pc->allow_next_conn_failure = FALSE;
@@ -754,14 +771,17 @@ static BOOL pf_client_connect(freerdp* instance)
 	WINPR_ASSERT(settings);
 
 	PROXY_LOG_INFO(TAG, pc, "connecting using client info: Username: %s, Domain: %s",
-	               settings->Username, settings->Domain);
+	               freerdp_settings_get_string(settings, FreeRDP_Username),
+	               freerdp_settings_get_string(settings, FreeRDP_Domain));
 
 	pf_client_set_security_settings(pc);
 	if (pf_client_should_retry_without_nla(pc))
 		retry = pc->allow_next_conn_failure = TRUE;
 
 	PROXY_LOG_INFO(TAG, pc, "connecting using security settings: rdp=%d, tls=%d, nla=%d",
-	               settings->RdpSecurity, settings->TlsSecurity, settings->NlaSecurity);
+	               freerdp_settings_get_bool(settings, FreeRDP_RdpSecurity),
+	               freerdp_settings_get_bool(settings, FreeRDP_TlsSecurity),
+	               freerdp_settings_get_bool(settings, FreeRDP_NlaSecurity));
 
 	if (!freerdp_connect(instance))
 	{
diff --git a/server/proxy/pf_context.c b/server/proxy/pf_context.c
index 14b29376e..4606ef283 100644
--- a/server/proxy/pf_context.c
+++ b/server/proxy/pf_context.c
@@ -243,16 +243,21 @@ BOOL pf_context_copy_settings(rdpSettings* dst, const rdpSettings* src)
 	}
 
 	/* keep original ServerMode value */
-	dst->ServerMode = before_copy->ServerMode;
+	if (!freerdp_settings_copy_item(dst, before_copy, FreeRDP_ServerMode))
+	{
+		freerdp_settings_free(before_copy);
+		return FALSE;
+	}
 
 	/* revert some values that must not be changed */
 	if (!pf_context_revert_str_settings(dst, before_copy, ARRAYSIZE(to_revert), to_revert))
 		return FALSE;
 
-	if (!dst->ServerMode)
+	if (!freerdp_settings_get_bool(dst, FreeRDP_ServerMode))
 	{
 		/* adjust instance pointer */
-		dst->instance = before_copy->instance;
+		if (!freerdp_settings_copy_item(dst, before_copy, FreeRDP_instance))
+			return FALSE;
 
 		/*
 		 * RdpServerRsaKey must be set to NULL if `dst` is client's context
diff --git a/server/proxy/pf_server.c b/server/proxy/pf_server.c
index d3905f92c..703d15604 100644
--- a/server/proxy/pf_server.c
+++ b/server/proxy/pf_server.c
@@ -63,8 +63,8 @@ typedef struct
 	freerdp_peer* client;
 } peer_thread_args;
 
-static BOOL pf_server_parse_target_from_routing_token(rdpContext* context, char** target,
-                                                      DWORD* port)
+static BOOL pf_server_parse_target_from_routing_token(rdpContext* context, rdpSettings* settings,
+                                                      size_t targetID, size_t portID)
 {
 #define TARGET_MAX (100)
 #define ROUTING_TOKEN_PREFIX "Cookie: msts="
@@ -85,14 +85,12 @@ static BOOL pf_server_parse_target_from_routing_token(rdpContext* context, char*
 	}
 
 	len = routing_token_length - prefix_len;
-	*target = malloc(len + 1);
 
-	if (!(*target))
+	if (!freerdp_settings_set_string_len(settings, targetID, routing_token + prefix_len, len))
 		return FALSE;
 
-	CopyMemory(*target, routing_token + prefix_len, len);
-	*(*target + len) = '\0';
-	colon = strchr(*target, ':');
+	const char* target = freerdp_settings_get_string(settings, targetID);
+	colon = strchr(target, ':');
 
 	if (colon)
 	{
@@ -100,13 +98,10 @@ static BOOL pf_server_parse_target_from_routing_token(rdpContext* context, char*
 		unsigned long p = strtoul(colon + 1, NULL, 10);
 
 		if (p > USHRT_MAX)
-		{
-			free(*target);
 			return FALSE;
-		}
 
-		*port = (DWORD)p;
-		*colon = '\0';
+		if (!freerdp_settings_set_uint32(settings, portID, p))
+			return FALSE;
 	}
 
 	return TRUE;
@@ -133,8 +128,8 @@ static BOOL pf_server_get_target_info(rdpContext* context, rdpSettings* settings
 	{
 		case PROXY_FETCH_TARGET_METHOD_DEFAULT:
 		case PROXY_FETCH_TARGET_METHOD_LOAD_BALANCE_INFO:
-			return pf_server_parse_target_from_routing_token(context, &settings->ServerHostname,
-			                                                 &settings->ServerPort);
+			return pf_server_parse_target_from_routing_token(
+			    context, settings, FreeRDP_ServerHostname, FreeRDP_ServerPort);
 
 		case PROXY_FETCH_TARGET_METHOD_CONFIG:
 		{
@@ -178,8 +173,7 @@ static BOOL pf_server_get_target_info(rdpContext* context, rdpSettings* settings
 			}
 
 			free(ev.target_address);
-			settings->ServerPort = ev.target_port;
-			return TRUE;
+			return freerdp_settings_set_uint32(settings, FreeRDP_ServerPort, ev.target_port);
 		}
 		default:
 			PROXY_LOG_ERR(TAG, ps, "unknown target fetch method: %d", ev.fetch_method);
@@ -284,7 +278,8 @@ static BOOL pf_server_post_connect(freerdp_peer* peer)
 	pdata = ps->pdata;
 	WINPR_ASSERT(pdata);
 
-	PROXY_LOG_INFO(TAG, ps, "Accepted client: %s", frontSettings->ClientHostname);
+	const char* ClientHostname = freerdp_settings_get_string(frontSettings, FreeRDP_ClientHostname);
+	PROXY_LOG_INFO(TAG, ps, "Accepted client: %s", ClientHostname);
 	if (!pf_server_setup_channels(peer))
 	{
 		PROXY_LOG_ERR(TAG, ps, "error setting up channels");
@@ -309,8 +304,9 @@ static BOOL pf_server_post_connect(freerdp_peer* peer)
 		return FALSE;
 	}
 
-	PROXY_LOG_INFO(TAG, ps, "remote target is %s:%" PRIu16 "", client_settings->ServerHostname,
-	               client_settings->ServerPort);
+	PROXY_LOG_INFO(TAG, ps, "remote target is %s:%" PRIu32 "",
+	               freerdp_settings_get_string(client_settings, FreeRDP_ServerHostname),
+	               freerdp_settings_get_uint32(client_settings, FreeRDP_ServerPort));
 
 	if (!pf_modules_run_hook(pdata->module, HOOK_TYPE_SERVER_POST_CONNECT, pdata, peer))
 		return FALSE;
@@ -341,7 +337,8 @@ static BOOL pf_server_activate(freerdp_peer* peer)
 
 	settings = peer->context->settings;
 
-	settings->CompressionLevel = PACKET_COMPR_TYPE_RDP8;
+	if (!freerdp_settings_set_uint32(settings, FreeRDP_CompressionLevel, PACKET_COMPR_TYPE_RDP8))
+		return FALSE;
 	if (!pf_modules_run_hook(pdata->module, HOOK_TYPE_SERVER_ACTIVATE, pdata, peer))
 		return FALSE;
 
@@ -478,7 +475,10 @@ static BOOL pf_server_initialize_peer_connection(freerdp_peer* peer)
 		return FALSE;
 
 	/* currently not supporting GDI orders */
-	ZeroMemory(settings->OrderSupport, 32);
+	{
+		void* OrderSupport = freerdp_settings_get_pointer_writable(settings, FreeRDP_OrderSupport);
+		ZeroMemory(OrderSupport, 32);
+	}
 
 	WINPR_ASSERT(peer->context->update);
 	peer->context->update->autoCalculateBitmapData = FALSE;
@@ -515,7 +515,9 @@ static BOOL pf_server_initialize_peer_connection(freerdp_peer* peer)
 	if (!freerdp_settings_set_bool(settings, FreeRDP_NlaSecurity, config->ServerNlaSecurity))
 		return FALSE;
 
-	settings->EncryptionLevel = ENCRYPTION_LEVEL_CLIENT_COMPATIBLE;
+	if (!freerdp_settings_set_uint32(settings, FreeRDP_EncryptionLevel,
+	                                 ENCRYPTION_LEVEL_CLIENT_COMPATIBLE))
+		return FALSE;
 	if (!freerdp_settings_set_uint32(settings, FreeRDP_ColorDepth, 32))
 		return FALSE;
 	if (!freerdp_settings_set_bool(settings, FreeRDP_SuppressOutput, TRUE))
diff --git a/server/proxy/pf_update.c b/server/proxy/pf_update.c
index e8b39320f..31103e436 100644
--- a/server/proxy/pf_update.c
+++ b/server/proxy/pf_update.c
@@ -144,8 +144,10 @@ static BOOL pf_client_desktop_resize(rdpContext* context)
 	WINPR_ASSERT(context->settings);
 	WINPR_ASSERT(ps->settings);
 	WLog_DBG(TAG, "called");
-	ps->settings->DesktopWidth = context->settings->DesktopWidth;
-	ps->settings->DesktopHeight = context->settings->DesktopHeight;
+	if (!freerdp_settings_copy_item(ps->settings, context->settings, FreeRDP_DesktopWidth))
+		return FALSE;
+	if (!freerdp_settings_copy_item(ps->settings, context->settings, FreeRDP_DesktopHeight))
+		return FALSE;
 	return ps->update->DesktopResize(ps);
 }
 
diff --git a/server/shadow/Win/win_rdp.c b/server/shadow/Win/win_rdp.c
index 70e7dd460..1d45a9a4a 100644
--- a/server/shadow/Win/win_rdp.c
+++ b/server/shadow/Win/win_rdp.c
@@ -290,45 +290,79 @@ static BOOL shw_freerdp_client_new(freerdp* instance, rdpContext* context)
 	WINPR_ASSERT(settings);
 
 	shw->settings = settings;
-	settings->AsyncChannels = FALSE;
-	settings->AsyncUpdate = FALSE;
-	settings->IgnoreCertificate = TRUE;
-	settings->ExternalCertificateManagement = TRUE;
-	settings->RdpSecurity = TRUE;
-	settings->TlsSecurity = TRUE;
-	settings->NlaSecurity = FALSE;
-	settings->BitmapCacheEnabled = FALSE;
-	settings->BitmapCacheV3Enabled = FALSE;
-	settings->OffscreenSupportLevel = FALSE;
-	settings->GlyphSupportLevel = GLYPH_SUPPORT_NONE;
-	settings->BrushSupportLevel = FALSE;
-	ZeroMemory(settings->OrderSupport, 32);
-	settings->FrameMarkerCommandEnabled = TRUE;
-	settings->SurfaceFrameMarkerEnabled = TRUE;
-	settings->AltSecFrameMarkerSupport = TRUE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_AsyncChannels, FALSE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_AsyncUpdate, FALSE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_IgnoreCertificate, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_ExternalCertificateManagement, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_RdpSecurity, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_TlsSecurity, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_NlaSecurity, FALSE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_BitmapCacheEnabled, FALSE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_BitmapCacheV3Enabled, FALSE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_OffscreenSupportLevel, FALSE))
+		return FALSE;
+	if (!freerdp_settings_set_uint32(settings, FreeRDP_GlyphSupportLevel, GLYPH_SUPPORT_NONE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_BrushSupportLevel, FALSE))
+		return FALSE;
+	ZeroMemory(freerdp_settings_get_pointer_writeable(settings, FreeRDP_OrderSupport), 32);
+	if (!freerdp_settings_set_bool(settings, FreeRDP_FrameMarkerCommandEnabled, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_SurfaceFrameMarkerEnabled, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_AltSecFrameMarkerSupport, TRUE))
+		return FALSE;
 	if (!freerdp_settings_set_uint32(settings, FreeRDP_ColorDepth, 32))
 		return FALSE;
-	settings->NSCodec = TRUE;
-	settings->RemoteFxCodec = TRUE;
-	settings->FastPathInput = TRUE;
-	settings->FastPathOutput = TRUE;
-	settings->LargePointerFlag = TRUE;
-	settings->CompressionEnabled = FALSE;
-	settings->AutoReconnectionEnabled = FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_NSCodec, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_RemoteFxCodec, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_FastPathInput, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_FastPathOutput, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_LargePointerFlag, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_CompressionEnabled, FALSE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_AutoReconnectionEnabled, FALSE))
+		return FALSE;
 	if (!freerdp_settings_set_bool(settings, FreeRDP_NetworkAutoDetect, FALSE))
 		return FALSE;
-	settings->SupportHeartbeatPdu = FALSE;
-	settings->SupportMultitransport = FALSE;
-	settings->ConnectionType = CONNECTION_TYPE_LAN;
-	settings->AllowFontSmoothing = TRUE;
-	settings->AllowDesktopComposition = TRUE;
-	settings->DisableWallpaper = FALSE;
-	settings->DisableFullWindowDrag = TRUE;
-	settings->DisableMenuAnims = TRUE;
-	settings->DisableThemes = FALSE;
-	settings->DeviceRedirection = TRUE;
-	settings->RedirectClipboard = TRUE;
-	settings->SupportDynamicChannels = TRUE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_SupportHeartbeatPdu, FALSE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_SupportMultitransport, FALSE))
+		return FALSE;
+	if (!freerdp_settings_set_uint32(settings, FreeRDP_ConnectionType, CONNECTION_TYPE_LAN))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_AllowFontSmoothing, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_AllowDesktopComposition, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_DisableWallpaper, FALSE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_DisableFullWindowDrag, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_DisableMenuAnims, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_DisableThemes, FALSE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_DeviceRedirection, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_RedirectClipboard, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_SupportDynamicChannels, TRUE))
+		return FALSE;
 	return TRUE;
 }
 
diff --git a/server/shadow/shadow_channels.c b/server/shadow/shadow_channels.c
index 199600f1f..07c51051a 100644
--- a/server/shadow/shadow_channels.c
+++ b/server/shadow/shadow_channels.c
@@ -41,7 +41,7 @@ UINT shadow_client_channels_post_connect(rdpShadowClient* client)
 
 	shadow_client_audin_init(client);
 
-	if (client->context.settings->SupportGraphicsPipeline)
+	if (freerdp_settings_get_bool(client->context.settings, FreeRDP_SupportGraphicsPipeline))
 	{
 		shadow_client_rdpgfx_init(client);
 	}
@@ -51,7 +51,7 @@ UINT shadow_client_channels_post_connect(rdpShadowClient* client)
 
 void shadow_client_channels_free(rdpShadowClient* client)
 {
-	if (client->context.settings->SupportGraphicsPipeline)
+	if (freerdp_settings_get_bool(client->context.settings, FreeRDP_SupportGraphicsPipeline))
 	{
 		shadow_client_rdpgfx_uninit(client);
 	}
diff --git a/server/shadow/shadow_client.c b/server/shadow/shadow_client.c
index 31f111238..e7d6b1614 100644
--- a/server/shadow/shadow_client.c
+++ b/server/shadow/shadow_client.c
@@ -56,10 +56,10 @@ static INLINE BOOL shadow_client_rdpgfx_new_surface(rdpShadowClient* client)
 	settings = ((rdpContext*)client)->settings;
 	WINPR_ASSERT(settings);
 
-	WINPR_ASSERT(settings->DesktopWidth <= UINT16_MAX);
-	WINPR_ASSERT(settings->DesktopHeight <= UINT16_MAX);
-	createSurface.width = (UINT16)settings->DesktopWidth;
-	createSurface.height = (UINT16)settings->DesktopHeight;
+	WINPR_ASSERT(freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth) <= UINT16_MAX);
+	WINPR_ASSERT(freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight) <= UINT16_MAX);
+	createSurface.width = (UINT16)freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth);
+	createSurface.height = (UINT16)freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight);
 	createSurface.pixelFormat = GFX_PIXEL_FORMAT_XRGB_8888;
 	createSurface.surfaceId = client->surfaceId;
 	surfaceToOutput.outputOriginX = 0;
@@ -124,8 +124,8 @@ static INLINE BOOL shadow_client_rdpgfx_reset_graphic(rdpShadowClient* client)
 	settings = client->context.settings;
 	WINPR_ASSERT(settings);
 
-	pdu.width = settings->DesktopWidth;
-	pdu.height = settings->DesktopHeight;
+	pdu.width = freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth);
+	pdu.height = freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight);
 	pdu.monitorCount = client->subsystem->numMonitors;
 	pdu.monitorDefArray = client->subsystem->monitors;
 	IFCALLRET(context->ResetGraphics, error, context, &pdu);
@@ -210,23 +210,38 @@ static BOOL shadow_client_context_new(freerdp_peer* peer, rdpContext* context)
 	                                 freerdp_settings_get_uint32(srvSettings, FreeRDP_ColorDepth)))
 		return FALSE;
 	NSCodec = freerdp_settings_get_bool(srvSettings, FreeRDP_NSCodec);
-	freerdp_settings_set_bool(settings, FreeRDP_NSCodec, NSCodec);
-	settings->RemoteFxCodec = srvSettings->RemoteFxCodec;
-	settings->BitmapCacheV3Enabled = TRUE;
-	settings->FrameMarkerCommandEnabled = TRUE;
-	settings->SurfaceFrameMarkerEnabled = TRUE;
-	settings->SupportGraphicsPipeline = TRUE;
-	settings->GfxH264 = srvSettings->GfxH264;
-	settings->DrawAllowSkipAlpha = TRUE;
-	settings->DrawAllowColorSubsampling = TRUE;
-	settings->DrawAllowDynamicColorFidelity = TRUE;
-	settings->CompressionLevel = PACKET_COMPR_TYPE_RDP8;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_NSCodec, NSCodec))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_RemoteFxCodec,
+	                               freerdp_settings_get_bool(srvSettings, FreeRDP_RemoteFxCodec)))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_BitmapCacheV3Enabled, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_FrameMarkerCommandEnabled, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_SurfaceFrameMarkerEnabled, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_SupportGraphicsPipeline, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_GfxH264,
+	                               freerdp_settings_get_bool(srvSettings, FreeRDP_GfxH264)))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_DrawAllowSkipAlpha, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_DrawAllowColorSubsampling, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_bool(settings, FreeRDP_DrawAllowDynamicColorFidelity, TRUE))
+		return FALSE;
+	if (!freerdp_settings_set_uint32(settings, FreeRDP_CompressionLevel, PACKET_COMPR_TYPE_RDP8))
+		return FALSE;
 
 	if (server->ipcSocket && (strncmp(bind_address, server->ipcSocket,
 	                                  strnlen(bind_address, sizeof(bind_address))) != 0))
 	{
-		settings->LyncRdpMode = TRUE;
-		settings->CompressionEnabled = FALSE;
+		if (!freerdp_settings_set_bool(settings, FreeRDP_LyncRdpMode, TRUE))
+			return FALSE;
+		if (!freerdp_settings_set_bool(settings, FreeRDP_CompressionEnabled, FALSE))
+			return FALSE;
 	}
 
 	client->inLobby = TRUE;
@@ -285,10 +300,10 @@ static INLINE void shadow_client_mark_invalid(rdpShadowClient* client, UINT32 nu
 	{
 		screenRegion.left = 0;
 		screenRegion.top = 0;
-		WINPR_ASSERT(settings->DesktopWidth <= UINT16_MAX);
-		WINPR_ASSERT(settings->DesktopHeight <= UINT16_MAX);
-		screenRegion.right = (UINT16)settings->DesktopWidth;
-		screenRegion.bottom = (UINT16)settings->DesktopHeight;
+		WINPR_ASSERT(freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth) <= UINT16_MAX);
+		WINPR_ASSERT(freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight) <= UINT16_MAX);
+		screenRegion.right = (UINT16)freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth);
+		screenRegion.bottom = (UINT16)freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight);
 		region16_union_rect(&(client->invalidRegion), &(client->invalidRegion), &screenRegion);
 	}
 
@@ -333,7 +348,8 @@ static INLINE BOOL shadow_client_recalc_desktop_size(rdpShadowClient* client)
 	WINPR_ASSERT(width <= UINT16_MAX);
 	WINPR_ASSERT(height >= 0);
 	WINPR_ASSERT(height <= UINT16_MAX);
-	if (settings->DesktopWidth != (UINT32)width || settings->DesktopHeight != (UINT32)height)
+	if (freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth) != (UINT32)width ||
+	    freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight) != (UINT32)height)
 		return TRUE;
 
 	return FALSE;
@@ -449,7 +465,9 @@ static BOOL shadow_client_post_connect(freerdp_peer* peer)
 			return FALSE;
 	}
 
-	if (settings->MultifragMaxRequestSize < 0x3F0000)
+	const UINT32 MultifragMaxRequestSize =
+	    freerdp_settings_get_uint32(settings, FreeRDP_MultifragMaxRequestSize);
+	if (MultifragMaxRequestSize < 0x3F0000)
 	{
 		BOOL rc = freerdp_settings_set_bool(
 		    settings, FreeRDP_NSCodec,
@@ -458,7 +476,8 @@ static BOOL shadow_client_post_connect(freerdp_peer* peer)
 	}
 
 	WLog_INFO(TAG, "Client from %s is activated (%" PRIu32 "x%" PRIu32 "@%" PRIu32 ")",
-	          peer->hostname, settings->DesktopWidth, settings->DesktopHeight,
+	          peer->hostname, freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth),
+	          freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight),
 	          freerdp_settings_get_uint32(settings, FreeRDP_ColorDepth));
 
 	if (shadow_client_channels_post_connect(client) != CHANNEL_RC_OK)
@@ -467,15 +486,21 @@ static BOOL shadow_client_post_connect(freerdp_peer* peer)
 	shadow_client_mark_invalid(client, 0, NULL);
 	authStatus = -1;
 
-	if (settings->Username && settings->Password)
-		settings->AutoLogonEnabled = TRUE;
+	const char* Username = freerdp_settings_get_string(settings, FreeRDP_Username);
+	const char* Domain = freerdp_settings_get_string(settings, FreeRDP_Domain);
+	const char* Password = freerdp_settings_get_string(settings, FreeRDP_Password);
 
-	if (server->authentication && !settings->NlaSecurity)
+	if (Username && Password)
+	{
+		if (!freerdp_settings_set_bool(settings, FreeRDP_AutoLogonEnabled, TRUE))
+			return FALSE;
+	}
+
+	if (server->authentication && !freerdp_settings_get_bool(settings, FreeRDP_NlaSecurity))
 	{
 		if (subsystem->Authenticate)
 		{
-			authStatus = subsystem->Authenticate(subsystem, client, settings->Username,
-			                                     settings->Domain, settings->Password);
+			authStatus = subsystem->Authenticate(subsystem, client, Username, Domain, Password);
 		}
 
 		if (authStatus < 0)
@@ -744,19 +769,17 @@ shadow_client_rdpgfx_frame_acknowledge(RdpgfxServerContext* context,
 
 static BOOL shadow_are_caps_filtered(const rdpSettings* settings, UINT32 caps)
 {
-	UINT32 filter;
 	const UINT32 capList[] = { RDPGFX_CAPVERSION_8,   RDPGFX_CAPVERSION_81,
 		                       RDPGFX_CAPVERSION_10,  RDPGFX_CAPVERSION_101,
 		                       RDPGFX_CAPVERSION_102, RDPGFX_CAPVERSION_103,
 		                       RDPGFX_CAPVERSION_104, RDPGFX_CAPVERSION_105,
 		                       RDPGFX_CAPVERSION_106, RDPGFX_CAPVERSION_106_ERR,
 		                       RDPGFX_CAPVERSION_107 };
-	UINT32 x;
 
 	WINPR_ASSERT(settings);
-	filter = settings->GfxCapsFilter;
+	const UINT32 filter = freerdp_settings_get_uint32(settings, FreeRDP_GfxCapsFilter);
 
-	for (x = 0; x < ARRAYSIZE(capList); x++)
+	for (UINT32 x = 0; x < ARRAYSIZE(capList); x++)
 	{
 		if (caps == capList[x])
 			return (filter & (1 << x)) != 0;
@@ -818,29 +841,38 @@ static BOOL shadow_client_caps_test_version(RdpgfxServerContext* context, rdpSha
 
 			flags = pdu.capsSet->flags;
 
-			clientSettings->GfxSmallCache = (flags & RDPGFX_CAPS_FLAG_SMALL_CACHE) ? TRUE : FALSE;
+			if (!freerdp_settings_set_bool(clientSettings, FreeRDP_GfxSmallCache,
+			                               (flags & RDPGFX_CAPS_FLAG_SMALL_CACHE) ? TRUE : FALSE))
+				return FALSE;
 
 			avc444v2 = avc444 = !(flags & RDPGFX_CAPS_FLAG_AVC_DISABLED);
 			if (!freerdp_settings_get_bool(srvSettings, FreeRDP_GfxAVC444v2) || !h264)
 				avc444v2 = FALSE;
-			freerdp_settings_set_bool(clientSettings, FreeRDP_GfxAVC444v2, avc444v2);
+			if (!freerdp_settings_set_bool(clientSettings, FreeRDP_GfxAVC444v2, avc444v2))
+				return FALSE;
 			if (!freerdp_settings_get_bool(srvSettings, FreeRDP_GfxAVC444) || !h264)
 				avc444 = FALSE;
-			freerdp_settings_set_bool(clientSettings, FreeRDP_GfxAVC444, avc444);
+			if (!freerdp_settings_set_bool(clientSettings, FreeRDP_GfxAVC444, avc444))
+				return FALSE;
 			if (!freerdp_settings_get_bool(srvSettings, FreeRDP_GfxH264) || !h264)
 				avc420 = FALSE;
-			freerdp_settings_set_bool(clientSettings, FreeRDP_GfxH264, avc420);
+			if (!freerdp_settings_set_bool(clientSettings, FreeRDP_GfxH264, avc420))
+				return FALSE;
 
 			progressive = freerdp_settings_get_bool(srvSettings, FreeRDP_GfxProgressive);
-			freerdp_settings_set_bool(clientSettings, FreeRDP_GfxProgressive, progressive);
+			if (!freerdp_settings_set_bool(clientSettings, FreeRDP_GfxProgressive, progressive))
+				return FALSE;
 			progressive = freerdp_settings_get_bool(srvSettings, FreeRDP_GfxProgressiveV2);
-			freerdp_settings_set_bool(clientSettings, FreeRDP_GfxProgressiveV2, progressive);
+			if (!freerdp_settings_set_bool(clientSettings, FreeRDP_GfxProgressiveV2, progressive))
+				return FALSE;
 
 			rfx = freerdp_settings_get_bool(srvSettings, FreeRDP_RemoteFxCodec);
-			freerdp_settings_set_bool(clientSettings, FreeRDP_RemoteFxCodec, rfx);
+			if (!freerdp_settings_set_bool(clientSettings, FreeRDP_RemoteFxCodec, rfx))
+				return FALSE;
 
 			planar = freerdp_settings_get_bool(srvSettings, FreeRDP_GfxPlanar);
-			freerdp_settings_set_bool(clientSettings, FreeRDP_GfxPlanar, planar);
+			if (!freerdp_settings_set_bool(clientSettings, FreeRDP_GfxPlanar, planar))
+				return FALSE;
 
 			if (!avc444v2 && !avc444 && !avc420)
 				pdu.capsSet->flags |= RDPGFX_CAPS_FLAG_AVC_DISABLED;
@@ -1063,12 +1095,15 @@ static BOOL shadow_client_send_surface_gfx(rdpShadowClient* client, const BYTE*
 
 	id = freerdp_settings_get_uint32(settings, FreeRDP_RemoteFxCodecId);
 #ifdef WITH_GFX_H264
-	if (settings->GfxAVC444 || settings->GfxAVC444v2)
+	const BOOL GfxH264 = freerdp_settings_get_bool(settings, FreeRDP_GfxH264);
+	const BOOL GfxAVC444 = freerdp_settings_get_bool(settings, FreeRDP_GfxAVC444);
+	const BOOL GfxAVC444v2 = freerdp_settings_get_bool(settings, FreeRDP_GfxAVC444v2);
+	if (GfxAVC444 || GfxAVC444v2)
 	{
 		INT32 rc;
 		RDPGFX_AVC444_BITMAP_STREAM avc444 = { 0 };
 		RECTANGLE_16 regionRect = { 0 };
-		BYTE version = settings->GfxAVC444v2 ? 2 : 1;
+		BYTE version = GfxAVC444v2 ? 2 : 1;
 
 		if (shadow_encoder_prepare(encoder, FREERDP_CODEC_AVC444) < 0)
 		{
@@ -1099,7 +1134,7 @@ static BOOL shadow_client_send_surface_gfx(rdpShadowClient* client, const BYTE*
 		if (rc > 0)
 		{
 			avc444.cbAvc420EncodedBitstream1 = rdpgfx_estimate_h264_avc420(&avc444.bitstream[0]);
-			cmd.codecId = settings->GfxAVC444v2 ? RDPGFX_CODECID_AVC444v2 : RDPGFX_CODECID_AVC444;
+			cmd.codecId = GfxAVC444v2 ? RDPGFX_CODECID_AVC444v2 : RDPGFX_CODECID_AVC444;
 			cmd.extra = (void*)&avc444;
 			IFCALLRET(client->rdpgfx->SurfaceFrameCommand, error, client->rdpgfx, &cmd, &cmdstart,
 			          &cmdend);
@@ -1113,7 +1148,7 @@ static BOOL shadow_client_send_surface_gfx(rdpShadowClient* client, const BYTE*
 			return FALSE;
 		}
 	}
-	else if (settings->GfxH264)
+	else if (GfxH264)
 	{
 		INT32 rc;
 		RDPGFX_AVC420_BITMAP_STREAM avc420 = { 0 };
@@ -1375,9 +1410,13 @@ static BOOL shadow_client_send_surface_bits(rdpShadowClient* client, BYTE* pSrcD
 		rect.width = nWidth;
 		rect.height = nHeight;
 
-		RFX_MESSAGE_LIST* messages = rfx_encode_messages(
-		    encoder->rfx, &rect, 1, pSrcData, settings->DesktopWidth, settings->DesktopHeight,
-		    nSrcStep, &numMessages, settings->MultifragMaxRequestSize);
+		const UINT32 MultifragMaxRequestSize =
+		    freerdp_settings_get_uint32(settings, FreeRDP_MultifragMaxRequestSize);
+		RFX_MESSAGE_LIST* messages =
+		    rfx_encode_messages(encoder->rfx, &rect, 1, pSrcData,
+		                        freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth),
+		                        freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight),
+		                        nSrcStep, &numMessages, MultifragMaxRequestSize);
 		if (!messages)
 		{
 			WLog_ERR(TAG, "rfx_encode_messages failed");
@@ -1389,14 +1428,14 @@ static BOOL shadow_client_send_surface_bits(rdpShadowClient* client, BYTE* pSrcD
 		cmd.bmp.codecID = (UINT16)rfxID;
 		cmd.destLeft = 0;
 		cmd.destTop = 0;
-		cmd.destRight = settings->DesktopWidth;
-		cmd.destBottom = settings->DesktopHeight;
+		cmd.destRight = freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth);
+		cmd.destBottom = freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight);
 		cmd.bmp.bpp = 32;
 		cmd.bmp.flags = 0;
-		WINPR_ASSERT(settings->DesktopWidth <= UINT16_MAX);
-		WINPR_ASSERT(settings->DesktopHeight <= UINT16_MAX);
-		cmd.bmp.width = (UINT16)settings->DesktopWidth;
-		cmd.bmp.height = (UINT16)settings->DesktopHeight;
+		WINPR_ASSERT(freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth) <= UINT16_MAX);
+		WINPR_ASSERT(freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight) <= UINT16_MAX);
+		cmd.bmp.width = (UINT16)freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth);
+		cmd.bmp.height = (UINT16)freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight);
 		cmd.skipCompression = TRUE;
 
 		for (size_t i = 0; i < numMessages; i++)
@@ -1496,7 +1535,6 @@ static BOOL shadow_client_send_bitmap_update(rdpShadowClient* client, BYTE* pSrc
 	rdpUpdate* update;
 	rdpContext* context = (rdpContext*)client;
 	rdpSettings* settings;
-	UINT32 maxUpdateSize;
 	UINT32 totalBitmapSize;
 	UINT32 updateSizeEstimate;
 	BITMAP_DATA* bitmapData;
@@ -1513,8 +1551,8 @@ static BOOL shadow_client_send_bitmap_update(rdpShadowClient* client, BYTE* pSrc
 	if (!update || !settings || !encoder)
 		return FALSE;
 
-	maxUpdateSize = settings->MultifragMaxRequestSize;
-
+	const UINT32 maxUpdateSize =
+	    freerdp_settings_get_uint32(settings, FreeRDP_MultifragMaxRequestSize);
 	if (freerdp_settings_get_uint32(settings, FreeRDP_ColorDepth) < 32)
 	{
 		if (shadow_encoder_prepare(encoder, FREERDP_CODEC_INTERLEAVED) < 0)
@@ -1791,13 +1829,13 @@ static BOOL shadow_client_send_surface_update(rdpShadowClient* client, SHADOW_GF
 	// PRId64 " height: %" PRId64 " right: %" PRId64 " bottom: %" PRId64, 	nXSrc, nYSrc, nWidth,
 	// nHeight, nXSrc + nWidth, nYSrc + nHeight);
 
-	if (settings->SupportGraphicsPipeline)
+	if (freerdp_settings_get_bool(settings, FreeRDP_SupportGraphicsPipeline))
 	{
 		if (pStatus->gfxOpened)
 		{
 			/* GFX/h264 always full screen encoded */
-			nWidth = settings->DesktopWidth;
-			nHeight = settings->DesktopHeight;
+			nWidth = freerdp_settings_get_uint32(settings, FreeRDP_DesktopWidth);
+			nHeight = freerdp_settings_get_uint32(settings, FreeRDP_DesktopHeight);
 
 			/* Create primary surface if have not */
 			if (!pStatus->gfxSurfaceCreated)
@@ -1824,7 +1862,8 @@ static BOOL shadow_client_send_surface_update(rdpShadowClient* client, SHADOW_GF
 			ret = TRUE;
 		}
 	}
-	else if (settings->RemoteFxCodec || freerdp_settings_get_bool(settings, FreeRDP_NSCodec))
+	else if (freerdp_settings_get_bool(settings, FreeRDP_RemoteFxCodec) ||
+	         freerdp_settings_get_bool(settings, FreeRDP_NSCodec))
 	{
 		WINPR_ASSERT(nXSrc >= 0);
 		WINPR_ASSERT(nXSrc <= UINT16_MAX);
@@ -2247,7 +2286,8 @@ static DWORD WINAPI shadow_client_thread(LPVOID arg)
 #endif
 
 					/* Init RDPGFX dynamic channel */
-					if (settings->SupportGraphicsPipeline && client->rdpgfx && !gfxstatus.gfxOpened)
+					if (freerdp_settings_get_bool(settings, FreeRDP_SupportGraphicsPipeline) &&
+					    client->rdpgfx && !gfxstatus.gfxOpened)
 					{
 						client->rdpgfx->FrameAcknowledge = shadow_client_rdpgfx_frame_acknowledge;
 						client->rdpgfx->CapsAdvertise = shadow_client_rdpgfx_caps_advertise;
@@ -2255,7 +2295,9 @@ static DWORD WINAPI shadow_client_thread(LPVOID arg)
 						if (!client->rdpgfx->Open(client->rdpgfx))
 						{
 							WLog_WARN(TAG, "Failed to open GraphicsPipeline");
-							settings->SupportGraphicsPipeline = FALSE;
+							if (!freerdp_settings_set_bool(settings,
+							                               FreeRDP_SupportGraphicsPipeline, FALSE))
+								goto fail;
 						}
 						else
 						{
diff --git a/server/shadow/shadow_encoder.c b/server/shadow/shadow_encoder.c
index b42648f94..d357e87ee 100644
--- a/server/shadow/shadow_encoder.c
+++ b/server/shadow/shadow_encoder.c
@@ -132,7 +132,8 @@ static int shadow_encoder_uninit_grid(rdpShadowEncoder* encoder)
 static int shadow_encoder_init_rfx(rdpShadowEncoder* encoder)
 {
 	if (!encoder->rfx)
-		encoder->rfx = rfx_context_new_ex(TRUE, encoder->server->settings->ThreadingFlags);
+		encoder->rfx = rfx_context_new_ex(
+		    TRUE, freerdp_settings_get_uint32(encoder->server->settings, FreeRDP_ThreadingFlags));
 
 	if (!encoder->rfx)
 		goto fail;
@@ -163,14 +164,17 @@ static int shadow_encoder_init_nsc(rdpShadowEncoder* encoder)
 	if (!nsc_context_reset(encoder->nsc, encoder->width, encoder->height))
 		goto fail;
 
-	if (!nsc_context_set_parameters(encoder->nsc, NSC_COLOR_LOSS_LEVEL,
-	                                settings->NSCodecColorLossLevel))
+	if (!nsc_context_set_parameters(
+	        encoder->nsc, NSC_COLOR_LOSS_LEVEL,
+	        freerdp_settings_get_uint32(settings, FreeRDP_NSCodecColorLossLevel)))
 		goto fail;
-	if (!nsc_context_set_parameters(encoder->nsc, NSC_ALLOW_SUBSAMPLING,
-	                                (UINT32)settings->NSCodecAllowSubsampling))
+	if (!nsc_context_set_parameters(
+	        encoder->nsc, NSC_ALLOW_SUBSAMPLING,
+	        freerdp_settings_get_bool(settings, FreeRDP_NSCodecAllowSubsampling)))
 		goto fail;
-	if (!nsc_context_set_parameters(encoder->nsc, NSC_DYNAMIC_COLOR_FIDELITY,
-	                                (UINT32)settings->NSCodecAllowDynamicColorFidelity))
+	if (!nsc_context_set_parameters(
+	        encoder->nsc, NSC_DYNAMIC_COLOR_FIDELITY,
+	        !freerdp_settings_get_bool(settings, FreeRDP_NSCodecAllowDynamicColorFidelity)))
 		goto fail;
 	if (!nsc_context_set_parameters(encoder->nsc, NSC_COLOR_FORMAT, PIXEL_FORMAT_BGRX32))
 		goto fail;
@@ -187,7 +191,7 @@ static int shadow_encoder_init_planar(rdpShadowEncoder* encoder)
 	rdpContext* context = (rdpContext*)encoder->client;
 	rdpSettings* settings = context->settings;
 
-	if (settings->DrawAllowSkipAlpha)
+	if (freerdp_settings_get_bool(settings, FreeRDP_DrawAllowSkipAlpha))
 		planarFlags |= PLANAR_FORMAT_HEADER_NA;
 
 	planarFlags |= PLANAR_FORMAT_HEADER_RLE;
@@ -418,7 +422,7 @@ int shadow_encoder_reset(rdpShadowEncoder* encoder)
 	encoder->maxFps = 32;
 	encoder->frameId = 0;
 	encoder->lastAckframeId = 0;
-	encoder->frameAck = settings->SurfaceFrameMarkerEnabled;
+	encoder->frameAck = freerdp_settings_get_bool(settings, FreeRDP_SurfaceFrameMarkerEnabled);
 	return 1;
 }
 
diff --git a/server/shadow/shadow_server.c b/server/shadow/shadow_server.c
index 7d53c8bb7..b55b4042b 100644
--- a/server/shadow/shadow_server.c
+++ b/server/shadow/shadow_server.c
@@ -311,32 +311,49 @@ int shadow_server_parse_command_line(rdpShadowServer* server, int argc, char** a
 		{
 			if (strcmp("rdp", arg->Value) == 0) /* Standard RDP */
 			{
-				settings->RdpSecurity = TRUE;
-				settings->TlsSecurity = FALSE;
-				settings->NlaSecurity = FALSE;
-				settings->ExtSecurity = FALSE;
-				settings->UseRdpSecurityLayer = TRUE;
+				if (!freerdp_settings_set_bool(settings, FreeRDP_RdpSecurity, TRUE))
+					return COMMAND_LINE_ERROR;
+				if (!freerdp_settings_set_bool(settings, FreeRDP_TlsSecurity, FALSE))
+					return COMMAND_LINE_ERROR;
+				if (!freerdp_settings_set_bool(settings, FreeRDP_NlaSecurity, FALSE))
+					return COMMAND_LINE_ERROR;
+				if (!freerdp_settings_set_bool(settings, FreeRDP_ExtSecurity, FALSE))
+					return COMMAND_LINE_ERROR;
+				if (!freerdp_settings_set_bool(settings, FreeRDP_UseRdpSecurityLayer, TRUE))
+					return COMMAND_LINE_ERROR;
 			}
 			else if (strcmp("tls", arg->Value) == 0) /* TLS */
 			{
-				settings->RdpSecurity = FALSE;
-				settings->TlsSecurity = TRUE;
-				settings->NlaSecurity = FALSE;
-				settings->ExtSecurity = FALSE;
+				if (!freerdp_settings_set_bool(settings, FreeRDP_RdpSecurity, FALSE))
+					return COMMAND_LINE_ERROR;
+				if (!freerdp_settings_set_bool(settings, FreeRDP_TlsSecurity, TRUE))
+					return COMMAND_LINE_ERROR;
+				if (!freerdp_settings_set_bool(settings, FreeRDP_NlaSecurity, FALSE))
+					return COMMAND_LINE_ERROR;
+				if (!freerdp_settings_set_bool(settings, FreeRDP_ExtSecurity, FALSE))
+					return COMMAND_LINE_ERROR;
 			}
 			else if (strcmp("nla", arg->Value) == 0) /* NLA */
 			{
-				settings->RdpSecurity = FALSE;
-				settings->TlsSecurity = FALSE;
-				settings->NlaSecurity = TRUE;
-				settings->ExtSecurity = FALSE;
+				if (!freerdp_settings_set_bool(settings, FreeRDP_RdpSecurity, FALSE))
+					return COMMAND_LINE_ERROR;
+				if (!freerdp_settings_set_bool(settings, FreeRDP_TlsSecurity, FALSE))
+					return COMMAND_LINE_ERROR;
+				if (!freerdp_settings_set_bool(settings, FreeRDP_NlaSecurity, TRUE))
+					return COMMAND_LINE_ERROR;
+				if (!freerdp_settings_set_bool(settings, FreeRDP_ExtSecurity, FALSE))
+					return COMMAND_LINE_ERROR;
 			}
 			else if (strcmp("ext", arg->Value) == 0) /* NLA Extended */
 			{
-				settings->RdpSecurity = FALSE;
-				settings->TlsSecurity = FALSE;
-				settings->NlaSecurity = FALSE;
-				settings->ExtSecurity = TRUE;
+				if (!freerdp_settings_set_bool(settings, FreeRDP_RdpSecurity, FALSE))
+					return COMMAND_LINE_ERROR;
+				if (!freerdp_settings_set_bool(settings, FreeRDP_TlsSecurity, FALSE))
+					return COMMAND_LINE_ERROR;
+				if (!freerdp_settings_set_bool(settings, FreeRDP_NlaSecurity, FALSE))
+					return COMMAND_LINE_ERROR;
+				if (!freerdp_settings_set_bool(settings, FreeRDP_ExtSecurity, TRUE))
+					return COMMAND_LINE_ERROR;
 			}
 			else
 			{
@@ -345,19 +362,27 @@ int shadow_server_parse_command_line(rdpShadowServer* server, int argc, char** a
 		}
 		CommandLineSwitchCase(arg, "sec-rdp")
 		{
-			settings->RdpSecurity = arg->Value ? TRUE : FALSE;
+			if (!freerdp_settings_set_bool(settings, FreeRDP_RdpSecurity,
+			                               arg->Value ? TRUE : FALSE))
+				return COMMAND_LINE_ERROR;
 		}
 		CommandLineSwitchCase(arg, "sec-tls")
 		{
-			settings->TlsSecurity = arg->Value ? TRUE : FALSE;
+			if (!freerdp_settings_set_bool(settings, FreeRDP_TlsSecurity,
+			                               arg->Value ? TRUE : FALSE))
+				return COMMAND_LINE_ERROR;
 		}
 		CommandLineSwitchCase(arg, "sec-nla")
 		{
-			settings->NlaSecurity = arg->Value ? TRUE : FALSE;
+			if (!freerdp_settings_set_bool(settings, FreeRDP_NlaSecurity,
+			                               arg->Value ? TRUE : FALSE))
+				return COMMAND_LINE_ERROR;
 		}
 		CommandLineSwitchCase(arg, "sec-ext")
 		{
-			settings->ExtSecurity = arg->Value ? TRUE : FALSE;
+			if (!freerdp_settings_set_bool(settings, FreeRDP_ExtSecurity,
+			                               arg->Value ? TRUE : FALSE))
+				return COMMAND_LINE_ERROR;
 		}
 		CommandLineSwitchCase(arg, "sam-file")
 		{