diff --git a/client/Android/android_event.c b/client/Android/android_event.c
index 393098dbe..b423dde6f 100644
--- a/client/Android/android_event.c
+++ b/client/Android/android_event.c
@@ -80,31 +80,37 @@ static ANDROID_EVENT* android_pop_event(ANDROID_EVENT_QUEUE* queue)
 
 static BOOL android_process_event(ANDROID_EVENT_QUEUE* queue, freerdp* inst)
 {
-	ANDROID_EVENT* event;
-	rdpContext* context = inst->context;
-	androidContext* afc = (androidContext*)context;
+	rdpContext* context;
+
+	WINPR_ASSERT(queue);
+	WINPR_ASSERT(inst);
+
+	context = inst->context;
+	WINPR_ASSERT(context);
 
 	while (android_peek_event(queue))
 	{
-		event = android_pop_event(queue);
+		androidContext* afc = (androidContext*)context;
+		ANDROID_EVENT* event = android_pop_event(queue);
 
 		if (event->type == EVENT_TYPE_KEY)
 		{
 			ANDROID_EVENT_KEY* key_event = (ANDROID_EVENT_KEY*)event;
-			inst->input->KeyboardEvent(inst->input, key_event->flags, key_event->scancode);
+			context->input->KeyboardEvent(context->input, key_event->flags, key_event->scancode);
 			android_event_free((ANDROID_EVENT*)key_event);
 		}
 		else if (event->type == EVENT_TYPE_KEY_UNICODE)
 		{
 			ANDROID_EVENT_KEY* key_event = (ANDROID_EVENT_KEY*)event;
-			inst->input->UnicodeKeyboardEvent(inst->input, key_event->flags, key_event->scancode);
+			context->input->UnicodeKeyboardEvent(context->input, key_event->flags,
+			                                     key_event->scancode);
 			android_event_free((ANDROID_EVENT*)key_event);
 		}
 		else if (event->type == EVENT_TYPE_CURSOR)
 		{
 			ANDROID_EVENT_CURSOR* cursor_event = (ANDROID_EVENT_CURSOR*)event;
-			inst->input->MouseEvent(inst->input, cursor_event->flags, cursor_event->x,
-			                        cursor_event->y);
+			context->input->MouseEvent(context->input, cursor_event->flags, cursor_event->x,
+			                           cursor_event->y);
 			android_event_free((ANDROID_EVENT*)cursor_event);
 		}
 		else if (event->type == EVENT_TYPE_CLIPBOARD)
diff --git a/client/Android/android_freerdp.c b/client/Android/android_freerdp.c
index 95368f534..35abfb2de 100644
--- a/client/Android/android_freerdp.c
+++ b/client/Android/android_freerdp.c
@@ -22,6 +22,8 @@
 #include <stdlib.h>
 #include <errno.h>
 
+#include <winpr/assert.h>
+
 #include <freerdp/graphics.h>
 #include <freerdp/codec/rfx.h>
 #include <freerdp/gdi/gdi.h>
@@ -121,7 +123,7 @@ static BOOL android_end_paint(rdpContext* context)
 	if (!ctx || !context->instance)
 		return FALSE;
 
-	settings = context->instance->settings;
+	settings = context->settings;
 
 	if (!settings)
 		return FALSE;
@@ -169,8 +171,9 @@ static BOOL android_end_paint(rdpContext* context)
 
 static BOOL android_desktop_resize(rdpContext* context)
 {
-	if (!context || !context->instance || !context->settings)
-		return FALSE;
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(context->settings);
+	WINPR_ASSERT(context->instance);
 
 	freerdp_callback("OnGraphicsResize", "(JIII)V", (jlong)context->instance,
 	                 context->settings->DesktopWidth, context->settings->DesktopHeight,
@@ -183,10 +186,10 @@ static BOOL android_pre_connect(freerdp* instance)
 	int rc;
 	rdpSettings* settings;
 
-	if (!instance)
-		return FALSE;
+	WINPR_ASSERT(instance);
+	WINPR_ASSERT(instance->context);
 
-	settings = instance->settings;
+	settings = instance->context->settings;
 
 	if (!settings)
 		return FALSE;
@@ -209,7 +212,7 @@ static BOOL android_pre_connect(freerdp* instance)
 		return FALSE;
 	}
 
-	if (!freerdp_client_load_addins(instance->context->channels, instance->settings))
+	if (!freerdp_client_load_addins(instance->context->channels, instance->context->settings))
 	{
 		WLog_ERR(TAG, "Failed to load addins [%l08X]", GetLastError());
 		return FALSE;
@@ -221,46 +224,43 @@ static BOOL android_pre_connect(freerdp* instance)
 
 static BOOL android_Pointer_New(rdpContext* context, rdpPointer* pointer)
 {
-	if (!context || !pointer || !context->gdi)
-		return FALSE;
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(pointer);
+	WINPR_ASSERT(context->gdi);
 
 	return TRUE;
 }
 
 static void android_Pointer_Free(rdpContext* context, rdpPointer* pointer)
 {
-	if (!context || !pointer)
-		return;
+	WINPR_ASSERT(context);
 }
 
 static BOOL android_Pointer_Set(rdpContext* context, const rdpPointer* pointer)
 {
-	if (!context)
-		return FALSE;
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(pointer);
 
 	return TRUE;
 }
 
 static BOOL android_Pointer_SetPosition(rdpContext* context, UINT32 x, UINT32 y)
 {
-	if (!context)
-		return FALSE;
+	WINPR_ASSERT(context);
 
 	return TRUE;
 }
 
 static BOOL android_Pointer_SetNull(rdpContext* context)
 {
-	if (!context)
-		return FALSE;
+	WINPR_ASSERT(context);
 
 	return TRUE;
 }
 
 static BOOL android_Pointer_SetDefault(rdpContext* context)
 {
-	if (!context)
-		return FALSE;
+	WINPR_ASSERT(context);
 
 	return TRUE;
 }
@@ -288,11 +288,14 @@ static BOOL android_post_connect(freerdp* instance)
 	rdpSettings* settings;
 	rdpUpdate* update;
 
-	if (!instance || !instance->settings || !instance->context || !instance->update)
-		return FALSE;
+	WINPR_ASSERT(instance);
+	WINPR_ASSERT(instance->context);
 
-	update = instance->update;
-	settings = instance->settings;
+	update = instance->context->update;
+	WINPR_ASSERT(update);
+
+	settings = instance->context->settings;
+	WINPR_ASSERT(settings);
 
 	if (!gdi_init(instance, PIXEL_FORMAT_RGBX32))
 		return FALSE;
@@ -300,9 +303,9 @@ static BOOL android_post_connect(freerdp* instance)
 	if (!android_register_pointer(instance->context->graphics))
 		return FALSE;
 
-	instance->update->BeginPaint = android_begin_paint;
-	instance->update->EndPaint = android_end_paint;
-	instance->update->DesktopResize = android_desktop_resize;
+	update->BeginPaint = android_begin_paint;
+	update->EndPaint = android_end_paint;
+	update->DesktopResize = android_desktop_resize;
 	freerdp_callback("OnSettingsChanged", "(JIII)V", (jlong)instance, settings->DesktopWidth,
 	                 settings->DesktopHeight, settings->ColorDepth);
 	freerdp_callback("OnConnectionSuccess", "(J)V", (jlong)instance);
@@ -489,8 +492,8 @@ static DWORD WINAPI android_thread_func(LPVOID param)
 	freerdp* instance = param;
 	WLog_DBG(TAG, "Start...");
 
-	if (!instance || !instance->context)
-		goto fail;
+	WINPR_ASSERT(instance);
+	WINPR_ASSERT(instance->context);
 
 	if (freerdp_client_start(instance->context) != CHANNEL_RC_OK)
 		goto fail;
@@ -528,8 +531,8 @@ fail:
 
 static BOOL android_client_new(freerdp* instance, rdpContext* context)
 {
-	if (!instance || !context)
-		return FALSE;
+	WINPR_ASSERT(instance);
+	WINPR_ASSERT(context);
 
 	if (!android_event_queue_init(instance))
 		return FALSE;
@@ -708,7 +711,8 @@ static jboolean JNICALL jni_freerdp_parse_arguments(JNIEnv* env, jclass cls, jlo
 		(*env)->ReleaseStringUTFChars(env, str, raw);
 	}
 
-	status = freerdp_client_settings_parse_command_line(inst->settings, count, argv, FALSE);
+	status =
+	    freerdp_client_settings_parse_command_line(inst->context->settings, count, argv, FALSE);
 
 	for (i = 0; i < count; i++)
 		free(argv[i]);
diff --git a/client/Mac/MRDPView.m b/client/Mac/MRDPView.m
index fa95cdcf2..d04455aaa 100644
--- a/client/Mac/MRDPView.m
+++ b/client/Mac/MRDPView.m
@@ -28,6 +28,7 @@
 #import "CertificateDialog.h"
 
 #include <winpr/crt.h>
+#include <winpr/assert.h>
 #include <winpr/input.h>
 #include <winpr/synch.h>
 #include <winpr/sysinfo.h>
@@ -73,10 +74,17 @@ static DWORD WINAPI mac_client_thread(void *param);
 	rdpSettings *settings;
 	EmbedWindowEventArgs e;
 	[self initializeView];
+
+	WINPR_ASSERT(rdp_context);
 	context = rdp_context;
 	mfc = (mfContext *)rdp_context;
+
 	instance = context->instance;
+	WINPR_ASSERT(instance);
+
 	settings = context->settings;
+	WINPR_ASSERT(settings);
+
 	EventArgsInit(&e, "mfreerdp");
 	e.embed = TRUE;
 	e.handle = (void *)self;
@@ -84,10 +92,10 @@ static DWORD WINAPI mac_client_thread(void *param);
 	NSScreen *screen = [[NSScreen screens] objectAtIndex:0];
 	NSRect screenFrame = [screen frame];
 
-	if (instance->settings->Fullscreen)
+	if (settings->Fullscreen)
 	{
-		instance->settings->DesktopWidth = screenFrame.size.width;
-		instance->settings->DesktopHeight = screenFrame.size.height;
+		settings->DesktopWidth = screenFrame.size.width;
+		settings->DesktopHeight = screenFrame.size.height;
 		[self enterFullScreenMode:[NSScreen mainScreen] withOptions:nil];
 	}
 	else
@@ -95,8 +103,8 @@ static DWORD WINAPI mac_client_thread(void *param);
 		[self exitFullScreenModeWithOptions:nil];
 	}
 
-	mfc->client_height = instance->settings->DesktopHeight;
-	mfc->client_width = instance->settings->DesktopWidth;
+	mfc->client_height = settings->DesktopHeight;
+	mfc->client_width = settings->DesktopWidth;
 
 	if (!(mfc->common.thread =
 	          CreateThread(NULL, 0, mac_client_thread, (void *)context, 0, &mfc->mainThreadId)))
@@ -496,7 +504,8 @@ DWORD fixKeyCode(DWORD keyCode, unichar keyChar, enum APPLE_KEYBOARD_TYPE type)
 	         keyCode, scancode, vkcode, keyFlags, GetVirtualKeyName(vkcode));
 #endif
 	sync_keyboard_state(instance);
-	freerdp_input_send_keyboard_event(instance->input, keyFlags, scancode);
+	WINPR_ASSERT(instance->context);
+	freerdp_input_send_keyboard_event(instance->context->input, keyFlags, scancode);
 }
 
 - (void)keyUp:(NSEvent *)event
@@ -531,7 +540,8 @@ DWORD fixKeyCode(DWORD keyCode, unichar keyChar, enum APPLE_KEYBOARD_TYPE type)
 	         "keyUp: key: 0x%04X scancode: 0x%04X vkcode: 0x%04X keyFlags: %d name: %s",
 	         keyCode, scancode, vkcode, keyFlags, GetVirtualKeyName(vkcode));
 #endif
-	freerdp_input_send_keyboard_event(instance->input, keyFlags, scancode);
+	WINPR_ASSERT(instance->context);
+	freerdp_input_send_keyboard_event(instance->context->input, keyFlags, scancode);
 }
 
 - (void)flagsChanged:(NSEvent *)event
@@ -541,6 +551,7 @@ DWORD fixKeyCode(DWORD keyCode, unichar keyChar, enum APPLE_KEYBOARD_TYPE type)
 	DWORD vkcode;
 	DWORD scancode;
 	DWORD modFlags;
+	rdpInput *input;
 
 	if (!is_connected)
 		return;
@@ -581,40 +592,45 @@ DWORD fixKeyCode(DWORD keyCode, unichar keyChar, enum APPLE_KEYBOARD_TYPE type)
 
 #endif
 
+	WINPR_ASSERT(instance);
+	WINPR_ASSERT(instance->context);
+
+	input = instance->context->input;
+
 	if ((modFlags & NSEventModifierFlagCapsLock) && !(kbdModFlags & NSEventModifierFlagCapsLock))
-		freerdp_input_send_keyboard_event(instance->input, keyFlags | KBD_FLAGS_DOWN, scancode);
+		freerdp_input_send_keyboard_event(input, keyFlags | KBD_FLAGS_DOWN, scancode);
 	else if (!(modFlags & NSEventModifierFlagCapsLock) && (kbdModFlags & NSEventModifierFlagCapsLock))
-		freerdp_input_send_keyboard_event(instance->input, keyFlags | KBD_FLAGS_RELEASE, scancode);
+		freerdp_input_send_keyboard_event(input, keyFlags | KBD_FLAGS_RELEASE, scancode);
 
 	if ((modFlags & NSEventModifierFlagShift) && !(kbdModFlags & NSEventModifierFlagShift))
-		freerdp_input_send_keyboard_event(instance->input, keyFlags | KBD_FLAGS_DOWN, scancode);
+		freerdp_input_send_keyboard_event(input, keyFlags | KBD_FLAGS_DOWN, scancode);
 	else if (!(modFlags & NSEventModifierFlagShift) && (kbdModFlags & NSEventModifierFlagShift))
-		freerdp_input_send_keyboard_event(instance->input, keyFlags | KBD_FLAGS_RELEASE, scancode);
+		freerdp_input_send_keyboard_event(input, keyFlags | KBD_FLAGS_RELEASE, scancode);
 
 	if ((modFlags & NSEventModifierFlagControl) && !(kbdModFlags & NSEventModifierFlagControl))
-		freerdp_input_send_keyboard_event(instance->input, keyFlags | KBD_FLAGS_DOWN, scancode);
+		freerdp_input_send_keyboard_event(input, keyFlags | KBD_FLAGS_DOWN, scancode);
 	else if (!(modFlags & NSEventModifierFlagControl) && (kbdModFlags & NSEventModifierFlagControl))
-		freerdp_input_send_keyboard_event(instance->input, keyFlags | KBD_FLAGS_RELEASE, scancode);
+		freerdp_input_send_keyboard_event(input, keyFlags | KBD_FLAGS_RELEASE, scancode);
 
 	if ((modFlags & NSEventModifierFlagOption) && !(kbdModFlags & NSEventModifierFlagOption))
-		freerdp_input_send_keyboard_event(instance->input, keyFlags | KBD_FLAGS_DOWN, scancode);
+		freerdp_input_send_keyboard_event(input, keyFlags | KBD_FLAGS_DOWN, scancode);
 	else if (!(modFlags & NSEventModifierFlagOption) && (kbdModFlags & NSEventModifierFlagOption))
-		freerdp_input_send_keyboard_event(instance->input, keyFlags | KBD_FLAGS_RELEASE, scancode);
+		freerdp_input_send_keyboard_event(input, keyFlags | KBD_FLAGS_RELEASE, scancode);
 
 	if ((modFlags & NSEventModifierFlagCommand) && !(kbdModFlags & NSEventModifierFlagCommand))
-		freerdp_input_send_keyboard_event(instance->input, keyFlags | KBD_FLAGS_DOWN, scancode);
+		freerdp_input_send_keyboard_event(input, keyFlags | KBD_FLAGS_DOWN, scancode);
 	else if (!(modFlags & NSEventModifierFlagCommand) && (kbdModFlags & NSEventModifierFlagCommand))
-		freerdp_input_send_keyboard_event(instance->input, keyFlags | KBD_FLAGS_RELEASE, scancode);
+		freerdp_input_send_keyboard_event(input, keyFlags | KBD_FLAGS_RELEASE, scancode);
 
 	if ((modFlags & NSEventModifierFlagNumericPad) && !(kbdModFlags & NSEventModifierFlagNumericPad))
-		freerdp_input_send_keyboard_event(instance->input, keyFlags | KBD_FLAGS_DOWN, scancode);
+		freerdp_input_send_keyboard_event(input, keyFlags | KBD_FLAGS_DOWN, scancode);
 	else if (!(modFlags & NSEventModifierFlagNumericPad) && (kbdModFlags & NSEventModifierFlagNumericPad))
-		freerdp_input_send_keyboard_event(instance->input, keyFlags | KBD_FLAGS_RELEASE, scancode);
+		freerdp_input_send_keyboard_event(input, keyFlags | KBD_FLAGS_RELEASE, scancode);
 
 	if ((modFlags & NSEventModifierFlagHelp) && !(kbdModFlags & NSEventModifierFlagHelp))
-		freerdp_input_send_keyboard_event(instance->input, keyFlags | KBD_FLAGS_DOWN, scancode);
+		freerdp_input_send_keyboard_event(input, keyFlags | KBD_FLAGS_DOWN, scancode);
 	else if (!(modFlags & NSEventModifierFlagHelp) && (kbdModFlags & NSEventModifierFlagHelp))
-		freerdp_input_send_keyboard_event(instance->input, keyFlags | KBD_FLAGS_RELEASE, scancode);
+		freerdp_input_send_keyboard_event(input, keyFlags | KBD_FLAGS_RELEASE, scancode);
 
 	kbdModFlags = modFlags;
 }
@@ -817,15 +833,19 @@ static void mac_OnChannelDisconnectedEventHandler(void *context,
 BOOL mac_pre_connect(freerdp *instance)
 {
 	rdpSettings *settings;
+	rdpUpdate *update;
 
 	WINPR_ASSERT(instance);
-	WINPR_ASSERT(instance->update);
+	WINPR_ASSERT(instance->context);
 
-	instance->update->BeginPaint = mac_begin_paint;
-	instance->update->EndPaint = mac_end_paint;
-	instance->update->DesktopResize = mac_desktop_resize;
+	update = instance->context->update;
+	WINPR_ASSERT(update);
 
-	settings = instance->settings;
+	update->BeginPaint = mac_begin_paint;
+	update->EndPaint = mac_end_paint;
+	update->DesktopResize = mac_desktop_resize;
+
+	settings = instance->context->settings;
 	WINPR_ASSERT(settings);
 
 	if (!settings->ServerHostname)
@@ -840,7 +860,7 @@ BOOL mac_pre_connect(freerdp *instance)
 	PubSub_SubscribeChannelDisconnected(instance->context->pubSub,
 	                                    mac_OnChannelDisconnectedEventHandler);
 
-	if (!freerdp_client_load_addins(instance->context->channels, instance->settings))
+	if (!freerdp_client_load_addins(instance->context->channels, settings))
 		return FALSE;
 
 	return TRUE;
@@ -849,11 +869,18 @@ BOOL mac_pre_connect(freerdp *instance)
 BOOL mac_post_connect(freerdp *instance)
 {
 	rdpGdi *gdi;
-	rdpSettings *settings;
-	rdpPointer rdp_pointer;
-	mfContext *mfc = (mfContext *)instance->context;
-	MRDPView *view = (MRDPView *)mfc->view;
-	ZeroMemory(&rdp_pointer, sizeof(rdpPointer));
+	rdpPointer rdp_pointer = { 0 };
+	mfContext *mfc;
+	MRDPView *view;
+
+	WINPR_ASSERT(instance);
+
+	mfc = (mfContext *)instance->context;
+	WINPR_ASSERT(mfc);
+
+	view = (MRDPView *)mfc->view;
+	WINPR_ASSERT(view);
+
 	rdp_pointer.size = sizeof(rdpPointer);
 	rdp_pointer.New = mf_Pointer_New;
 	rdp_pointer.Free = mf_Pointer_Free;
@@ -861,7 +888,6 @@ BOOL mac_post_connect(freerdp *instance)
 	rdp_pointer.SetNull = mf_Pointer_SetNull;
 	rdp_pointer.SetDefault = mf_Pointer_SetDefault;
 	rdp_pointer.SetPosition = mf_Pointer_SetPosition;
-	settings = instance->settings;
 
 	if (!gdi_init(instance, PIXEL_FORMAT_BGRX32))
 		return FALSE;
@@ -958,21 +984,37 @@ static BOOL mac_authenticate_int(NSString *title, freerdp *instance, char **user
 
 BOOL mac_authenticate(freerdp *instance, char **username, char **password, char **domain)
 {
+	rdpSettings *settings;
+
+	WINPR_ASSERT(instance);
+	WINPR_ASSERT(instance->context);
+
+	settings = instance->context->settings;
+	WINPR_ASSERT(settings);
+
 	NSString *title =
 	    [NSString stringWithFormat:@"%@:%u",
-	                               [NSString stringWithCString:instance->settings->ServerHostname
+	                               [NSString stringWithCString:settings->ServerHostname
 	                                                  encoding:NSUTF8StringEncoding],
-	                               instance -> settings -> ServerPort];
+	                               settings -> ServerPort];
 	return mac_authenticate_int(title, instance, username, password, domain);
 }
 
 BOOL mac_gw_authenticate(freerdp *instance, char **username, char **password, char **domain)
 {
+	rdpSettings *settings;
+
+	WINPR_ASSERT(instance);
+	WINPR_ASSERT(instance->context);
+
+	settings = instance->context->settings;
+	WINPR_ASSERT(settings);
+
 	NSString *title =
 	    [NSString stringWithFormat:@"%@:%u",
-	                               [NSString stringWithCString:instance->settings->GatewayHostname
+	                               [NSString stringWithCString:settings->GatewayHostname
 	                                                  encoding:NSUTF8StringEncoding],
-	                               instance -> settings -> GatewayPort];
+	                               settings -> GatewayPort];
 	return mac_authenticate_int(title, instance, username, password, domain);
 }
 
@@ -1365,9 +1407,13 @@ void windows_to_apple_cords(MRDPView *view, NSRect *r)
 
 void sync_keyboard_state(freerdp *instance)
 {
-	mfContext *context = (mfContext *)instance->context;
 	UINT32 flags = 0;
 	CGEventFlags currentFlags = CGEventSourceFlagsState(kCGEventSourceStateHIDSystemState);
+	mfContext *context;
+
+	WINPR_ASSERT(instance);
+	context = (mfContext *)instance->context;
+	WINPR_ASSERT(context);
 
 	if (context->kbdFlags != currentFlags)
 	{
@@ -1377,7 +1423,7 @@ void sync_keyboard_state(freerdp *instance)
 		if (currentFlags & kCGEventFlagMaskNumericPad)
 			flags |= KBD_SYNC_NUM_LOCK;
 
-		freerdp_input_send_synchronize_event(instance->input, flags);
+		freerdp_input_send_synchronize_event(instance->context->input, flags);
 		context->kbdFlags = currentFlags;
 	}
 }
diff --git a/client/Mac/mf_client.m b/client/Mac/mf_client.m
index d4c0b82fc..281aee92c 100644
--- a/client/Mac/mf_client.m
+++ b/client/Mac/mf_client.m
@@ -81,7 +81,6 @@ static int mfreerdp_client_stop(rdpContext *context)
 static BOOL mfreerdp_client_new(freerdp *instance, rdpContext *context)
 {
 	mfContext *mfc;
-	rdpSettings *settings;
 
 	WINPR_ASSERT(instance);
 
@@ -97,8 +96,6 @@ static BOOL mfreerdp_client_new(freerdp *instance, rdpContext *context)
 	context->instance->VerifyCertificateEx = mac_verify_certificate_ex;
 	context->instance->VerifyChangedCertificateEx = mac_verify_changed_certificate_ex;
 	context->instance->LogonErrorInfo = mac_logon_error_info;
-	context->instance->settings = instance->settings;
-	settings = context->settings;
 	return TRUE;
 }
 
diff --git a/client/Sample/tf_freerdp.c b/client/Sample/tf_freerdp.c
index 9551ec3c6..fbf596b4c 100644
--- a/client/Sample/tf_freerdp.c
+++ b/client/Sample/tf_freerdp.c
@@ -141,8 +141,9 @@ static BOOL tf_pre_connect(freerdp* instance)
 	rdpSettings* settings;
 
 	WINPR_ASSERT(instance);
+	WINPR_ASSERT(instance->context);
 
-	settings = instance->settings;
+	settings = instance->context->settings;
 	WINPR_ASSERT(settings);
 
 	/* Optional OS identifier sent to server */
@@ -159,7 +160,7 @@ static BOOL tf_pre_connect(freerdp* instance)
 
 	/* Load all required plugins / channels / libraries specified by current
 	 * settings. */
-	if (!freerdp_client_load_addins(instance->context->channels, instance->settings))
+	if (!freerdp_client_load_addins(instance->context->channels, settings))
 		return FALSE;
 
 	/* TODO: Any code your client requires */
@@ -176,20 +177,28 @@ static BOOL tf_pre_connect(freerdp* instance)
  */
 static BOOL tf_post_connect(freerdp* instance)
 {
+	rdpContext* context;
+
 	if (!gdi_init(instance, PIXEL_FORMAT_XRGB32))
 		return FALSE;
 
+	context = instance->context;
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(context->update);
+
 	/* With this setting we disable all graphics processing in the library.
 	 *
 	 * This allows low resource (client) protocol parsing.
 	 */
-	freerdp_settings_set_bool(instance->settings, FreeRDP_DeactivateClientDecoding, TRUE);
-	instance->update->BeginPaint = tf_begin_paint;
-	instance->update->EndPaint = tf_end_paint;
-	instance->update->PlaySound = tf_play_sound;
-	instance->update->DesktopResize = tf_desktop_resize;
-	instance->update->SetKeyboardIndicators = tf_keyboard_set_indicators;
-	instance->update->SetKeyboardImeStatus = tf_keyboard_set_ime_status;
+	if (!freerdp_settings_set_bool(context->settings, FreeRDP_DeactivateClientDecoding, TRUE))
+		return FALSE;
+
+	context->update->BeginPaint = tf_begin_paint;
+	context->update->EndPaint = tf_end_paint;
+	context->update->PlaySound = tf_play_sound;
+	context->update->DesktopResize = tf_desktop_resize;
+	context->update->SetKeyboardIndicators = tf_keyboard_set_indicators;
+	context->update->SetKeyboardImeStatus = tf_keyboard_set_ime_status;
 	return TRUE;
 }
 
@@ -228,7 +237,9 @@ static DWORD WINAPI tf_client_thread_proc(LPVOID arg)
 	HANDLE handles[MAXIMUM_WAIT_OBJECTS] = { 0 };
 	BOOL rc = freerdp_connect(instance);
 
-	if (instance->settings->AuthenticationOnly)
+	WINPR_ASSERT(instance->context);
+	WINPR_ASSERT(instance->context->settings);
+	if (instance->context->settings->AuthenticationOnly)
 	{
 		result = freerdp_get_last_error(instance->context);
 		freerdp_abort_connect(instance);
diff --git a/client/Wayland/wlf_input.c b/client/Wayland/wlf_input.c
index b286ecd8e..eeac311f1 100644
--- a/client/Wayland/wlf_input.c
+++ b/client/Wayland/wlf_input.c
@@ -61,7 +61,7 @@ BOOL wlf_handle_pointer_enter(freerdp* instance, const UwacPointerEnterLeaveEven
 	uint32_t x, y;
 	rdpClientContext* cctx;
 
-	if (!instance || !ev || !instance->input)
+	if (!instance || !ev)
 		return FALSE;
 
 	x = ev->x;
@@ -245,7 +245,7 @@ BOOL wlf_handle_pointer_frame(freerdp* instance, const UwacPointerFrameEvent* ev
 	wlfContext* context;
 	enum wl_pointer_axis_source source = WL_POINTER_AXIS_SOURCE_CONTINUOUS;
 
-	if (!instance || !ev || !instance->input || !instance->context)
+	if (!instance || !ev || !instance->context)
 		return FALSE;
 
 	context = (wlfContext*)instance->context;
@@ -324,13 +324,14 @@ BOOL wlf_handle_key(freerdp* instance, const UwacKeyEvent* ev)
 	rdpInput* input;
 	DWORD rdp_scancode;
 
-	if (!instance || !ev || !instance->input)
+	if (!instance || !ev)
 		return FALSE;
 
+	WINPR_ASSERT(instance->context);
 	if (instance->context->settings->GrabKeyboard && ev->raw_key == KEY_RIGHTCTRL)
 		wlf_handle_ungrab_key(instance, ev);
 
-	input = instance->input;
+	input = instance->context->input;
 	rdp_scancode = freerdp_keyboard_get_rdp_scancode_from_x11_keycode(ev->raw_key + 8);
 
 	if (rdp_scancode == RDP_SCANCODE_UNKNOWN)
@@ -352,7 +353,7 @@ BOOL wlf_handle_ungrab_key(freerdp* instance, const UwacKeyEvent* ev)
 
 BOOL wlf_keyboard_enter(freerdp* instance, const UwacKeyboardEnterLeaveEvent* ev)
 {
-	if (!instance || !ev || !instance->input)
+	if (!instance || !ev)
 		return FALSE;
 
 	((wlfContext*)instance->context)->focusing = TRUE;
@@ -365,13 +366,15 @@ BOOL wlf_keyboard_modifiers(freerdp* instance, const UwacKeyboardModifiersEvent*
 	UINT16 syncFlags;
 	wlfContext* wlf;
 
-	if (!instance || !ev || !instance->input)
+	if (!instance || !ev)
 		return FALSE;
 
 	wlf = (wlfContext*)instance->context;
 	WINPR_ASSERT(wlf);
 
-	input = instance->input;
+	input = instance->context->input;
+	WINPR_ASSERT(input);
+
 	syncFlags = 0;
 
 	if (ev->modifiers & UWAC_MOD_CAPS_MASK)
diff --git a/client/Wayland/wlfreerdp.c b/client/Wayland/wlfreerdp.c
index 1219da288..540c16f11 100644
--- a/client/Wayland/wlfreerdp.c
+++ b/client/Wayland/wlfreerdp.c
@@ -177,10 +177,10 @@ static BOOL wl_pre_connect(freerdp* instance)
 		return FALSE;
 
 	context = (wlfContext*)instance->context;
-	settings = instance->settings;
+	WINPR_ASSERT(context);
 
-	if (!context || !settings)
-		return FALSE;
+	settings = instance->context->settings;
+	WINPR_ASSERT(settings);
 
 	settings->OsMajorType = OSMAJORTYPE_UNIX;
 	settings->OsMinorType = OSMINORTYPE_NATIVE_WAYLAND;
@@ -204,7 +204,7 @@ static BOOL wl_pre_connect(freerdp* instance)
 		}
 	}
 
-	if (!freerdp_client_load_addins(instance->context->channels, instance->settings))
+	if (!freerdp_client_load_addins(instance->context->channels, settings))
 		return FALSE;
 
 	return TRUE;
@@ -261,8 +261,8 @@ static BOOL wl_post_connect(freerdp* instance)
 	UwacWindowSetTitle(window, title);
 	UwacWindowSetAppId(window, app_id);
 	UwacWindowSetOpaqueRegion(context->window, 0, 0, w, h);
-	instance->update->EndPaint = wl_end_paint;
-	instance->update->DesktopResize = wl_resize_display;
+	instance->context->update->EndPaint = wl_end_paint;
+	instance->context->update->DesktopResize = wl_resize_display;
 	freerdp_keyboard_init_ex(instance->context->settings->KeyboardLayout,
 	                         instance->context->settings->KeyboardRemappingList);
 
@@ -442,13 +442,9 @@ static BOOL handle_uwac_events(freerdp* instance, UwacDisplay* display)
 
 static BOOL handle_window_events(freerdp* instance)
 {
-	rdpSettings* settings;
-
-	if (!instance || !instance->settings)
+	if (!instance)
 		return FALSE;
 
-	settings = instance->settings;
-
 	return TRUE;
 }
 
diff --git a/client/Windows/wf_client.c b/client/Windows/wf_client.c
index 52ebe5cbe..b6469e349 100644
--- a/client/Windows/wf_client.c
+++ b/client/Windows/wf_client.c
@@ -223,12 +223,13 @@ static BOOL wf_pre_connect(freerdp* instance)
 	rdpContext* context;
 	rdpSettings* settings;
 
-	if (!instance || !instance->context || !instance->settings)
-		return FALSE;
+	WINPR_ASSERT(instance);
+	WINPR_ASSERT(instance->context);
+	WINPR_ASSERT(instance->context->settings);
 
 	context = instance->context;
 	wfc = (wfContext*)instance->context;
-	settings = instance->settings;
+	settings = context->settings;
 	settings->OsMajorType = OSMAJORTYPE_WINDOWS;
 	settings->OsMinorType = OSMINORTYPE_WINDOWS_NT;
 	wfc->fullscreen = settings->Fullscreen;
@@ -272,7 +273,7 @@ static BOOL wf_pre_connect(freerdp* instance)
 		freerdp_settings_set_uint32(settings, FreeRDP_DesktopHeight, desktopHeight);
 	}
 
-	if (!freerdp_client_load_addins(context->channels, instance->settings))
+	if (!freerdp_client_load_addins(context->channels, context->settings))
 		return -1;
 
 	rc = freerdp_keyboard_init(freerdp_settings_get_uint32(settings, FreeRDP_KeyboardLayout));
@@ -359,10 +360,21 @@ static BOOL wf_post_connect(freerdp* instance)
 	rdpSettings* settings;
 	EmbedWindowEventArgs e;
 	const UINT32 format = PIXEL_FORMAT_BGRX32;
-	settings = instance->settings;
+
+	WINPR_ASSERT(instance);
+
 	context = instance->context;
+	WINPR_ASSERT(context);
+
+	settings = context->settings;
+	WINPR_ASSERT(settings);
+
 	wfc = (wfContext*)instance->context;
+	WINPR_ASSERT(wfc);
+
 	cache = instance->context->cache;
+	WINPR_ASSERT(cache);
+
 	wfc->primary = wf_image_new(wfc, settings->DesktopWidth, settings->DesktopHeight, format, NULL);
 
 	if (!gdi_init_ex(instance, format, 0, wfc->primary->pdata, NULL))
@@ -372,7 +384,7 @@ static BOOL wf_post_connect(freerdp* instance)
 
 	if (!settings->SoftwareGdi)
 	{
-		wf_gdi_register_update_callbacks(instance->update);
+		wf_gdi_register_update_callbacks(context->update);
 	}
 
 	wfc->window_title = wf_window_get_title(settings);
@@ -415,20 +427,20 @@ static BOOL wf_post_connect(freerdp* instance)
 	}
 #endif
 	UpdateWindow(wfc->hwnd);
-	instance->update->BeginPaint = wf_begin_paint;
-	instance->update->DesktopResize = wf_desktop_resize;
-	instance->update->EndPaint = wf_end_paint;
+	context->update->BeginPaint = wf_begin_paint;
+	context->update->DesktopResize = wf_desktop_resize;
+	context->update->EndPaint = wf_end_paint;
 	wf_register_pointer(context->graphics);
 
 	if (!settings->SoftwareGdi)
 	{
 		wf_register_graphics(context->graphics);
-		wf_gdi_register_update_callbacks(instance->update);
-		brush_cache_register_callbacks(instance->update);
-		glyph_cache_register_callbacks(instance->update);
-		bitmap_cache_register_callbacks(instance->update);
-		offscreen_cache_register_callbacks(instance->update);
-		palette_cache_register_callbacks(instance->update);
+		wf_gdi_register_update_callbacks(context->update);
+		brush_cache_register_callbacks(context->update);
+		glyph_cache_register_callbacks(context->update);
+		bitmap_cache_register_callbacks(context->update);
+		offscreen_cache_register_callbacks(context->update);
+		palette_cache_register_callbacks(context->update);
 	}
 
 	wfc->floatbar = wf_floatbar_new(wfc, wfc->hInstance, settings->Floatbar);
@@ -439,7 +451,7 @@ static void wf_post_disconnect(freerdp* instance)
 {
 	wfContext* wfc;
 
-	if (!instance || !instance->context || !instance->settings)
+	if (!instance || !instance->context)
 		return;
 
 	wfc = (wfContext*)instance->context;
@@ -461,8 +473,10 @@ static BOOL wf_authenticate_raw(freerdp* instance, const char* title, char** use
 	char User[CREDUI_MAX_USERNAME_LENGTH + 1] = { 0 };
 	char Domain[CREDUI_MAX_DOMAIN_TARGET_LENGTH + 1] = { 0 };
 
-	if (!instance || !instance->context)
-		return FALSE;
+	WINPR_ASSERT(instance);
+	WINPR_ASSERT(instance->context);
+	WINPR_ASSERT(instance->context->settings);
+
 	wfc = (wfContext*)instance->context;
 
 	fSave = FALSE;
@@ -546,14 +560,29 @@ static BOOL wf_authenticate_raw(freerdp* instance, const char* title, char** use
 
 static BOOL wf_authenticate(freerdp* instance, char** username, char** password, char** domain)
 {
-	return wf_authenticate_raw(instance, instance->settings->ServerHostname, username, password,
-	                           domain);
+	rdpSettings* settings;
+
+	WINPR_ASSERT(instance);
+	WINPR_ASSERT(instance->context);
+
+	settings = instance->context->settings;
+	WINPR_ASSERT(settings);
+
+	return wf_authenticate_raw(instance, settings->ServerHostname, username, password, domain);
 }
 
 static BOOL wf_gw_authenticate(freerdp* instance, char** username, char** password, char** domain)
 {
 	char tmp[MAX_PATH];
-	sprintf_s(tmp, sizeof(tmp), "Gateway %s", instance->settings->GatewayHostname);
+	rdpSettings* settings;
+
+	WINPR_ASSERT(instance);
+	WINPR_ASSERT(instance->context);
+
+	settings = instance->context->settings;
+	WINPR_ASSERT(settings);
+
+	sprintf_s(tmp, sizeof(tmp), "Gateway %s", settings->GatewayHostname);
 	return wf_authenticate_raw(instance, tmp, username, password, domain);
 }
 
@@ -962,27 +991,35 @@ static DWORD WINAPI wf_client_thread(LPVOID lpParam)
 	int height;
 	BOOL msg_ret;
 	int quit_msg;
-	DWORD nCount;
 	DWORD error;
-	HANDLE handles[MAXIMUM_WAIT_OBJECTS];
 	wfContext* wfc;
 	freerdp* instance;
 	rdpContext* context;
 	rdpChannels* channels;
 	rdpSettings* settings;
+
 	instance = (freerdp*)lpParam;
-	context = instance->context;
-	wfc = (wfContext*)instance->context;
+	WINPR_ASSERT(instance);
 
 	if (!freerdp_connect(instance))
 		goto end;
 
-	channels = instance->context->channels;
-	settings = instance->context->settings;
+	context = instance->context;
+	WINPR_ASSERT(context);
+
+	wfc = (wfContext*)instance->context;
+	WINPR_ASSERT(wfc);
+
+	channels = context->channels;
+	WINPR_ASSERT(channels);
+
+	settings = context->settings;
+	WINPR_ASSERT(settings);
 
 	while (1)
 	{
-		nCount = 0;
+		HANDLE handles[MAXIMUM_WAIT_OBJECTS] = { 0 };
+		DWORD nCount = 0;
 
 		if (freerdp_focus_required(instance))
 		{
@@ -1029,7 +1066,7 @@ static DWORD WINAPI wf_client_thread(LPVOID lpParam)
 		{
 			msg_ret = GetMessage(&msg, NULL, 0, 0);
 
-			if (instance->settings->EmbeddedWindow)
+			if (settings->EmbeddedWindow)
 			{
 				if ((msg.message == WM_SETFOCUS) && (msg.lParam == 1))
 				{
@@ -1270,6 +1307,7 @@ static BOOL wfreerdp_client_new(freerdp* instance, rdpContext* context)
 	if (!(wfreerdp_client_global_init()))
 		return FALSE;
 
+	WINPR_ASSERT(instance);
 	instance->PreConnect = wf_pre_connect;
 	instance->PostConnect = wf_post_connect;
 	instance->PostDisconnect = wf_post_disconnect;
@@ -1277,7 +1315,7 @@ static BOOL wfreerdp_client_new(freerdp* instance, rdpContext* context)
 	instance->GatewayAuthenticate = wf_gw_authenticate;
 
 #ifdef WITH_WINDOWS_CERT_STORE
-	freerdp_settings_set_bool(instance->settings, FreeRDP_CertificateCallbackPreferPEM, TRUE);
+	freerdp_settings_set_bool(context->settings, FreeRDP_CertificateCallbackPreferPEM, TRUE);
 #endif
 
 	if (wfc->isConsole)
@@ -1318,10 +1356,17 @@ static int wfreerdp_client_start(rdpContext* context)
 	HWND hWndParent;
 	HINSTANCE hInstance;
 	wfContext* wfc = (wfContext*)context;
-	freerdp* instance = context->instance;
+	freerdp* instance;
+
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(context->settings);
+
+	instance = context->instance;
+	WINPR_ASSERT(instance);
+
 	hInstance = GetModuleHandle(NULL);
-	hWndParent = (HWND)instance->settings->ParentWindowId;
-	instance->settings->EmbeddedWindow = (hWndParent) ? TRUE : FALSE;
+	hWndParent = (HWND)context->settings->ParentWindowId;
+	context->settings->EmbeddedWindow = (hWndParent) ? TRUE : FALSE;
 	wfc->hWndParent = hWndParent;
 	wfc->hInstance = hInstance;
 	wfc->cursor = LoadCursor(NULL, IDC_ARROW);
diff --git a/client/Windows/wf_gdi.c b/client/Windows/wf_gdi.c
index 9b1349666..fb6768efc 100644
--- a/client/Windows/wf_gdi.c
+++ b/client/Windows/wf_gdi.c
@@ -776,7 +776,7 @@ static BOOL wf_gdi_surface_frame_marker(rdpContext* context,
 	if (!context || !surface_frame_marker || !context->instance)
 		return FALSE;
 
-	settings = context->instance->settings;
+	settings = context->settings;
 
 	if (!settings)
 		return FALSE;
@@ -784,8 +784,7 @@ static BOOL wf_gdi_surface_frame_marker(rdpContext* context,
 	if (surface_frame_marker->frameAction == SURFACECMD_FRAMEACTION_END &&
 	    settings->FrameAcknowledge > 0)
 	{
-		IFCALL(context->instance->update->SurfaceFrameAcknowledge, context,
-		       surface_frame_marker->frameId);
+		IFCALL(context->update->SurfaceFrameAcknowledge, context, surface_frame_marker->frameId);
 	}
 
 	return TRUE;
diff --git a/client/X11/xf_client.c b/client/X11/xf_client.c
index 0eb667ac7..695661fdd 100644
--- a/client/X11/xf_client.c
+++ b/client/X11/xf_client.c
@@ -1201,19 +1201,29 @@ static BOOL xf_pre_connect(freerdp* instance)
 {
 	rdpChannels* channels;
 	rdpSettings* settings;
-	rdpContext* context = instance->context;
-	xfContext* xfc = (xfContext*)instance->context;
+	rdpContext* context;
+	xfContext* xfc;
 	UINT32 maxWidth = 0;
 	UINT32 maxHeight = 0;
-	settings = instance->settings;
+
+	WINPR_ASSERT(instance);
+
+	context = instance->context;
+	xfc = (xfContext*)instance->context;
+	WINPR_ASSERT(context);
+
+	settings = context->settings;
+	WINPR_ASSERT(settings);
+
 	channels = context->channels;
+	WINPR_ASSERT(channels);
+
 	settings->OsMajorType = OSMAJORTYPE_UNIX;
 	settings->OsMinorType = OSMINORTYPE_NATIVE_XSERVER;
-	PubSub_SubscribeChannelConnected(instance->context->pubSub, xf_OnChannelConnectedEventHandler);
-	PubSub_SubscribeChannelDisconnected(instance->context->pubSub,
-	                                    xf_OnChannelDisconnectedEventHandler);
+	PubSub_SubscribeChannelConnected(context->pubSub, xf_OnChannelConnectedEventHandler);
+	PubSub_SubscribeChannelDisconnected(context->pubSub, xf_OnChannelDisconnectedEventHandler);
 
-	if (!freerdp_client_load_addins(channels, instance->settings))
+	if (!freerdp_client_load_addins(channels, settings))
 		return FALSE;
 
 	if (!settings->Username && !settings->CredentialsFromStdin && !settings->SmartcardLogon)
@@ -1286,10 +1296,18 @@ static BOOL xf_post_connect(freerdp* instance)
 	rdpContext* context;
 	rdpSettings* settings;
 	ResizeWindowEventArgs e;
-	xfContext* xfc = (xfContext*)instance->context;
+	xfContext* xfc;
+
+	WINPR_ASSERT(instance);
+	xfc = (xfContext*)instance->context;
 	context = instance->context;
-	settings = instance->settings;
+	WINPR_ASSERT(context);
+
+	settings = context->settings;
+	WINPR_ASSERT(settings);
+
 	update = context->update;
+	WINPR_ASSERT(update);
 
 	if (!gdi_init(instance, xf_get_local_color_format(xfc, TRUE)))
 		return FALSE;
@@ -1306,11 +1324,11 @@ static BOOL xf_post_connect(freerdp* instance)
 		}
 
 		xf_gdi_register_update_callbacks(update);
-		brush_cache_register_callbacks(instance->update);
-		glyph_cache_register_callbacks(instance->update);
-		bitmap_cache_register_callbacks(instance->update);
-		offscreen_cache_register_callbacks(instance->update);
-		palette_cache_register_callbacks(instance->update);
+		brush_cache_register_callbacks(context->update);
+		glyph_cache_register_callbacks(context->update);
+		bitmap_cache_register_callbacks(context->update);
+		offscreen_cache_register_callbacks(context->update);
+		palette_cache_register_callbacks(context->update);
 	}
 
 #ifdef WITH_XRENDER
@@ -1424,13 +1442,6 @@ static int xf_logon_error_info(freerdp* instance, UINT32 data, UINT32 type)
 
 static BOOL handle_window_events(freerdp* instance)
 {
-	rdpSettings* settings;
-
-	if (!instance || !instance->settings)
-		return FALSE;
-
-	settings = instance->settings;
-
 		if (!xf_process_x_events(instance))
 		{
 			WLog_DBG(TAG, "Closed from X11");
@@ -1564,7 +1575,7 @@ static DWORD WINAPI xf_client_thread(LPVOID param)
 		goto end;
 
 	/* --authonly ? */
-	if (instance->settings->AuthenticationOnly)
+	if (settings->AuthenticationOnly)
 	{
 		WLog_ERR(TAG, "Authentication only, exit status %" PRId32 "", !status);
 		goto disconnect;
diff --git a/client/common/client.c b/client/common/client.c
index 91f07d1ac..36cdfd956 100644
--- a/client/common/client.c
+++ b/client/common/client.c
@@ -83,7 +83,7 @@ static void freerdp_client_common_free(freerdp* instance, rdpContext* context)
 
 /* Common API */
 
-rdpContext* freerdp_client_context_new(RDP_CLIENT_ENTRY_POINTS* pEntryPoints)
+rdpContext* freerdp_client_context_new(const RDP_CLIENT_ENTRY_POINTS* pEntryPoints)
 {
 	freerdp* instance;
 	rdpContext* context;
@@ -97,7 +97,6 @@ rdpContext* freerdp_client_context_new(RDP_CLIENT_ENTRY_POINTS* pEntryPoints)
 	if (!instance)
 		return NULL;
 
-	instance->settings = pEntryPoints->settings;
 	instance->ContextSize = pEntryPoints->ContextSize;
 	instance->ContextNew = freerdp_client_common_new;
 	instance->ContextFree = freerdp_client_common_free;
@@ -108,12 +107,11 @@ rdpContext* freerdp_client_context_new(RDP_CLIENT_ENTRY_POINTS* pEntryPoints)
 
 	CopyMemory(instance->pClientEntryPoints, pEntryPoints, pEntryPoints->Size);
 
-	if (!freerdp_context_new(instance))
+	if (!freerdp_context_new_ex(instance, pEntryPoints->settings))
 		goto out_fail2;
 
 	context = instance->context;
 	context->instance = instance;
-	context->settings = instance->settings;
 
 	if (freerdp_register_addin_provider(freerdp_channels_load_static_addin_entry, 0) !=
 	    CHANNEL_RC_OK)
@@ -398,6 +396,10 @@ static BOOL client_cli_authenticate_raw(freerdp* instance, rdp_auth_reason reaso
 	const char** prompt;
 	BOOL pinOnly = FALSE;
 
+	WINPR_ASSERT(instance);
+	WINPR_ASSERT(instance->context);
+	WINPR_ASSERT(instance->context->settings);
+
 	switch (reason)
 	{
 		case AUTH_SMARTCARD_PIN:
@@ -465,7 +467,7 @@ static BOOL client_cli_authenticate_raw(freerdp* instance, rdp_auth_reason reaso
 			goto fail;
 
 		if (freerdp_passphrase_read(prompt[2], *password, password_size,
-		                            instance->settings->CredentialsFromStdin) == NULL)
+		                            instance->context->settings->CredentialsFromStdin) == NULL)
 			goto fail;
 	}
 
@@ -631,6 +633,11 @@ DWORD client_cli_verify_certificate_ex(freerdp* instance, const char* host, UINT
                                        const char* issuer, const char* fingerprint, DWORD flags)
 {
 	const char* type = "RDP-Server";
+
+	WINPR_ASSERT(instance);
+	WINPR_ASSERT(instance->context);
+	WINPR_ASSERT(instance->context->settings);
+
 	if (flags & VERIFY_CERT_FLAG_GATEWAY)
 		type = "RDP-Gateway";
 
@@ -656,7 +663,7 @@ DWORD client_cli_verify_certificate_ex(freerdp* instance, const char* host, UINT
 	printf("The above X.509 certificate could not be verified, possibly because you do not have\n"
 	       "the CA certificate in your certificate store, or the certificate has expired.\n"
 	       "Please look at the OpenSSL documentation on how to add a private CA to the store.\n");
-	return client_cli_accept_certificate(instance->settings);
+	return client_cli_accept_certificate(instance->context->settings);
 }
 
 /** Callback set in the rdp_freerdp structure, and used to make a certificate validation
@@ -731,6 +738,10 @@ DWORD client_cli_verify_changed_certificate_ex(freerdp* instance, const char* ho
 {
 	const char* type = "RDP-Server";
 
+	WINPR_ASSERT(instance);
+	WINPR_ASSERT(instance->context);
+	WINPR_ASSERT(instance->context->settings);
+
 	if (flags & VERIFY_CERT_FLAG_GATEWAY)
 		type = "RDP-Gateway";
 
@@ -782,7 +793,7 @@ DWORD client_cli_verify_changed_certificate_ex(freerdp* instance, const char* ho
 	       "connections.\n"
 	       "This may indicate that the certificate has been tampered with.\n"
 	       "Please contact the administrator of the RDP server and clarify.\n");
-	return client_cli_accept_certificate(instance->settings);
+	return client_cli_accept_certificate(instance->context->settings);
 }
 
 BOOL client_cli_present_gateway_message(freerdp* instance, UINT32 type, BOOL isDisplayMandatory,
@@ -792,6 +803,10 @@ BOOL client_cli_present_gateway_message(freerdp* instance, UINT32 type, BOOL isD
 	int answer;
 	const char* msgType = (type == GATEWAY_MESSAGE_CONSENT) ? "Consent message" : "Service message";
 
+	WINPR_ASSERT(instance);
+	WINPR_ASSERT(instance->context);
+	WINPR_ASSERT(instance->context->settings);
+
 	if (!isDisplayMandatory && !isConsentMandatory)
 		return TRUE;
 
@@ -858,10 +873,14 @@ BOOL client_auto_reconnect_ex(freerdp* instance, BOOL (*window_events)(freerdp*
 	UINT32 numRetries = 0;
 	rdpSettings* settings;
 
-	if (!instance || !instance->settings)
+	if (!instance)
 		return FALSE;
 
-	settings = instance->settings;
+	WINPR_ASSERT(instance->context);
+
+	settings = instance->context->settings;
+	WINPR_ASSERT(settings);
+
 	maxRetries = settings->AutoReconnectMaxRetries;
 
 	/* Only auto reconnect on network disconnects. */
diff --git a/include/freerdp/client.h b/include/freerdp/client.h
index 0d0e99d42..bd83961a8 100644
--- a/include/freerdp/client.h
+++ b/include/freerdp/client.h
@@ -100,7 +100,7 @@ extern "C"
 
 	/* Common client functions */
 
-	FREERDP_API rdpContext* freerdp_client_context_new(RDP_CLIENT_ENTRY_POINTS* pEntryPoints);
+	FREERDP_API rdpContext* freerdp_client_context_new(const RDP_CLIENT_ENTRY_POINTS* pEntryPoints);
 	FREERDP_API void freerdp_client_context_free(rdpContext* context);
 
 	FREERDP_API int freerdp_client_start(rdpContext* context);
diff --git a/include/freerdp/codec/nsc.h b/include/freerdp/codec/nsc.h
index 408f0850f..da5da9b35 100644
--- a/include/freerdp/codec/nsc.h
+++ b/include/freerdp/codec/nsc.h
@@ -45,8 +45,9 @@ extern "C"
 	typedef struct S_NSC_CONTEXT NSC_CONTEXT;
 
 #if defined(WITH_FREERDP_DEPRECATED)
-	FREERDP_API WINPR_DEPRECATED(BOOL nsc_context_set_pixel_format(NSC_CONTEXT* context,
-	                                                               UINT32 pixel_format));
+	FREERDP_API WINPR_DEPRECATED_VAR("Use nsc_context_set_parameters(NSC_COLOR_FORMAT)",
+	                                 BOOL nsc_context_set_pixel_format(NSC_CONTEXT* context,
+	                                                                   UINT32 pixel_format));
 #endif
 
 	FREERDP_API BOOL nsc_context_set_parameters(NSC_CONTEXT* context, NSC_PARAMETER what,
diff --git a/include/freerdp/freerdp.h b/include/freerdp/freerdp.h
index 5271cd5f2..c3c6f4808 100644
--- a/include/freerdp/freerdp.h
+++ b/include/freerdp/freerdp.h
@@ -352,24 +352,30 @@ extern "C"
 
 		UINT64 paddingA[16 - 2]; /* 2 */
 
-		ALIGN64 rdpInput* input;           /* (offset 16)
-		                              Input handle for the connection.
-		                                        Will be initialized by a call to freerdp_context_new()
-		             owned by rdpRdp */
-		ALIGN64 rdpUpdate* update;         /* (offset 17)
-		                              Update display parameters. Used to register display events callbacks
-		and settings.		 Will be initialized by a call to freerdp_context_new()		 owned by rdpRdp */
-		ALIGN64 rdpSettings* settings;     /**< (offset 18)
-		                                Pointer to a rdpSettings structure. Will be used to maintain the
-		                                required RDP	 settings.		              Will be
-		                                initialized by	 a call to freerdp_context_new()
-		                                owned by rdpRdp
-		                              */
-		ALIGN64 rdpAutoDetect* autodetect; /* (offset 19)
+#if defined(WITH_FREERDP_DEPRECATED)
+		WINPR_DEPRECATED_VAR("use rdpContext::input instead", ALIGN64 rdpInput* input;) /* (offset
+		                        16) Input handle for the connection. Will be initialized by a call
+		                        to freerdp_context_new() owned by rdpRdp */
+		WINPR_DEPRECATED_VAR("use rdpContext::update instead",
+		                     ALIGN64 rdpUpdate* update;) /* (offset 17)
+		                      Update display parameters. Used to register display events callbacks
+and settings.		 Will be initialized by a call to freerdp_context_new()		 owned by rdpRdp */
+		WINPR_DEPRECATED_VAR("use rdpContext::settings instead",
+		                     ALIGN64 rdpSettings* settings;) /**< (offset 18)
+		                            Pointer to a rdpSettings structure. Will be used to maintain the
+		                            required RDP	 settings.		              Will be
+		                            initialized by	 a call to freerdp_context_new()
+		                            owned by rdpRdp
+		                          */
+		WINPR_DEPRECATED_VAR("use rdpContext::autodetect instead",
+		                     ALIGN64 rdpAutoDetect* autodetect;) /* (offset 19)
 		                                Auto-Detect handle for the connection.
 		                                Will be initialized by a call to freerdp_context_new()
 owned by rdpRdp */
-		ALIGN64 rdpHeartbeat* heartbeat;   /* (offset 21) owned by rdpRdp*/
+#else
+	    UINT64 paddingX[4];
+#endif
+		ALIGN64 rdpHeartbeat* heartbeat; /* (offset 21) owned by rdpRdp*/
 
 		UINT64 paddingB[32 - 21]; /* 21 */
 
@@ -416,19 +422,17 @@ owned by rdpRdp */
 		                                 It is used to get the username/password when it was not
 		                                 provided at connection time. */
 #if defined(WITH_FREERDP_DEPRECATED)
-		ALIGN64 pVerifyCertificate VerifyCertificate;               /**< (offset 51)
-    Callback for certificate validation.
-    Used to verify that an unknown certificate is
-trusted. DEPRECATED: Use VerifyChangedCertificateEx*/
-		ALIGN64 pVerifyChangedCertificate VerifyChangedCertificate; /**<
-(offset 52) Callback for changed certificate validation. Used when a certificate differs from stored
-fingerprint. DEPRECATED: Use VerifyChangedCertificateEx */
+		WINPR_DEPRECATED_VAR("Use VerifyCertificateEx or VerifyX509Certificate  instead",
+		                     ALIGN64 pVerifyCertificate VerifyCertificate;) /**< (offset 51) */
+		WINPR_DEPRECATED_VAR("Use VerifyChangedCertificateEx or VerifyX509Certificate  instead",
+		                     ALIGN64 pVerifyChangedCertificate
+		                         VerifyChangedCertificate;) /**< (offset 52) */
 #else
 	    ALIGN64 UINT64 reserved[2];
 #endif
 		ALIGN64 pVerifyX509Certificate
-		    VerifyX509Certificate; /**< (offset 53)  Callback for X509 certificate verification (PEM
-		                              format) */
+		    VerifyX509Certificate; /**< (offset 53)  Callback for X509 certificate verification
+		                              (PEM format) */
 
 		ALIGN64 pLogonErrorInfo
 		    LogonErrorInfo; /**< (offset 54)  Callback for logon error info, important for logon
@@ -497,6 +501,7 @@ settings but before rdp_client_connect() to have it executed after the
 	typedef struct rdp_channel_handles rdpChannelHandles;
 
 	FREERDP_API BOOL freerdp_context_new(freerdp* instance);
+	FREERDP_API BOOL freerdp_context_new_ex(freerdp* instance, rdpSettings* settings);
 	FREERDP_API void freerdp_context_free(freerdp* instance);
 
 	FREERDP_API BOOL freerdp_connect(freerdp* instance);
diff --git a/include/freerdp/listener.h b/include/freerdp/listener.h
index 520bba7bc..1b6e59294 100644
--- a/include/freerdp/listener.h
+++ b/include/freerdp/listener.h
@@ -37,8 +37,9 @@ extern "C"
 	typedef BOOL (*psListenerOpenLocal)(freerdp_listener* instance, const char* path);
 	typedef BOOL (*psListenerOpenFromSocket)(freerdp_listener* instance, int fd);
 #if defined(WITH_FREERDP_DEPRECATED)
-	typedef BOOL (*psListenerGetFileDescriptor)(freerdp_listener* instance, void** rfds,
-	                                            int* rcount);
+	WINPR_DEPRECATED_VAR("Use psListenerGetEventHandles instead",
+	                     typedef BOOL (*psListenerGetFileDescriptor)(freerdp_listener* instance,
+	                                                                 void** rfds, int* rcount);)
 #endif
 	typedef DWORD (*psListenerGetEventHandles)(freerdp_listener* instance, HANDLE* events,
 	                                           DWORD nCount);
@@ -58,7 +59,8 @@ extern "C"
 		psListenerOpen Open;
 		psListenerOpenLocal OpenLocal;
 #if defined(WITH_FREERDP_DEPRECATED)
-		psListenerGetFileDescriptor GetFileDescriptor;
+		WINPR_DEPRECATED_VAR("Use rdp_freerdp_listener::GetEventHandles instead",
+		                     psListenerGetFileDescriptor GetFileDescriptor;)
 #else
 	    void* reserved;
 #endif
diff --git a/include/freerdp/peer.h b/include/freerdp/peer.h
index 2dcd91a4f..c5cdf3440 100644
--- a/include/freerdp/peer.h
+++ b/include/freerdp/peer.h
@@ -36,7 +36,9 @@ typedef void (*psPeerContextFree)(freerdp_peer* peer, rdpContext* context);
 
 typedef BOOL (*psPeerInitialize)(freerdp_peer* peer);
 #if defined(WITH_FREERDP_DEPRECATED)
-typedef BOOL (*psPeerGetFileDescriptor)(freerdp_peer* peer, void** rfds, int* rcount);
+WINPR_DEPRECATED_VAR("Use psPeerGetEventHandle instead",
+                     typedef BOOL (*psPeerGetFileDescriptor)(freerdp_peer* peer, void** rfds,
+                                                             int* rcount);)
 #endif
 typedef HANDLE (*psPeerGetEventHandle)(freerdp_peer* peer);
 typedef DWORD (*psPeerGetEventHandles)(freerdp_peer* peer, HANDLE* events, DWORD count);
@@ -85,65 +87,70 @@ typedef LicenseCallbackResult (*psPeerLicenseCallback)(freerdp_peer* peer, wStre
 
 struct rdp_freerdp_peer
 {
-	rdpContext* context;
+	ALIGN64 rdpContext* context;
 
-	int sockfd;
-	char hostname[50];
+	ALIGN64 int sockfd;
+	ALIGN64 char hostname[50];
 
-	rdpUpdate* update;
-	rdpSettings* settings;
-	rdpAutoDetect* autodetect;
-
-	void* ContextExtra;
-	size_t ContextSize;
-	psPeerContextNew ContextNew;
-	psPeerContextFree ContextFree;
-
-	psPeerInitialize Initialize;
 #if defined(WITH_FREERDP_DEPRECATED)
-	psPeerGetFileDescriptor GetFileDescriptor;
+	WINPR_DEPRECATED_VAR("Use rdpContext::update instead", ALIGN64 rdpUpdate* update;)
+	WINPR_DEPRECATED_VAR("Use rdpContext::settings instead", ALIGN64 rdpSettings* settings;)
+	WINPR_DEPRECATED_VAR("Use rdpContext::autodetect instead", ALIGN64 rdpAutoDetect* autodetect;)
 #else
-	void* reserved;
+	UINT64 reservedX[3];
 #endif
-	psPeerGetEventHandle GetEventHandle;
-	psPeerGetReceiveEventHandle GetReceiveEventHandle;
-	psPeerCheckFileDescriptor CheckFileDescriptor;
-	psPeerClose Close;
-	psPeerDisconnect Disconnect;
 
-	psPeerCapabilities Capabilities;
-	psPeerPostConnect PostConnect;
-	psPeerActivate Activate;
-	psPeerLogon Logon;
+	ALIGN64 void* ContextExtra;
+	ALIGN64 size_t ContextSize;
+	ALIGN64 psPeerContextNew ContextNew;
+	ALIGN64 psPeerContextFree ContextFree;
 
-	psPeerSendChannelData SendChannelData;
-	psPeerReceiveChannelData ReceiveChannelData;
+	ALIGN64 psPeerInitialize Initialize;
+#if defined(WITH_FREERDP_DEPRECATED)
+	WINPR_DEPRECATED_VAR("Use freerdp_peer::GetEventHandle instead",
+	                     ALIGN64 psPeerGetFileDescriptor GetFileDescriptor;)
+#else
+	UINT64 reserved;
+#endif
+	ALIGN64 psPeerGetEventHandle GetEventHandle;
+	ALIGN64 psPeerGetReceiveEventHandle GetReceiveEventHandle;
+	ALIGN64 psPeerCheckFileDescriptor CheckFileDescriptor;
+	ALIGN64 psPeerClose Close;
+	ALIGN64 psPeerDisconnect Disconnect;
 
-	psPeerVirtualChannelOpen VirtualChannelOpen;
-	psPeerVirtualChannelClose VirtualChannelClose;
-	psPeerVirtualChannelRead VirtualChannelRead;
-	psPeerVirtualChannelWrite VirtualChannelWrite;
-	psPeerVirtualChannelGetData VirtualChannelGetData;
-	psPeerVirtualChannelSetData VirtualChannelSetData;
+	ALIGN64 psPeerCapabilities Capabilities;
+	ALIGN64 psPeerPostConnect PostConnect;
+	ALIGN64 psPeerActivate Activate;
+	ALIGN64 psPeerLogon Logon;
 
-	int pId;
-	UINT32 ack_frame_id;
-	BOOL local;
-	BOOL connected;
-	BOOL activated;
-	BOOL authenticated;
-	SEC_WINNT_AUTH_IDENTITY identity;
+	ALIGN64 psPeerSendChannelData SendChannelData;
+	ALIGN64 psPeerReceiveChannelData ReceiveChannelData;
 
-	psPeerIsWriteBlocked IsWriteBlocked;
-	psPeerDrainOutputBuffer DrainOutputBuffer;
-	psPeerHasMoreToRead HasMoreToRead;
-	psPeerGetEventHandles GetEventHandles;
-	psPeerAdjustMonitorsLayout AdjustMonitorsLayout;
-	psPeerClientCapabilities ClientCapabilities;
-	psPeerComputeNtlmHash ComputeNtlmHash;
-	psPeerLicenseCallback LicenseCallback;
+	ALIGN64 psPeerVirtualChannelOpen VirtualChannelOpen;
+	ALIGN64 psPeerVirtualChannelClose VirtualChannelClose;
+	ALIGN64 psPeerVirtualChannelRead VirtualChannelRead;
+	ALIGN64 psPeerVirtualChannelWrite VirtualChannelWrite;
+	ALIGN64 psPeerVirtualChannelGetData VirtualChannelGetData;
+	ALIGN64 psPeerVirtualChannelSetData VirtualChannelSetData;
 
-	psPeerSendChannelPacket SendChannelPacket;
+	ALIGN64 int pId;
+	ALIGN64 UINT32 ack_frame_id;
+	ALIGN64 BOOL local;
+	ALIGN64 BOOL connected;
+	ALIGN64 BOOL activated;
+	ALIGN64 BOOL authenticated;
+	ALIGN64 SEC_WINNT_AUTH_IDENTITY identity;
+
+	ALIGN64 psPeerIsWriteBlocked IsWriteBlocked;
+	ALIGN64 psPeerDrainOutputBuffer DrainOutputBuffer;
+	ALIGN64 psPeerHasMoreToRead HasMoreToRead;
+	ALIGN64 psPeerGetEventHandles GetEventHandles;
+	ALIGN64 psPeerAdjustMonitorsLayout AdjustMonitorsLayout;
+	ALIGN64 psPeerClientCapabilities ClientCapabilities;
+	ALIGN64 psPeerComputeNtlmHash ComputeNtlmHash;
+	ALIGN64 psPeerLicenseCallback LicenseCallback;
+
+	ALIGN64 psPeerSendChannelPacket SendChannelPacket;
 };
 
 #ifdef __cplusplus
@@ -152,6 +159,7 @@ extern "C"
 #endif
 
 	FREERDP_API BOOL freerdp_peer_context_new(freerdp_peer* client);
+	FREERDP_API BOOL freerdp_peer_context_new_ex(freerdp_peer* client, const rdpSettings* settings);
 	FREERDP_API void freerdp_peer_context_free(freerdp_peer* client);
 
 	FREERDP_API freerdp_peer* freerdp_peer_new(int sockfd);
diff --git a/include/freerdp/settings.h b/include/freerdp/settings.h
index 0e091a073..2ef6a1227 100644
--- a/include/freerdp/settings.h
+++ b/include/freerdp/settings.h
@@ -1712,28 +1712,40 @@ extern "C"
 	 * use freerdp_settings_get_* and freerdp_settings_set_* as a replacement!
 	 */
 #if defined(WITH_FREERDP_DEPRECATED)
-	FREERDP_API WINPR_DEPRECATED(BOOL freerdp_get_param_bool(const rdpSettings* settings, int id));
-	FREERDP_API WINPR_DEPRECATED(int freerdp_set_param_bool(rdpSettings* settings, int id,
-	                                                        BOOL param));
-
-	FREERDP_API WINPR_DEPRECATED(int freerdp_get_param_int(const rdpSettings* settings, int id));
-	FREERDP_API WINPR_DEPRECATED(int freerdp_set_param_int(rdpSettings* settings, int id,
-	                                                       int param));
-
-	FREERDP_API WINPR_DEPRECATED(UINT32 freerdp_get_param_uint32(const rdpSettings* settings,
+	FREERDP_API WINPR_DEPRECATED_VAR("Use freerdp_settings_get_bool instead",
+	                                 BOOL freerdp_get_param_bool(const rdpSettings* settings,
 	                                                             int id));
-	FREERDP_API WINPR_DEPRECATED(int freerdp_set_param_uint32(rdpSettings* settings, int id,
-	                                                          UINT32 param));
+	FREERDP_API WINPR_DEPRECATED_VAR("Use freerdp_settings_set_bool instead",
+	                                 int freerdp_set_param_bool(rdpSettings* settings, int id,
+	                                                            BOOL param));
 
-	FREERDP_API WINPR_DEPRECATED(UINT64 freerdp_get_param_uint64(const rdpSettings* settings,
-	                                                             int id));
-	FREERDP_API WINPR_DEPRECATED(int freerdp_set_param_uint64(rdpSettings* settings, int id,
-	                                                          UINT64 param));
+	FREERDP_API WINPR_DEPRECATED_VAR("Use freerdp_settings_get_int[16|32] instead",
+	                                 int freerdp_get_param_int(const rdpSettings* settings,
+	                                                           int id));
+	FREERDP_API WINPR_DEPRECATED_VAR("Use freerdp_settings_set_int[16|32] instead",
+	                                 int freerdp_set_param_int(rdpSettings* settings, int id,
+	                                                           int param));
 
-	FREERDP_API WINPR_DEPRECATED(char* freerdp_get_param_string(const rdpSettings* settings,
-	                                                            int id));
-	FREERDP_API WINPR_DEPRECATED(int freerdp_set_param_string(rdpSettings* settings, int id,
-	                                                          const char* param));
+	FREERDP_API WINPR_DEPRECATED_VAR("Use freerdp_settings_set_uint32 instead",
+	                                 UINT32 freerdp_get_param_uint32(const rdpSettings* settings,
+	                                                                 int id));
+	FREERDP_API WINPR_DEPRECATED_VAR("Use freerdp_settings_set_uint32 instead",
+	                                 int freerdp_set_param_uint32(rdpSettings* settings, int id,
+	                                                              UINT32 param));
+
+	FREERDP_API WINPR_DEPRECATED_VAR("Use freerdp_settings_get_uint64 instead",
+	                                 UINT64 freerdp_get_param_uint64(const rdpSettings* settings,
+	                                                                 int id));
+	FREERDP_API WINPR_DEPRECATED_VAR("Use freerdp_settings_set_uint64 instead",
+	                                 int freerdp_set_param_uint64(rdpSettings* settings, int id,
+	                                                              UINT64 param));
+
+	FREERDP_API WINPR_DEPRECATED_VAR("Use freerdp_settings_get_string instead",
+	                                 char* freerdp_get_param_string(const rdpSettings* settings,
+	                                                                int id));
+	FREERDP_API WINPR_DEPRECATED_VAR("Use freerdp_settings_set_string instead",
+	                                 int freerdp_set_param_string(rdpSettings* settings, int id,
+	                                                              const char* param));
 #endif
 
 	FREERDP_API BOOL freerdp_settings_get_bool(const rdpSettings* settings, size_t id);
diff --git a/libfreerdp/cache/glyph.c b/libfreerdp/cache/glyph.c
index 754dd77fb..a83581ee8 100644
--- a/libfreerdp/cache/glyph.c
+++ b/libfreerdp/cache/glyph.c
@@ -355,8 +355,8 @@ static BOOL update_gdi_fast_index(rdpContext* context, const FAST_INDEX_ORDER* f
 	/* Server can send a massive number (32766) which appears to be
 	 * undocumented special behavior for "Erase all the way right".
 	 * X11 has nondeterministic results asking for a draw that wide. */
-	if (opRight > (INT64)context->instance->settings->DesktopWidth)
-		opRight = (int)context->instance->settings->DesktopWidth;
+	if (opRight > (INT64)context->settings->DesktopWidth)
+		opRight = (int)context->settings->DesktopWidth;
 
 	if (x == -32768)
 		x = fastIndex->bkLeft;
@@ -427,8 +427,8 @@ static BOOL update_gdi_fast_glyph(rdpContext* context, const FAST_GLYPH_ORDER* f
 		opRight = fastGlyph->bkRight;
 
 	/* See update_gdi_fast_index opRight comment. */
-	if (opRight > (INT64)context->instance->settings->DesktopWidth)
-		opRight = (int)context->instance->settings->DesktopWidth;
+	if (opRight > (INT64)context->settings->DesktopWidth)
+		opRight = (int)context->settings->DesktopWidth;
 
 	if (x == -32768)
 		x = fastGlyph->bkLeft;
diff --git a/libfreerdp/core/autodetect.c b/libfreerdp/core/autodetect.c
index 2cb8c1bdf..d8318af05 100644
--- a/libfreerdp/core/autodetect.c
+++ b/libfreerdp/core/autodetect.c
@@ -708,12 +708,13 @@ int rdp_recv_autodetect_response_packet(rdpRdp* rdp, wStream* s)
 	return success ? 0 : -1;
 }
 
-rdpAutoDetect* autodetect_new(void)
+rdpAutoDetect* autodetect_new(rdpContext* context)
 {
 	rdpAutoDetect* autoDetect = (rdpAutoDetect*)calloc(1, sizeof(rdpAutoDetect));
 
 	if (autoDetect)
 	{
+		autoDetect->context = context;
 	}
 
 	return autoDetect;
diff --git a/libfreerdp/core/autodetect.h b/libfreerdp/core/autodetect.h
index a2263f7b4..e76dcd5a5 100644
--- a/libfreerdp/core/autodetect.h
+++ b/libfreerdp/core/autodetect.h
@@ -36,7 +36,7 @@
 FREERDP_LOCAL int rdp_recv_autodetect_request_packet(rdpRdp* rdp, wStream* s);
 FREERDP_LOCAL int rdp_recv_autodetect_response_packet(rdpRdp* rdp, wStream* s);
 
-FREERDP_LOCAL rdpAutoDetect* autodetect_new(void);
+FREERDP_LOCAL rdpAutoDetect* autodetect_new(rdpContext* context);
 FREERDP_LOCAL void autodetect_free(rdpAutoDetect* autodetect);
 
 FREERDP_LOCAL void autodetect_register_server_callbacks(rdpAutoDetect* autodetect);
diff --git a/libfreerdp/core/client.c b/libfreerdp/core/client.c
index 95793f74a..11575b094 100644
--- a/libfreerdp/core/client.c
+++ b/libfreerdp/core/client.c
@@ -297,8 +297,13 @@ UINT freerdp_channels_attach(freerdp* instance)
 	size_t hostnameLength;
 	rdpChannels* channels;
 	CHANNEL_CLIENT_DATA* pChannelClientData;
+
+	WINPR_ASSERT(instance);
+	WINPR_ASSERT(instance->context);
+	WINPR_ASSERT(instance->context->settings);
+
 	channels = instance->context->channels;
-	hostname = instance->settings->ServerHostname;
+	hostname = instance->context->settings->ServerHostname;
 	hostnameLength = strlen(hostname);
 
 	for (index = 0; index < channels->clientDataCount; index++)
@@ -341,9 +346,19 @@ UINT freerdp_channels_detach(freerdp* instance)
 	const char* hostname;
 	size_t hostnameLength;
 	rdpChannels* channels;
+	rdpContext* context;
 	CHANNEL_CLIENT_DATA* pChannelClientData;
-	channels = instance->context->channels;
-	hostname = instance->settings->ServerHostname;
+
+	WINPR_ASSERT(instance);
+
+	context = instance->context;
+	WINPR_ASSERT(context);
+
+	channels = context->channels;
+	WINPR_ASSERT(channels);
+
+	WINPR_ASSERT(context->settings);
+	hostname = context->settings->ServerHostname;
 	hostnameLength = strlen(hostname);
 
 	for (index = 0; index < channels->clientDataCount; index++)
@@ -365,14 +380,14 @@ UINT freerdp_channels_detach(freerdp* instance)
 			    CHANNEL_EVENT_DETACHED, (LPVOID)hostname, (UINT)hostnameLength);
 		}
 
-		if (getChannelError(instance->context) != CHANNEL_RC_OK)
+		if (getChannelError(context) != CHANNEL_RC_OK)
 			goto fail;
 
 		pChannelOpenData = &channels->openDataList[index];
 		EventArgsInit(&e, "freerdp");
 		e.name = pChannelOpenData->name;
 		e.pInterface = pChannelOpenData->pInterface;
-		PubSub_OnChannelDetached(instance->context->pubSub, instance->context, &e);
+		PubSub_OnChannelDetached(context->pubSub, context, &e);
 	}
 
 fail:
@@ -391,8 +406,14 @@ UINT freerdp_channels_post_connect(rdpChannels* channels, freerdp* instance)
 	const char* hostname;
 	size_t hostnameLength;
 	CHANNEL_CLIENT_DATA* pChannelClientData;
+
+	WINPR_ASSERT(channels);
+	WINPR_ASSERT(instance);
+	WINPR_ASSERT(instance->context);
+	WINPR_ASSERT(instance->context->settings);
+
 	channels->connected = TRUE;
-	hostname = instance->settings->ServerHostname;
+	hostname = instance->context->settings->ServerHostname;
 	hostnameLength = strlen(hostname);
 
 	for (index = 0; index < channels->clientDataCount; index++)
@@ -778,7 +799,10 @@ void freerdp_channels_close(rdpChannels* channels, freerdp* instance)
 
 	channels->openDataCount = 0;
 	channels->initDataCount = 0;
-	instance->settings->ChannelCount = 0;
+
+	WINPR_ASSERT(instance->context);
+	WINPR_ASSERT(instance->context->settings);
+	instance->context->settings->ChannelCount = 0;
 	g_Instance = NULL;
 }
 
diff --git a/libfreerdp/core/freerdp.c b/libfreerdp/core/freerdp.c
index 781209781..325c65b1c 100644
--- a/libfreerdp/core/freerdp.c
+++ b/libfreerdp/core/freerdp.c
@@ -91,7 +91,7 @@ BOOL freerdp_connect(freerdp* instance)
 	rdp = instance->context->rdp;
 	WINPR_ASSERT(rdp);
 
-	settings = instance->settings;
+	settings = instance->context->settings;
 	WINPR_ASSERT(settings);
 
 	freerdp_channels_register_instance(instance->context->channels, instance);
@@ -161,7 +161,7 @@ BOOL freerdp_connect(freerdp* instance)
 			goto freerdp_connect_finally;
 	}
 
-	if (!status || (status2 != CHANNEL_RC_OK) || !update_post_connect(instance->update))
+	if (!status || (status2 != CHANNEL_RC_OK) || !update_post_connect(instance->context->update))
 	{
 		WLog_ERR(TAG, "freerdp_post_connect failed");
 
@@ -171,10 +171,10 @@ BOOL freerdp_connect(freerdp* instance)
 		goto freerdp_connect_finally;
 	}
 
-	if (instance->settings->PlayRemoteFx)
+	if (settings->PlayRemoteFx)
 	{
 		wStream* s;
-		rdp_update_internal* update = update_cast(instance->update);
+		rdp_update_internal* update = update_cast(instance->context->update);
 		pcap_record record;
 
 		WINPR_ASSERT(update);
@@ -359,21 +359,25 @@ BOOL freerdp_check_event_handles(rdpContext* context)
 wMessageQueue* freerdp_get_message_queue(freerdp* instance, DWORD id)
 {
 	wMessageQueue* queue = NULL;
+	rdpContext* context;
 
 	WINPR_ASSERT(instance);
 
+	context = instance->context;
+	WINPR_ASSERT(context);
+
 	switch (id)
 	{
 		case FREERDP_UPDATE_MESSAGE_QUEUE:
 		{
-			rdp_update_internal* update = update_cast(instance->update);
+			rdp_update_internal* update = update_cast(context->update);
 			queue = update->queue;
 		}
 		break;
 
 		case FREERDP_INPUT_MESSAGE_QUEUE:
 		{
-			rdp_input_internal* input = input_cast(instance->input);
+			rdp_input_internal* input = input_cast(context->input);
 			queue = input->queue;
 		}
 		break;
@@ -396,17 +400,21 @@ HANDLE freerdp_get_message_queue_event_handle(freerdp* instance, DWORD id)
 int freerdp_message_queue_process_message(freerdp* instance, DWORD id, wMessage* message)
 {
 	int status = -1;
+	rdpContext* context;
 
 	WINPR_ASSERT(instance);
 
+	context = instance->context;
+	WINPR_ASSERT(context);
+
 	switch (id)
 	{
 		case FREERDP_UPDATE_MESSAGE_QUEUE:
-			status = update_message_queue_process_message(instance->update, message);
+			status = update_message_queue_process_message(context->update, message);
 			break;
 
 		case FREERDP_INPUT_MESSAGE_QUEUE:
-			status = input_message_queue_process_message(instance->input, message);
+			status = input_message_queue_process_message(context->input, message);
 			break;
 	}
 
@@ -416,17 +424,21 @@ int freerdp_message_queue_process_message(freerdp* instance, DWORD id, wMessage*
 int freerdp_message_queue_process_pending_messages(freerdp* instance, DWORD id)
 {
 	int status = -1;
+	rdpContext* context;
 
 	WINPR_ASSERT(instance);
 
+	context = instance->context;
+	WINPR_ASSERT(context);
+
 	switch (id)
 	{
 		case FREERDP_UPDATE_MESSAGE_QUEUE:
-			status = update_message_queue_process_pending_messages(instance->update);
+			status = update_message_queue_process_pending_messages(context->update);
 			break;
 
 		case FREERDP_INPUT_MESSAGE_QUEUE:
-			status = input_message_queue_process_pending_messages(instance->input);
+			status = input_message_queue_process_pending_messages(context->input);
 			break;
 	}
 
@@ -469,7 +481,7 @@ BOOL freerdp_disconnect(freerdp* instance)
 
 	up = update_cast(rdp->update);
 
-	update_post_disconnect(instance->update);
+	update_post_disconnect(rdp->update);
 
 	IFCALL(instance->PostDisconnect, instance);
 
@@ -600,19 +612,27 @@ static wEventType FreeRDP_Events[] = {
  * context.
  */
 BOOL freerdp_context_new(freerdp* instance)
+{
+	return freerdp_context_new_ex(instance, NULL);
+}
+
+BOOL freerdp_context_new_ex(freerdp* instance, rdpSettings* settings)
 {
 	rdpRdp* rdp;
 	rdpContext* context;
 	BOOL ret = TRUE;
-	instance->context = (rdpContext*)calloc(1, instance->ContextSize);
 
-	if (!instance->context)
+	WINPR_ASSERT(instance);
+
+	instance->context = context = (rdpContext*)calloc(1, instance->ContextSize);
+
+	if (!context)
 		return FALSE;
 
-	context = instance->context;
+	/* Set to external settings, prevents rdp_new from creating its own instance */
+	context->settings = settings;
 	context->instance = instance;
 	context->ServerMode = FALSE;
-	context->settings = instance->settings;
 	context->disconnectUltimatum = 0;
 	context->pubSub = PubSub_New(TRUE);
 
@@ -631,27 +651,23 @@ BOOL freerdp_context_new(freerdp* instance)
 		goto fail;
 
 	context->rdp = rdp;
+#if defined(WITH_FREERDP_DEPRECATED)
 	instance->input = rdp->input;
 	instance->update = rdp->update;
 	instance->settings = rdp->settings;
 	instance->autodetect = rdp->autodetect;
+#endif
+
 	instance->heartbeat = rdp->heartbeat;
 	context->graphics = graphics_new(context);
 
 	if (!context->graphics)
 		goto fail;
 
-	context->input = instance->input;
-	context->update = instance->update;
-	context->settings = instance->settings;
-	context->autodetect = instance->autodetect;
-	instance->update->context = instance->context;
-	instance->update->pointer->context = instance->context;
-	instance->update->primary->context = instance->context;
-	instance->update->secondary->context = instance->context;
-	instance->update->altsec->context = instance->context;
-	instance->input->context = context;
-	instance->autodetect->context = context;
+	context->input = rdp->input;
+	context->update = rdp->update;
+	context->settings = rdp->settings;
+	context->autodetect = rdp->autodetect;
 
 	if (!(context->errorDescription = calloc(1, 500)))
 	{
@@ -742,9 +758,20 @@ void freerdp_context_free(freerdp* instance)
 	stream_dump_free(ctx->dump);
 	ctx->dump = NULL;
 
+	ctx->input = NULL;      /* owned by rdpRdp */
+	ctx->update = NULL;     /* owned by rdpRdp */
+	ctx->settings = NULL;   /* owned by rdpRdp */
+	ctx->autodetect = NULL; /* owned by rdpRdp */
+
 	free(ctx);
 	instance->context = NULL;
+#if defined(WITH_FREERDP_DEPRECATED)
+	instance->input = NULL;    /* owned by rdpRdp */
+	instance->update = NULL;   /* owned by rdpRdp */
 	instance->settings = NULL; /* owned by rdpRdp */
+	instance->autodetect = NULL; /* owned by rdpRdp */
+#endif
+	instance->heartbeat = NULL; /* owned by rdpRdp */
 }
 
 int freerdp_get_disconnect_ultimatum(rdpContext* context)
diff --git a/libfreerdp/core/input.c b/libfreerdp/core/input.c
index 9fc45a84d..d478ba26f 100644
--- a/libfreerdp/core/input.c
+++ b/libfreerdp/core/input.c
@@ -769,6 +769,7 @@ rdpInput* input_new(rdpRdp* rdp)
 	if (!input)
 		return NULL;
 
+	input->common.context = rdp->context;
 	input->queue = MessageQueue_New(&cb);
 
 	if (!input->queue)
diff --git a/libfreerdp/core/peer.c b/libfreerdp/core/peer.c
index 2c9d71a7f..991b89669 100644
--- a/libfreerdp/core/peer.c
+++ b/libfreerdp/core/peer.c
@@ -319,14 +319,17 @@ static BOOL peer_recv_data_pdu(freerdp_peer* client, wStream* s, UINT16 totalLen
 	UINT32 share_id;
 	BYTE compressed_type;
 	UINT16 compressed_len;
+	rdpUpdate* update;
 
 	WINPR_ASSERT(s);
 	WINPR_ASSERT(client);
-	WINPR_ASSERT(client->update);
 	WINPR_ASSERT(client->context);
 	WINPR_ASSERT(client->context->rdp);
 	WINPR_ASSERT(client->context->rdp->mcs);
 
+	update = client->context->update;
+	WINPR_ASSERT(update);
+
 	if (!rdp_read_share_data_header(s, &length, &type, &share_id, &compressed_type,
 	                                &compressed_len))
 		return FALSE;
@@ -376,18 +379,17 @@ static BOOL peer_recv_data_pdu(freerdp_peer* client, wStream* s, UINT16 totalLen
 				return FALSE;
 
 			Stream_Read_UINT32(s, client->ack_frame_id);
-			IFCALL(client->update->SurfaceFrameAcknowledge, client->update->context,
-			       client->ack_frame_id);
+			IFCALL(update->SurfaceFrameAcknowledge, update->context, client->ack_frame_id);
 			break;
 
 		case DATA_PDU_TYPE_REFRESH_RECT:
-			if (!update_read_refresh_rect(client->update, s))
+			if (!update_read_refresh_rect(update, s))
 				return FALSE;
 
 			break;
 
 		case DATA_PDU_TYPE_SUPPRESS_OUTPUT:
-			if (!update_read_suppress_output(client->update, s))
+			if (!update_read_suppress_output(update, s))
 				return FALSE;
 
 			break;
@@ -408,6 +410,7 @@ static int peer_recv_tpkt_pdu(freerdp_peer* client, wStream* s)
 	UINT16 pduSource;
 	UINT16 channelId;
 	UINT16 securityFlags = 0;
+	rdpSettings* settings;
 
 	WINPR_ASSERT(s);
 	WINPR_ASSERT(client);
@@ -416,7 +419,9 @@ static int peer_recv_tpkt_pdu(freerdp_peer* client, wStream* s)
 	rdp = client->context->rdp;
 	WINPR_ASSERT(rdp);
 	WINPR_ASSERT(rdp->mcs);
-	WINPR_ASSERT(rdp->settings);
+
+	settings = client->context->settings;
+	WINPR_ASSERT(settings);
 
 	if (!rdp_read_header(rdp, s, &length, &channelId))
 	{
@@ -428,7 +433,7 @@ static int peer_recv_tpkt_pdu(freerdp_peer* client, wStream* s)
 	if (freerdp_shall_disconnect(rdp->instance))
 		return 0;
 
-	if (rdp->settings->UseRdpSecurityLayer)
+	if (settings->UseRdpSecurityLayer)
 	{
 		if (!rdp_read_security_header(s, &securityFlags, &length))
 			return -1;
@@ -449,7 +454,7 @@ static int peer_recv_tpkt_pdu(freerdp_peer* client, wStream* s)
 		if (!rdp_read_share_control_header(s, &pduLength, &remain, &pduType, &pduSource))
 			return -1;
 
-		client->settings->PduSource = pduSource;
+		settings->PduSource = pduSource;
 
 		WLog_DBG(TAG, "Received %s", pdu_type_to_str(pduType));
 		switch (pduType)
@@ -480,7 +485,7 @@ static int peer_recv_tpkt_pdu(freerdp_peer* client, wStream* s)
 	}
 	else if ((rdp->mcs->messageChannelId > 0) && (channelId == rdp->mcs->messageChannelId))
 	{
-		if (!rdp->settings->UseRdpSecurityLayer)
+		if (!settings->UseRdpSecurityLayer)
 			if (!rdp_read_security_header(s, &securityFlags, NULL))
 				return -1;
 
@@ -551,6 +556,7 @@ static int peer_recv_callback(rdpTransport* transport, wStream* s, void* extra)
 	UINT32 SelectedProtocol;
 	freerdp_peer* client = (freerdp_peer*)extra;
 	rdpRdp* rdp;
+	rdpSettings* settings;
 
 	WINPR_ASSERT(transport);
 	WINPR_ASSERT(client);
@@ -559,6 +565,9 @@ static int peer_recv_callback(rdpTransport* transport, wStream* s, void* extra)
 	rdp = client->context->rdp;
 	WINPR_ASSERT(rdp);
 
+	settings = client->context->settings;
+	WINPR_ASSERT(settings);
+
 	switch (rdp_get_state(rdp))
 	{
 		case CONNECTION_STATE_INITIAL:
@@ -570,9 +579,9 @@ static int peer_recv_callback(rdpTransport* transport, wStream* s, void* extra)
 			}
 
 			SelectedProtocol = nego_get_selected_protocol(rdp->nego);
-			client->settings->NlaSecurity = (SelectedProtocol & PROTOCOL_HYBRID) ? TRUE : FALSE;
-			client->settings->TlsSecurity = (SelectedProtocol & PROTOCOL_SSL) ? TRUE : FALSE;
-			client->settings->RdpSecurity = (SelectedProtocol == PROTOCOL_RDP) ? TRUE : FALSE;
+			settings->NlaSecurity = (SelectedProtocol & PROTOCOL_HYBRID) ? TRUE : FALSE;
+			settings->TlsSecurity = (SelectedProtocol & PROTOCOL_SSL) ? TRUE : FALSE;
+			settings->RdpSecurity = (SelectedProtocol == PROTOCOL_RDP) ? TRUE : FALSE;
 
 			if (SelectedProtocol & PROTOCOL_HYBRID)
 			{
@@ -792,16 +801,19 @@ static int peer_recv_callback(rdpTransport* transport, wStream* s, void* extra)
 static BOOL freerdp_peer_close(freerdp_peer* client)
 {
 	UINT32 SelectedProtocol;
+	rdpContext* context;
 
 	WINPR_ASSERT(client);
-	WINPR_ASSERT(client->settings);
-	WINPR_ASSERT(client->context);
-	WINPR_ASSERT(client->context->rdp);
+
+	context = client->context;
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(context->settings);
+	WINPR_ASSERT(context->rdp);
 
 	/** if negotiation has failed, we're not MCS connected. So don't
 	 * 	send anything else, or some mstsc will consider that as an error
 	 */
-	SelectedProtocol = nego_get_selected_protocol(client->context->rdp->nego);
+	SelectedProtocol = nego_get_selected_protocol(context->rdp->nego);
 
 	if (SelectedProtocol & PROTOCOL_FAILED_NEGO)
 		return TRUE;
@@ -811,25 +823,23 @@ static BOOL freerdp_peer_close(freerdp_peer* client)
 	 * The server first sends the client a Deactivate All PDU followed by an
 	 * optional MCS Disconnect Provider Ultimatum PDU.
 	 */
-	if (!rdp_send_deactivate_all(client->context->rdp))
+	if (!rdp_send_deactivate_all(context->rdp))
 		return FALSE;
 
-	if (freerdp_settings_get_bool(client->settings, FreeRDP_SupportErrorInfoPdu))
+	if (freerdp_settings_get_bool(context->settings, FreeRDP_SupportErrorInfoPdu))
 	{
-		rdp_send_error_info(client->context->rdp);
+		rdp_send_error_info(context->rdp);
 	}
 
-	return mcs_send_disconnect_provider_ultimatum(client->context->rdp->mcs);
+	return mcs_send_disconnect_provider_ultimatum(context->rdp->mcs);
 }
 
 static void freerdp_peer_disconnect(freerdp_peer* client)
 {
 	rdpTransport* transport;
 	WINPR_ASSERT(client);
-	WINPR_ASSERT(client->context);
-	WINPR_ASSERT(client->context->rdp);
-	WINPR_ASSERT(client->context->rdp->transport);
-	transport = client->context->rdp->transport;
+
+	transport = freerdp_get_transport(client->context);
 	transport_disconnect(transport);
 }
 
@@ -903,69 +913,7 @@ static LicenseCallbackResult freerdp_peer_nolicense(freerdp_peer* peer, wStream*
 
 BOOL freerdp_peer_context_new(freerdp_peer* client)
 {
-	rdpRdp* rdp;
-	rdpContext* context;
-	BOOL ret = TRUE;
-
-	if (!client)
-		return FALSE;
-
-	if (!(context = (rdpContext*)calloc(1, client->ContextSize)))
-		goto fail;
-
-	client->context = context;
-	context->peer = client;
-	context->ServerMode = TRUE;
-	context->settings = client->settings;
-
-	context->dump = stream_dump_new();
-	if (!context->dump)
-		goto fail;
-	if (!(context->metrics = metrics_new(context)))
-		goto fail;
-
-	if (!(rdp = rdp_new(context)))
-		goto fail;
-
-	client->update = rdp->update;
-	client->settings = rdp->settings;
-	client->autodetect = rdp->autodetect;
-	context->rdp = rdp;
-	context->input = rdp->input;
-	context->update = client->update;
-	context->settings = client->settings;
-	context->autodetect = client->autodetect;
-	client->update->context = context;
-	context->input->context = context;
-	client->autodetect->context = context;
-	update_register_server_callbacks(client->update);
-	autodetect_register_server_callbacks(client->autodetect);
-
-	if (!(context->errorDescription = calloc(1, 500)))
-	{
-		WLog_ERR(TAG, "calloc failed!");
-		goto fail;
-	}
-
-	if (!transport_attach(rdp->transport, client->sockfd))
-		goto fail;
-
-	transport_set_recv_callbacks(rdp->transport, peer_recv_callback, client);
-	transport_set_blocking_mode(rdp->transport, FALSE);
-	client->IsWriteBlocked = freerdp_peer_is_write_blocked;
-	client->DrainOutputBuffer = freerdp_peer_drain_output_buffer;
-	client->HasMoreToRead = freerdp_peer_has_more_to_read;
-	client->LicenseCallback = freerdp_peer_nolicense;
-	IFCALLRET(client->ContextNew, ret, client, client->context);
-
-	if (!ret)
-		goto fail;
-	return TRUE;
-
-fail:
-	WLog_ERR(TAG, "ContextNew callback failed");
-	freerdp_peer_context_free(client);
-	return FALSE;
+	return freerdp_peer_context_new_ex(client, NULL);
 }
 
 void freerdp_peer_context_free(freerdp_peer* client)
@@ -1043,3 +991,78 @@ void freerdp_peer_free(freerdp_peer* client)
 	closesocket((SOCKET)client->sockfd);
 	free(client);
 }
+
+BOOL freerdp_peer_context_new_ex(freerdp_peer* client, const rdpSettings* settings)
+{
+	rdpRdp* rdp;
+	rdpContext* context;
+	BOOL ret = TRUE;
+
+	if (!client)
+		return FALSE;
+
+	if (!(context = (rdpContext*)calloc(1, client->ContextSize)))
+		goto fail;
+
+	client->context = context;
+	context->peer = client;
+	context->ServerMode = TRUE;
+
+	if (settings)
+	{
+		context->settings = freerdp_settings_clone(settings);
+		if (!context->settings)
+			goto fail;
+	}
+
+	context->dump = stream_dump_new();
+	if (!context->dump)
+		goto fail;
+	if (!(context->metrics = metrics_new(context)))
+		goto fail;
+
+	if (!(rdp = rdp_new(context)))
+		goto fail;
+
+#if defined(WITH_FREERDP_DEPRECATED)
+	client->update = rdp->update;
+	client->settings = rdp->settings;
+	client->autodetect = rdp->autodetect;
+#endif
+	context->rdp = rdp;
+	context->input = rdp->input;
+	context->update = rdp->update;
+	context->settings = rdp->settings;
+	context->autodetect = rdp->autodetect;
+	context->update->context = context;
+	context->input->context = context;
+	context->autodetect->context = context;
+	update_register_server_callbacks(rdp->update);
+	autodetect_register_server_callbacks(rdp->autodetect);
+
+	if (!(context->errorDescription = calloc(1, 500)))
+	{
+		WLog_ERR(TAG, "calloc failed!");
+		goto fail;
+	}
+
+	if (!transport_attach(rdp->transport, client->sockfd))
+		goto fail;
+
+	transport_set_recv_callbacks(rdp->transport, peer_recv_callback, client);
+	transport_set_blocking_mode(rdp->transport, FALSE);
+	client->IsWriteBlocked = freerdp_peer_is_write_blocked;
+	client->DrainOutputBuffer = freerdp_peer_drain_output_buffer;
+	client->HasMoreToRead = freerdp_peer_has_more_to_read;
+	client->LicenseCallback = freerdp_peer_nolicense;
+	IFCALLRET(client->ContextNew, ret, client, client->context);
+
+	if (!ret)
+		goto fail;
+	return TRUE;
+
+fail:
+	WLog_ERR(TAG, "ContextNew callback failed");
+	freerdp_peer_context_free(client);
+	return FALSE;
+}
diff --git a/libfreerdp/core/rdp.c b/libfreerdp/core/rdp.c
index 28a46433d..d59dc6cc2 100644
--- a/libfreerdp/core/rdp.c
+++ b/libfreerdp/core/rdp.c
@@ -1800,23 +1800,24 @@ rdpRdp* rdp_new(rdpContext* context)
 
 	if (!context->settings)
 	{
-		context->settings = freerdp_settings_new(flags);
+		context->settings = rdp->settings = freerdp_settings_new(flags);
 
-		if (!context->settings)
+		if (!rdp->settings)
 			goto fail;
 	}
-
-	rdp->settings = context->settings;
+	else
+		rdp->settings = context->settings;
+	rdp->settings->instance = context->instance;
 
 	if (context->instance)
-	{
-		rdp->settings->instance = context->instance;
-		context->instance->settings = rdp->settings;
-	}
+		context->settings->instance = context->instance;
 	else if (context->peer)
 	{
 		rdp->settings->instance = context->peer;
+
+#if defined(WITH_FREERDP_DEPRECATED)
 		context->peer->settings = rdp->settings;
+#endif
 	}
 
 	rdp->transport = transport_new(context);
@@ -1869,7 +1870,7 @@ rdpRdp* rdp_new(rdpContext* context)
 	if (!rdp->redirection)
 		goto fail;
 
-	rdp->autodetect = autodetect_new();
+	rdp->autodetect = autodetect_new(rdp->context);
 
 	if (!rdp->autodetect)
 		goto fail;
diff --git a/libfreerdp/core/redirection.c b/libfreerdp/core/redirection.c
index 6f75d8ee9..a449d6c45 100644
--- a/libfreerdp/core/redirection.c
+++ b/libfreerdp/core/redirection.c
@@ -455,7 +455,7 @@ int rdp_recv_enhanced_security_redirection_packet(rdpRdp* rdp, wStream* s)
 	return status;
 }
 
-rdpRedirection* redirection_new()
+rdpRedirection* redirection_new(void)
 {
 	rdpRedirection* redirection;
 	redirection = (rdpRedirection*)calloc(1, sizeof(rdpRedirection));
diff --git a/libfreerdp/core/server.c b/libfreerdp/core/server.c
index e0f8c6025..74f087bac 100644
--- a/libfreerdp/core/server.c
+++ b/libfreerdp/core/server.c
@@ -1196,6 +1196,7 @@ HANDLE WINAPI FreeRDP_WTSVirtualChannelOpen(HANDLE hServer, DWORD SessionId, LPS
 	rdpPeerChannel* channel = NULL;
 	WTSVirtualChannelManager* vcm;
 	HANDLE hChannelHandle = NULL;
+	rdpContext* context;
 	vcm = (WTSVirtualChannelManager*)hServer;
 
 	if (!vcm)
@@ -1205,7 +1206,16 @@ HANDLE WINAPI FreeRDP_WTSVirtualChannelOpen(HANDLE hServer, DWORD SessionId, LPS
 	}
 
 	client = vcm->client;
-	mcs = client->context->rdp->mcs;
+	WINPR_ASSERT(client);
+
+	context = client->context;
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(context->rdp);
+	WINPR_ASSERT(context->settings);
+
+	mcs = context->rdp->mcs;
+	WINPR_ASSERT(mcs);
+
 	length = strlen(pVirtualName);
 
 	if (length > 8)
@@ -1234,8 +1244,9 @@ HANDLE WINAPI FreeRDP_WTSVirtualChannelOpen(HANDLE hServer, DWORD SessionId, LPS
 
 	if (!channel)
 	{
-		channel = channel_new(vcm, client, joined_channel->ChannelId, index,
-		                      RDP_PEER_CHANNEL_TYPE_SVC, client->settings->VirtualChannelChunkSize);
+		channel =
+		    channel_new(vcm, client, joined_channel->ChannelId, index, RDP_PEER_CHANNEL_TYPE_SVC,
+		                context->settings->VirtualChannelChunkSize);
 
 		if (!channel)
 			goto fail;
@@ -1302,8 +1313,11 @@ HANDLE WINAPI FreeRDP_WTSVirtualChannelOpenEx(DWORD SessionId, LPSTR pVirtualNam
 		return NULL;
 	}
 
+	WINPR_ASSERT(client);
+	WINPR_ASSERT(client->context);
+	WINPR_ASSERT(client->context->settings);
 	channel = channel_new(vcm, client, 0, 0, RDP_PEER_CHANNEL_TYPE_DVC,
-	                      client->settings->VirtualChannelChunkSize);
+	                      client->context->settings->VirtualChannelChunkSize);
 
 	if (!channel)
 	{
@@ -1481,12 +1495,16 @@ BOOL WINAPI FreeRDP_WTSVirtualChannelWrite(HANDLE hChannelHandle, PCHAR Buffer,
 	}
 	else
 	{
+		rdpContext* context;
+
 		first = TRUE;
 		WINPR_ASSERT(channel->client);
-		WINPR_ASSERT(channel->client->settings);
+		context = channel->client->context;
+		WINPR_ASSERT(context);
+		WINPR_ASSERT(context->settings);
 		while (Length > 0)
 		{
-			s = Stream_New(NULL, channel->client->settings->VirtualChannelChunkSize);
+			s = Stream_New(NULL, context->settings->VirtualChannelChunkSize);
 
 			if (!s)
 			{
diff --git a/libfreerdp/core/transport.c b/libfreerdp/core/transport.c
index 95a86a495..672952497 100644
--- a/libfreerdp/core/transport.c
+++ b/libfreerdp/core/transport.c
@@ -66,7 +66,6 @@ struct rdp_transport
 	rdpTls* tls;
 	rdpContext* context;
 	rdpNla* nla;
-	rdpSettings* settings;
 	void* ReceiveExtra;
 	wStream* ReceiveBuffer;
 	TransportRecv ReceiveCallback;
@@ -207,13 +206,14 @@ BOOL transport_connect_rdp(rdpTransport* transport)
 
 BOOL transport_connect_tls(rdpTransport* transport)
 {
-	if (!transport)
-		return FALSE;
+	const rdpSettings* settings;
+	rdpContext* context = transport_get_context(transport);
 
-	WINPR_ASSERT(transport->settings);
+	settings = context->settings;
+	WINPR_ASSERT(settings);
 
 	/* Only prompt for password if we use TLS (NLA also calls this function) */
-	if (transport->settings->SelectedProtocol == PROTOCOL_SSL)
+	if (settings->SelectedProtocol == PROTOCOL_SSL)
 	{
 		switch (utils_authenticate(transport_get_context(transport)->instance, AUTH_TLS, FALSE))
 		{
@@ -241,7 +241,7 @@ static BOOL transport_default_connect_tls(rdpTransport* transport)
 	context = transport_get_context(transport);
 	WINPR_ASSERT(context);
 
-	settings = transport->settings;
+	settings = context->settings;
 	WINPR_ASSERT(settings);
 
 	if (!(tls = tls_new(settings)))
@@ -349,17 +349,16 @@ BOOL transport_connect(rdpTransport* transport, const char* hostname, UINT16 por
 	int sockfd;
 	BOOL status = FALSE;
 	rdpSettings* settings;
-	rdpContext* context;
+	rdpContext* context = transport_get_context(transport);
 	BOOL rpcFallback;
 
-	WINPR_ASSERT(transport);
+	WINPR_ASSERT(context);
 	WINPR_ASSERT(hostname);
 
-	settings = transport->settings;
-	context = transport_get_context(transport);
-	rpcFallback = !settings->GatewayHttpTransport;
+	settings = context->settings;
 	WINPR_ASSERT(settings);
-	WINPR_ASSERT(context);
+
+	rpcFallback = !settings->GatewayHttpTransport;
 
 	if (transport->GatewayEnabled)
 	{
@@ -460,15 +459,16 @@ BOOL transport_accept_tls(rdpTransport* transport)
 
 static BOOL transport_default_accept_tls(rdpTransport* transport)
 {
+	rdpContext* context = transport_get_context(transport);
 	rdpSettings* settings;
 
-	WINPR_ASSERT(transport);
+	WINPR_ASSERT(context);
 
-	settings = transport->settings;
+	settings = context->settings;
 	WINPR_ASSERT(settings);
 
 	if (!transport->tls)
-		transport->tls = tls_new(transport->settings);
+		transport->tls = tls_new(settings);
 
 	transport->layer = TRANSPORT_LAYER_TLS;
 
@@ -481,14 +481,17 @@ static BOOL transport_default_accept_tls(rdpTransport* transport)
 
 BOOL transport_accept_nla(rdpTransport* transport)
 {
+	rdpContext* context = transport_get_context(transport);
 	rdpSettings* settings;
 	freerdp* instance;
-	if (!transport)
-		return FALSE;
-	settings = transport->settings;
-	if (!settings)
-		return FALSE;
-	instance = (freerdp*)settings->instance;
+
+	WINPR_ASSERT(context);
+
+	settings = context->settings;
+	WINPR_ASSERT(settings);
+
+	instance = context->instance;
+	WINPR_ASSERT(settings);
 	if (!IFCALLRESULT(FALSE, transport->io.TLSAccept, transport))
 		return FALSE;
 
@@ -876,15 +879,14 @@ static int transport_default_write(rdpTransport* transport, wStream* s)
 	int status = -1;
 	int writtenlength = 0;
 	rdpRdp* rdp;
-	rdpContext* context;
+	rdpContext* context = transport_get_context(transport);
+
+	WINPR_ASSERT(transport);
+	WINPR_ASSERT(context);
 
 	if (!s)
 		return -1;
 
-	context = transport_get_context(transport);
-	if (!transport || !context)
-		goto fail;
-
 	rdp = context->rdp;
 	if (!rdp)
 		goto fail;
@@ -936,7 +938,8 @@ static int transport_default_write(rdpTransport* transport, wStream* s)
 			continue;
 		}
 
-		if (transport->blocking || transport->settings->WaitForOutputBufferFlush)
+		WINPR_ASSERT(context->settings);
+		if (transport->blocking || context->settings->WaitForOutputBufferFlush)
 		{
 			while (BIO_write_blocked(transport->frontBio))
 			{
@@ -1101,11 +1104,8 @@ int transport_check_fds(rdpTransport* transport)
 	wStream* received;
 	UINT64 now = GetTickCount64();
 	UINT64 dueDate = 0;
-	rdpContext* context;
+	rdpContext* context = transport_get_context(transport);
 
-	WINPR_ASSERT(transport);
-
-	context = transport_get_context(transport);
 	WINPR_ASSERT(context);
 
 	if (transport->layer == TRANSPORT_LAYER_CLOSED)
@@ -1115,8 +1115,8 @@ int transport_check_fds(rdpTransport* transport)
 		return -1;
 	}
 
-	WINPR_ASSERT(transport->settings);
-	dueDate = now + transport->settings->MaxTimeInCheckLoop;
+	WINPR_ASSERT(context->settings);
+	dueDate = now + context->settings->MaxTimeInCheckLoop;
 
 	if (transport->haveMoreBytesToRead)
 	{
@@ -1281,7 +1281,6 @@ rdpTransport* transport_new(rdpContext* context)
 	transport->io.ReadBytes = transport_read_layer;
 
 	transport->context = context;
-	transport->settings = context->settings;
 	transport->ReceivePool = StreamPool_New(TRUE, BUFFER_SIZE);
 
 	if (!transport->ReceivePool)
diff --git a/libfreerdp/core/update.c b/libfreerdp/core/update.c
index 7ef965469..9d06b2875 100644
--- a/libfreerdp/core/update.c
+++ b/libfreerdp/core/update.c
@@ -3043,6 +3043,7 @@ rdpUpdate* update_new(rdpRdp* rdp)
 	if (!update)
 		return NULL;
 
+	update->common.context = rdp->context;
 	update->log = WLog_Get("com.freerdp.core.update");
 	InitializeCriticalSection(&(update->mux));
 	update->common.pointer = (rdpPointerUpdate*)calloc(1, sizeof(rdpPointerUpdate));
diff --git a/libfreerdp/core/utils.c b/libfreerdp/core/utils.c
index 6b40ca9e5..ab1846b84 100644
--- a/libfreerdp/core/utils.c
+++ b/libfreerdp/core/utils.c
@@ -50,9 +50,9 @@ auth_status utils_authenticate_gateway(freerdp* instance, rdp_auth_reason reason
 
 	WINPR_ASSERT(instance);
 	WINPR_ASSERT(instance->context);
-	WINPR_ASSERT(instance->settings);
+	WINPR_ASSERT(instance->context->settings);
 
-	settings = instance->settings;
+	settings = instance->context->settings;
 
 	if (freerdp_shall_disconnect(instance))
 		return AUTH_FAILED;
@@ -92,9 +92,9 @@ auth_status utils_authenticate(freerdp* instance, rdp_auth_reason reason, BOOL o
 
 	WINPR_ASSERT(instance);
 	WINPR_ASSERT(instance->context);
-	WINPR_ASSERT(instance->settings);
+	WINPR_ASSERT(instance->context->settings);
 
-	settings = instance->settings;
+	settings = instance->context->settings;
 
 	if (freerdp_shall_disconnect(instance))
 		return AUTH_FAILED;
@@ -111,7 +111,7 @@ auth_status utils_authenticate(freerdp* instance, rdp_auth_reason reason, BOOL o
 	{
 		case AUTH_RDP:
 		case AUTH_TLS:
-			if (instance->settings->SmartcardLogon)
+			if (settings->SmartcardLogon)
 			{
 				if (!utils_str_is_empty(settings->Password))
 				{
@@ -122,7 +122,7 @@ auth_status utils_authenticate(freerdp* instance, rdp_auth_reason reason, BOOL o
 			}
 			break;
 		case AUTH_NLA:
-			if (instance->settings->SmartcardLogon)
+			if (settings->SmartcardLogon)
 				reason = AUTH_SMARTCARD_PIN;
 			break;
 		default:
diff --git a/libfreerdp/crypto/tls.c b/libfreerdp/crypto/tls.c
index cecb3872f..6bdf4f8a5 100644
--- a/libfreerdp/crypto/tls.c
+++ b/libfreerdp/crypto/tls.c
@@ -1285,9 +1285,15 @@ int tls_verify_certificate(rdpTls* tls, CryptoCert cert, const char* hostname, U
 	int verification_status = -1;
 	BOOL hostname_match = FALSE;
 	rdpCertificateData* certificate_data = NULL;
-	freerdp* instance = (freerdp*)tls->settings->instance;
 	BYTE* pemCert = NULL;
 	DWORD flags = VERIFY_CERT_FLAG_NONE;
+	freerdp* instance;
+
+	WINPR_ASSERT(tls);
+	WINPR_ASSERT(tls->settings);
+
+	instance = (freerdp*)tls->settings->instance;
+	WINPR_ASSERT(instance);
 
 	if (freerdp_shall_disconnect(instance))
 		return -1;
@@ -1437,7 +1443,7 @@ int tls_verify_certificate(rdpTls* tls, CryptoCert cert, const char* hostname, U
 				else if (instance->VerifyCertificateEx)
 				{
 					const BOOL use_pem = freerdp_settings_get_bool(
-					    instance->settings, FreeRDP_CertificateCallbackPreferPEM);
+					    tls->settings, FreeRDP_CertificateCallbackPreferPEM);
 					char* fp = NULL;
 					DWORD cflags = flags;
 					if (use_pem)
@@ -1503,7 +1509,7 @@ int tls_verify_certificate(rdpTls* tls, CryptoCert cert, const char* hostname, U
 					const char* old_pem = certificate_data_get_pem(stored_data);
 					const BOOL fpIsAllocated =
 					    !old_pem || !freerdp_settings_get_bool(
-					                    instance->settings, FreeRDP_CertificateCallbackPreferPEM);
+					                    tls->settings, FreeRDP_CertificateCallbackPreferPEM);
 					char* fp;
 					if (!fpIsAllocated)
 					{
diff --git a/libfreerdp/gdi/gdi.c b/libfreerdp/gdi/gdi.c
index ebbba930b..ffa238232 100644
--- a/libfreerdp/gdi/gdi.c
+++ b/libfreerdp/gdi/gdi.c
@@ -1276,22 +1276,31 @@ BOOL gdi_init(freerdp* instance, UINT32 format)
 BOOL gdi_init_ex(freerdp* instance, UINT32 format, UINT32 stride, BYTE* buffer,
                  void (*pfree)(void*))
 {
-	UINT32 SrcFormat = gdi_get_pixel_format(instance->settings->ColorDepth);
-	rdpGdi* gdi = (rdpGdi*)calloc(1, sizeof(rdpGdi));
-	rdpContext* context = instance->context;
+	rdpContext* context;
+	UINT32 SrcFormat;
+	rdpGdi* gdi;
+
+	WINPR_ASSERT(instance);
+
+	context = instance->context;
+	WINPR_ASSERT(context);
+	WINPR_ASSERT(context->settings);
+
+	SrcFormat = gdi_get_pixel_format(context->settings->ColorDepth);
+	gdi = (rdpGdi*)calloc(1, sizeof(rdpGdi));
 
 	if (!gdi)
 		goto fail;
 
-	instance->context->gdi = gdi;
+	context->gdi = gdi;
 	gdi->log = WLog_Get(TAG);
 
 	if (!gdi->log)
 		goto fail;
 
-	gdi->context = instance->context;
-	gdi->width = instance->settings->DesktopWidth;
-	gdi->height = instance->settings->DesktopHeight;
+	gdi->context = context;
+	gdi->width = context->settings->DesktopWidth;
+	gdi->height = context->settings->DesktopHeight;
 	gdi->dstFormat = format;
 	/* default internal buffer format */
 	WLog_Print(gdi->log, WLOG_INFO, "Local framebuffer format  %s",
@@ -1307,17 +1316,17 @@ BOOL gdi_init_ex(freerdp* instance, UINT32 format, UINT32 stride, BYTE* buffer,
 	if (!gdi_init_primary(gdi, stride, gdi->dstFormat, buffer, pfree, FALSE))
 		goto fail;
 
-	if (!(context->cache = cache_new(instance->context)))
+	if (!(context->cache = cache_new(context)))
 		goto fail;
 
-	gdi_register_update_callbacks(instance->update);
-	brush_cache_register_callbacks(instance->update);
-	glyph_cache_register_callbacks(instance->update);
-	bitmap_cache_register_callbacks(instance->update);
-	offscreen_cache_register_callbacks(instance->update);
-	palette_cache_register_callbacks(instance->update);
+	gdi_register_update_callbacks(context->update);
+	brush_cache_register_callbacks(context->update);
+	glyph_cache_register_callbacks(context->update);
+	bitmap_cache_register_callbacks(context->update);
+	offscreen_cache_register_callbacks(context->update);
+	palette_cache_register_callbacks(context->update);
 
-	if (!gdi_register_graphics(instance->context->graphics))
+	if (!gdi_register_graphics(context->graphics))
 		goto fail;
 
 	return TRUE;
diff --git a/server/Mac/mf_peer.c b/server/Mac/mf_peer.c
index 955343e7f..c31f3662b 100644
--- a/server/Mac/mf_peer.c
+++ b/server/Mac/mf_peer.c
@@ -93,9 +93,18 @@ static void mf_peer_rfx_update(freerdp_peer* client)
 	rdpUpdate* update;
 	mfPeerContext* mfp;
 	SURFACE_BITS_COMMAND cmd = { 0 };
-	update = client->update;
+
+	WINPR_ASSERT(client);
+
 	mfp = (mfPeerContext*)client->context;
+	WINPR_ASSERT(mfp);
+
+	update = client->context->update;
+	WINPR_ASSERT(update);
+
 	s = mfp->s;
+	WINPR_ASSERT(s);
+
 	Stream_Clear(s);
 	Stream_SetPosition(s, 0);
 	UINT32 x = mfi->invalid.x / mfi->scale;
@@ -157,15 +166,24 @@ static BOOL mf_peer_check_fds(freerdp_peer* client)
 /* Called when we have a new peer connecting */
 static BOOL mf_peer_context_new(freerdp_peer* client, mfPeerContext* context)
 {
+	rdpSettings* settings;
+
+	WINPR_ASSERT(client);
+	WINPR_ASSERT(client->context);
+	WINPR_ASSERT(context);
+
+	settings = client->context->settings;
+	WINPR_ASSERT(settings);
+
 	if (!(context->info = mf_info_get_instance()))
 		return FALSE;
 
-	if (!(context->rfx_context = rfx_context_new_ex(TRUE, client->settings->ThreadingFlags)))
+	if (!(context->rfx_context = rfx_context_new_ex(TRUE, settings->ThreadingFlags)))
 		goto fail_rfx_context;
 
 	context->rfx_context->mode = RLGR3;
-	context->rfx_context->width = client->settings->DesktopWidth;
-	context->rfx_context->height = client->settings->DesktopHeight;
+	context->rfx_context->width = settings->DesktopWidth;
+	context->rfx_context->height = settings->DesktopHeight;
 	rfx_context_set_pixel_format(context->rfx_context, PIXEL_FORMAT_BGRA32);
 
 	if (!(context->s = Stream_New(NULL, 0xFFFF)))
@@ -247,9 +265,16 @@ static BOOL mf_peer_init(freerdp_peer* client)
 
 static BOOL mf_peer_post_connect(freerdp_peer* client)
 {
-	mfPeerContext* context = (mfPeerContext*)client->context;
-	rdpSettings* settings = client->settings;
 	mfInfo* mfi = mf_info_get_instance();
+
+	WINPR_ASSERT(client);
+
+	mfPeerContext* context = (mfPeerContext*)client->context;
+	WINPR_ASSERT(context);
+
+	rdpSettings* settings = client->context->settings;
+	WINPR_ASSERT(settings);
+
 	mfi->scale = 1;
 	// mfi->servscreen_width = 2880 / mfi->scale;
 	// mfi->servscreen_height = 1800 / mfi->scale;
@@ -263,7 +288,11 @@ static BOOL mf_peer_post_connect(freerdp_peer* client)
 	settings->DesktopWidth = mfi->servscreen_width;
 	settings->DesktopHeight = mfi->servscreen_height;
 	settings->ColorDepth = bitsPerPixel;
-	client->update->DesktopResize(client->update->context);
+
+	WINPR_ASSERT(client->context->update);
+	WINPR_ASSERT(client->context->update->DesktopResize);
+	client->context->update->DesktopResize(client->context);
+
 	mfi->mouse_down_left = FALSE;
 	mfi->mouse_down_right = FALSE;
 	mfi->mouse_down_other = FALSE;
@@ -284,9 +313,15 @@ static BOOL mf_peer_post_connect(freerdp_peer* client)
 
 static BOOL mf_peer_activate(freerdp_peer* client)
 {
+	WINPR_ASSERT(client);
+
 	mfPeerContext* context = (mfPeerContext*)client->context;
-	rfx_context_reset(context->rfx_context, client->settings->DesktopWidth,
-	                  client->settings->DesktopHeight);
+	WINPR_ASSERT(context);
+
+	rdpSettings* settings = client->context->settings;
+	WINPR_ASSERT(settings);
+
+	rfx_context_reset(context->rfx_context, settings->DesktopWidth, settings->DesktopHeight);
 	context->activated = TRUE;
 	return TRUE;
 }
@@ -321,41 +356,56 @@ static BOOL mf_peer_suppress_output(rdpContext* context, BYTE allow, const RECTA
 static void* mf_peer_main_loop(void* arg)
 {
 	mfPeerContext* context;
+	rdpSettings* settings;
+	rdpInput* input;
+	rdpUpdate* update;
 	freerdp_peer* client = (freerdp_peer*)arg;
 
-	WINPR_ASSERT(client);
-	WINPR_ASSERT(client->settings);
-
 	if (!mf_peer_init(client))
 	{
 		freerdp_peer_free(client);
 		return NULL;
 	}
 
-	/* Initialize the real server settings here */
-	freerdp_settings_set_string(client->settings, FreeRDP_CertificateFile, "server.crt");
-	freerdp_settings_set_string(client->settings, FreeRDP_PrivateKeyFile, "server.key");
+	WINPR_ASSERT(client->context);
 
-	if (!client->settings->CertificateFile || !client->settings->PrivateKeyFile)
+	settings = client->context->settings;
+	WINPR_ASSERT(settings);
+
+	/* Initialize the real server settings here */
+	freerdp_settings_set_string(settings, FreeRDP_CertificateFile, "server.crt");
+	freerdp_settings_set_string(settings, FreeRDP_PrivateKeyFile, "server.key");
+
+	if (!settings->CertificateFile || !settings->PrivateKeyFile)
 	{
 		freerdp_peer_free(client);
 		return NULL;
 	}
 
-	client->settings->NlaSecurity = FALSE;
-	client->settings->RemoteFxCodec = TRUE;
-	client->settings->ColorDepth = 32;
-	client->settings->SuppressOutput = TRUE;
-	client->settings->RefreshRect = FALSE;
+	settings->NlaSecurity = FALSE;
+	settings->RemoteFxCodec = TRUE;
+	settings->ColorDepth = 32;
+	settings->SuppressOutput = TRUE;
+	settings->RefreshRect = FALSE;
+
 	client->PostConnect = mf_peer_post_connect;
 	client->Activate = mf_peer_activate;
-	client->context->input->SynchronizeEvent = mf_peer_synchronize_event;
-	client->context->input->KeyboardEvent = mf_input_keyboard_event; // mf_peer_keyboard_event;
-	client->context->input->UnicodeKeyboardEvent = mf_peer_unicode_keyboard_event;
-	client->context->input->MouseEvent = mf_input_mouse_event;
-	client->context->input->ExtendedMouseEvent = mf_input_extended_mouse_event;
-	// client->update->RefreshRect = mf_peer_refresh_rect;
-	client->update->SuppressOutput = mf_peer_suppress_output;
+
+	input = client->context->input;
+	WINPR_ASSERT(input);
+
+	input->SynchronizeEvent = mf_peer_synchronize_event;
+	input->KeyboardEvent = mf_input_keyboard_event; // mf_peer_keyboard_event;
+	input->UnicodeKeyboardEvent = mf_peer_unicode_keyboard_event;
+	input->MouseEvent = mf_input_mouse_event;
+	input->ExtendedMouseEvent = mf_input_extended_mouse_event;
+
+	update = client->context->update;
+	WINPR_ASSERT(update);
+
+	// update->RefreshRect = mf_peer_refresh_rect;
+	update->SuppressOutput = mf_peer_suppress_output;
+
 	client->Initialize(client);
 	context = (mfPeerContext*)client->context;
 
diff --git a/server/Sample/sfreerdp.c b/server/Sample/sfreerdp.c
index b1a1e9fe0..2b72eb066 100644
--- a/server/Sample/sfreerdp.c
+++ b/server/Sample/sfreerdp.c
@@ -111,8 +111,9 @@ static BOOL test_peer_context_new(freerdp_peer* client, rdpContext* ctx)
 
 	WINPR_ASSERT(client);
 	WINPR_ASSERT(context);
+	WINPR_ASSERT(ctx->settings);
 
-	if (!(context->rfx_context = rfx_context_new_ex(TRUE, client->settings->ThreadingFlags)))
+	if (!(context->rfx_context = rfx_context_new_ex(TRUE, ctx->settings->ThreadingFlags)))
 		goto fail;
 
 	if (!rfx_context_reset(context->rfx_context, SAMPLE_SERVER_DEFAULT_WIDTH,
@@ -171,7 +172,9 @@ static void test_peer_begin_frame(freerdp_peer* client)
 	testPeerContext* context;
 
 	WINPR_ASSERT(client);
-	update = client->update;
+	WINPR_ASSERT(client->context);
+
+	update = client->context->update;
 	WINPR_ASSERT(update);
 
 	context = (testPeerContext*)client->context;
@@ -190,12 +193,13 @@ static void test_peer_end_frame(freerdp_peer* client)
 	testPeerContext* context;
 
 	WINPR_ASSERT(client);
-	update = client->update;
-	WINPR_ASSERT(update);
 
 	context = (testPeerContext*)client->context;
 	WINPR_ASSERT(context);
 
+	update = client->context->update;
+	WINPR_ASSERT(update);
+
 	fm.frameAction = SURFACECMD_FRAMEACTION_END;
 	fm.frameId = context->frame_id;
 	WINPR_ASSERT(update->SurfaceFrameMarker);
@@ -219,10 +223,10 @@ static BOOL test_peer_draw_background(freerdp_peer* client)
 	context = (testPeerContext*)client->context;
 	WINPR_ASSERT(context);
 
-	settings = client->settings;
+	settings = client->context->settings;
 	WINPR_ASSERT(settings);
 
-	update = client->update;
+	update = client->context->update;
 	WINPR_ASSERT(update);
 
 	if (!settings->RemoteFxCodec && !freerdp_settings_get_bool(settings, FreeRDP_NSCodec))
@@ -297,15 +301,17 @@ static BOOL test_peer_load_icon(freerdp_peer* client)
 	char line[50];
 	BYTE* rgb_data = NULL;
 	int c;
+	rdpSettings* settings;
 
 	WINPR_ASSERT(client);
 
 	context = (testPeerContext*)client->context;
 	WINPR_ASSERT(context);
-	WINPR_ASSERT(client->settings);
 
-	if (!client->settings->RemoteFxCodec &&
-	    !freerdp_settings_get_bool(client->settings, FreeRDP_NSCodec))
+	settings = client->context->settings;
+	WINPR_ASSERT(settings);
+
+	if (!settings->RemoteFxCodec && !freerdp_settings_get_bool(settings, FreeRDP_NSCodec))
 	{
 		WLog_ERR(TAG, "Client doesn't support RemoteFX or NSCodec");
 		return FALSE;
@@ -364,19 +370,22 @@ static void test_peer_draw_icon(freerdp_peer* client, UINT32 x, UINT32 y)
 	wStream* s;
 	RFX_RECT rect;
 	rdpUpdate* update;
+	rdpSettings* settings;
 	SURFACE_BITS_COMMAND cmd = { 0 };
 	testPeerContext* context;
 
 	WINPR_ASSERT(client);
-	WINPR_ASSERT(client->settings);
 
 	context = (testPeerContext*)client->context;
 	WINPR_ASSERT(context);
 
-	update = client->update;
+	update = client->context->update;
 	WINPR_ASSERT(update);
 
-	if (freerdp_settings_get_bool(client->settings, FreeRDP_DumpRemoteFx))
+	settings = client->context->settings;
+	WINPR_ASSERT(settings);
+
+	if (freerdp_settings_get_bool(settings, FreeRDP_DumpRemoteFx))
 		return;
 
 	if (context->icon_width < 1 || !context->activated)
@@ -388,16 +397,16 @@ static void test_peer_draw_icon(freerdp_peer* client, UINT32 x, UINT32 y)
 	rect.width = context->icon_width;
 	rect.height = context->icon_height;
 
-	if (client->settings->RemoteFxCodec)
+	if (settings->RemoteFxCodec)
 	{
-		WINPR_ASSERT(client->settings->RemoteFxCodecId <= UINT16_MAX);
-		cmd.bmp.codecID = (UINT16)client->settings->RemoteFxCodecId;
+		WINPR_ASSERT(settings->RemoteFxCodecId <= UINT16_MAX);
+		cmd.bmp.codecID = (UINT16)settings->RemoteFxCodecId;
 		cmd.cmdType = CMDTYPE_STREAM_SURFACE_BITS;
 	}
 	else
 	{
-		WINPR_ASSERT(client->settings->NSCodecId <= UINT16_MAX);
-		cmd.bmp.codecID = (UINT16)client->settings->NSCodecId;
+		WINPR_ASSERT(settings->NSCodecId <= UINT16_MAX);
+		cmd.bmp.codecID = (UINT16)settings->NSCodecId;
 		cmd.cmdType = CMDTYPE_SET_SURFACE_BITS;
 	}
 
@@ -405,7 +414,7 @@ static void test_peer_draw_icon(freerdp_peer* client, UINT32 x, UINT32 y)
 	{
 		s = test_peer_stream_init(context);
 
-		if (client->settings->RemoteFxCodec)
+		if (settings->RemoteFxCodec)
 			rfx_compose_message(context->rfx_context, s, &rect, 1, context->bg_data, rect.width,
 			                    rect.height, rect.width * 3);
 		else
@@ -428,7 +437,7 @@ static void test_peer_draw_icon(freerdp_peer* client, UINT32 x, UINT32 y)
 
 	s = test_peer_stream_init(context);
 
-	if (client->settings->RemoteFxCodec)
+	if (settings->RemoteFxCodec)
 		rfx_compose_message(context->rfx_context, s, &rect, 1, context->icon_data, rect.width,
 		                    rect.height, rect.width * 3);
 	else
@@ -513,7 +522,7 @@ static BOOL tf_peer_dump_rfx(freerdp_peer* client)
 	if (!s)
 		return FALSE;
 
-	update = client->update;
+	update = client->context->update;
 	WINPR_ASSERT(update);
 
 	if (!(pcap_rfx = pcap_open(info->test_pcap_file, FALSE)))
@@ -610,13 +619,16 @@ static DWORD WINAPI tf_debug_channel_thread_func(LPVOID arg)
 static BOOL tf_peer_post_connect(freerdp_peer* client)
 {
 	testPeerContext* context;
+	rdpSettings* settings;
 
 	WINPR_ASSERT(client);
-	WINPR_ASSERT(client->settings);
 
 	context = (testPeerContext*)client->context;
 	WINPR_ASSERT(context);
 
+	settings = client->context->settings;
+	WINPR_ASSERT(settings);
+
 	/**
 	 * This callback is called when the entire connection sequence is done, i.e. we've received the
 	 * Font List PDU from the client and sent out the Font Map PDU.
@@ -624,25 +636,22 @@ static BOOL tf_peer_post_connect(freerdp_peer* client)
 	 * callback returns.
 	 */
 	WLog_DBG(TAG, "Client %s is activated (osMajorType %" PRIu32 " osMinorType %" PRIu32 ")",
-	         client->local ? "(local)" : client->hostname, client->settings->OsMajorType,
-	         client->settings->OsMinorType);
+	         client->local ? "(local)" : client->hostname, settings->OsMajorType,
+	         settings->OsMinorType);
 
-	if (client->settings->AutoLogonEnabled)
+	if (settings->AutoLogonEnabled)
 	{
 		WLog_DBG(TAG, " and wants to login automatically as %s\\%s",
-		         client->settings->Domain ? client->settings->Domain : "",
-		         client->settings->Username);
+		         settings->Domain ? settings->Domain : "", settings->Username);
 		/* A real server may perform OS login here if NLA is not executed previously. */
 	}
 
 	WLog_DBG(TAG, "");
 	WLog_DBG(TAG, "Client requested desktop: %" PRIu32 "x%" PRIu32 "x%" PRIu32 "",
-	         client->settings->DesktopWidth, client->settings->DesktopHeight,
-	         client->settings->ColorDepth);
+	         settings->DesktopWidth, settings->DesktopHeight, settings->ColorDepth);
 #if (SAMPLE_SERVER_USE_CLIENT_RESOLUTION == 1)
 
-	if (!rfx_context_reset(context->rfx_context, client->settings->DesktopWidth,
-	                       client->settings->DesktopHeight))
+	if (!rfx_context_reset(context->rfx_context, settings->DesktopWidth, settings->DesktopHeight))
 		return FALSE;
 
 	WLog_DBG(TAG, "Using resolution requested by client.");
@@ -712,14 +721,16 @@ static BOOL tf_peer_activate(freerdp_peer* client)
 {
 	testPeerContext* context;
 	struct server_info* info;
+	rdpSettings* settings;
 
 	WINPR_ASSERT(client);
-	WINPR_ASSERT(client->settings);
-	WINPR_ASSERT(client->update);
 
 	context = (testPeerContext*)client->context;
 	WINPR_ASSERT(context);
 
+	settings = client->context->settings;
+	WINPR_ASSERT(settings);
+
 	info = client->ContextExtra;
 	WINPR_ASSERT(info);
 
@@ -727,11 +738,11 @@ static BOOL tf_peer_activate(freerdp_peer* client)
 	// client->settings->CompressionLevel = PACKET_COMPR_TYPE_8K;
 	// client->settings->CompressionLevel = PACKET_COMPR_TYPE_64K;
 	// client->settings->CompressionLevel = PACKET_COMPR_TYPE_RDP6;
-	client->settings->CompressionLevel = PACKET_COMPR_TYPE_RDP8;
+	settings->CompressionLevel = PACKET_COMPR_TYPE_RDP8;
 
 	if (info->test_pcap_file != NULL)
 	{
-		freerdp_settings_set_bool(client->settings, FreeRDP_DumpRemoteFx, TRUE);
+		freerdp_settings_set_bool(settings, FreeRDP_DumpRemoteFx, TRUE);
 
 		if (!tf_peer_dump_rfx(client))
 			return FALSE;
@@ -754,51 +765,57 @@ static BOOL tf_peer_keyboard_event(rdpInput* input, UINT16 flags, UINT16 code)
 {
 	freerdp_peer* client;
 	rdpUpdate* update;
-	testPeerContext* context;
+	rdpContext* context;
+	testPeerContext* tcontext;
+	rdpSettings* settings;
 
 	WINPR_ASSERT(input);
-	WINPR_ASSERT(input->context);
 
-	client = input->context->peer;
+	context = input->context;
+	WINPR_ASSERT(context);
+
+	client = context->peer;
 	WINPR_ASSERT(client);
-	WINPR_ASSERT(client->settings);
 
-	update = client->update;
+	settings = context->settings;
+	WINPR_ASSERT(settings);
+
+	update = context->update;
 	WINPR_ASSERT(update);
 
-	context = (testPeerContext*)input->context;
-	WINPR_ASSERT(context);
+	tcontext = (testPeerContext*)context;
+	WINPR_ASSERT(tcontext);
 
 	WLog_DBG(TAG, "Client sent a keyboard event (flags:0x%04" PRIX16 " code:0x%04" PRIX16 ")",
 	         flags, code);
 
 	if ((flags & 0x4000) && code == 0x22) /* 'g' key */
 	{
-		if (client->settings->DesktopWidth != 800)
+		if (settings->DesktopWidth != 800)
 		{
-			client->settings->DesktopWidth = 800;
-			client->settings->DesktopHeight = 600;
+			settings->DesktopWidth = 800;
+			settings->DesktopHeight = 600;
 		}
 		else
 		{
-			client->settings->DesktopWidth = SAMPLE_SERVER_DEFAULT_WIDTH;
-			client->settings->DesktopHeight = SAMPLE_SERVER_DEFAULT_HEIGHT;
+			settings->DesktopWidth = SAMPLE_SERVER_DEFAULT_WIDTH;
+			settings->DesktopHeight = SAMPLE_SERVER_DEFAULT_HEIGHT;
 		}
 
-		if (!rfx_context_reset(context->rfx_context, client->settings->DesktopWidth,
-		                       client->settings->DesktopHeight))
+		if (!rfx_context_reset(tcontext->rfx_context, settings->DesktopWidth,
+		                       settings->DesktopHeight))
 			return FALSE;
 
 		WINPR_ASSERT(update->DesktopResize);
 		update->DesktopResize(update->context);
-		context->activated = FALSE;
+		tcontext->activated = FALSE;
 	}
 	else if ((flags & 0x4000) && code == RDP_SCANCODE_KEY_C) /* 'c' key */
 	{
-		if (context->debug_channel)
+		if (tcontext->debug_channel)
 		{
 			ULONG written;
-			WTSVirtualChannelWrite(context->debug_channel, (PCHAR) "test2", 5, &written);
+			WTSVirtualChannelWrite(tcontext->debug_channel, (PCHAR) "test2", 5, &written);
 		}
 	}
 	else if ((flags & 0x4000) && code == RDP_SCANCODE_KEY_X) /* 'x' key */
@@ -808,12 +825,12 @@ static BOOL tf_peer_keyboard_event(rdpInput* input, UINT16 flags, UINT16 code)
 	}
 	else if ((flags & 0x4000) && code == RDP_SCANCODE_KEY_R) /* 'r' key */
 	{
-		context->audin_open = !context->audin_open;
+		tcontext->audin_open = !tcontext->audin_open;
 	}
 #if defined(CHANNEL_AINPUT_SERVER)
 	else if ((flags & 0x4000) && code == RDP_SCANCODE_KEY_I) /* 'i' key */
 	{
-		context->ainput_open = !context->ainput_open;
+		tcontext->ainput_open = !tcontext->ainput_open;
 	}
 #endif
 	else if ((flags & 0x4000) && code == RDP_SCANCODE_KEY_S) /* 's' key */
@@ -965,6 +982,9 @@ static DWORD WINAPI test_peer_mainloop(LPVOID arg)
 	DWORD status;
 	testPeerContext* context;
 	struct server_info* info;
+	rdpSettings* settings;
+	rdpInput* input;
+	rdpUpdate* update;
 	freerdp_peer* client = (freerdp_peer*)arg;
 
 	const char* key = "server.key";
@@ -987,52 +1007,59 @@ static DWORD WINAPI test_peer_mainloop(LPVOID arg)
 		cert = info->cert;
 
 	/* Initialize the real server settings here */
-	WINPR_ASSERT(client->settings);
+	WINPR_ASSERT(client->context);
+	settings = client->context->settings;
+	WINPR_ASSERT(settings);
 	if (info->replay_dump)
 	{
-		if (!freerdp_settings_set_bool(client->settings, FreeRDP_TransportDumpReplay, TRUE) ||
-		    !freerdp_settings_set_string(client->settings, FreeRDP_TransportDumpFile,
-		                                 info->replay_dump))
+		if (!freerdp_settings_set_bool(settings, FreeRDP_TransportDumpReplay, TRUE) ||
+		    !freerdp_settings_set_string(settings, FreeRDP_TransportDumpFile, info->replay_dump))
 		{
 			freerdp_peer_free(client);
 			return 0;
 		}
 	}
-	if (!freerdp_settings_set_string(client->settings, FreeRDP_CertificateFile, cert) ||
-	    !freerdp_settings_set_string(client->settings, FreeRDP_PrivateKeyFile, key) ||
-	    !freerdp_settings_set_string(client->settings, FreeRDP_RdpKeyFile, key))
+	if (!freerdp_settings_set_string(settings, FreeRDP_CertificateFile, cert) ||
+	    !freerdp_settings_set_string(settings, FreeRDP_PrivateKeyFile, key) ||
+	    !freerdp_settings_set_string(settings, FreeRDP_RdpKeyFile, key))
 	{
 		WLog_ERR(TAG, "Memory allocation failed (strdup)");
 		freerdp_peer_free(client);
 		return 0;
 	}
 
-	client->settings->RdpSecurity = TRUE;
-	client->settings->TlsSecurity = TRUE;
-	client->settings->NlaSecurity = FALSE;
-	client->settings->EncryptionLevel = ENCRYPTION_LEVEL_CLIENT_COMPATIBLE;
-	/* client->settings->EncryptionLevel = ENCRYPTION_LEVEL_HIGH; */
-	/* client->settings->EncryptionLevel = ENCRYPTION_LEVEL_LOW; */
-	/* client->settings->EncryptionLevel = ENCRYPTION_LEVEL_FIPS; */
-	client->settings->RemoteFxCodec = TRUE;
-	freerdp_settings_set_bool(client->settings, FreeRDP_NSCodec, TRUE);
-	client->settings->ColorDepth = 32;
-	client->settings->SuppressOutput = TRUE;
-	client->settings->RefreshRect = TRUE;
+	settings->RdpSecurity = TRUE;
+	settings->TlsSecurity = TRUE;
+	settings->NlaSecurity = FALSE;
+	settings->EncryptionLevel = ENCRYPTION_LEVEL_CLIENT_COMPATIBLE;
+	/* settings->EncryptionLevel = ENCRYPTION_LEVEL_HIGH; */
+	/* settings->EncryptionLevel = ENCRYPTION_LEVEL_LOW; */
+	/* settings->EncryptionLevel = ENCRYPTION_LEVEL_FIPS; */
+	settings->RemoteFxCodec = TRUE;
+	freerdp_settings_set_bool(settings, FreeRDP_NSCodec, TRUE);
+	settings->ColorDepth = 32;
+	settings->SuppressOutput = TRUE;
+	settings->RefreshRect = TRUE;
+
 	client->PostConnect = tf_peer_post_connect;
 	client->Activate = tf_peer_activate;
 
 	WINPR_ASSERT(client->context);
-	WINPR_ASSERT(client->context->input);
-	client->context->input->SynchronizeEvent = tf_peer_synchronize_event;
-	client->context->input->KeyboardEvent = tf_peer_keyboard_event;
-	client->context->input->UnicodeKeyboardEvent = tf_peer_unicode_keyboard_event;
-	client->context->input->MouseEvent = tf_peer_mouse_event;
-	client->context->input->ExtendedMouseEvent = tf_peer_extended_mouse_event;
+	input = client->context->input;
+	WINPR_ASSERT(input);
 
-	client->update->RefreshRect = tf_peer_refresh_rect;
-	client->update->SuppressOutput = tf_peer_suppress_output;
-	client->settings->MultifragMaxRequestSize = 0xFFFFFF; /* FIXME */
+	input->SynchronizeEvent = tf_peer_synchronize_event;
+	input->KeyboardEvent = tf_peer_keyboard_event;
+	input->UnicodeKeyboardEvent = tf_peer_unicode_keyboard_event;
+	input->MouseEvent = tf_peer_mouse_event;
+	input->ExtendedMouseEvent = tf_peer_extended_mouse_event;
+
+	update = client->context->update;
+	WINPR_ASSERT(update);
+
+	update->RefreshRect = tf_peer_refresh_rect;
+	update->SuppressOutput = tf_peer_suppress_output;
+	settings->MultifragMaxRequestSize = 0xFFFFFF; /* FIXME */
 
 	WINPR_ASSERT(client->Initialize);
 	rc = client->Initialize(client);
diff --git a/server/Windows/wf_peer.c b/server/Windows/wf_peer.c
index 39b64e461..36e5bb08e 100644
--- a/server/Windows/wf_peer.c
+++ b/server/Windows/wf_peer.c
@@ -91,9 +91,18 @@ static BOOL wf_peer_post_connect(freerdp_peer* client)
 {
 	wfInfo* wfi;
 	rdpSettings* settings;
-	wfPeerContext* context = (wfPeerContext*)client->context;
+	wfPeerContext* context;
+
+	WINPR_ASSERT(client);
+
+	context = (wfPeerContext*)client->context;
+	WINPR_ASSERT(context);
+
 	wfi = context->info;
-	settings = client->settings;
+	WINPR_ASSERT(wfi);
+
+	settings = client->context->settings;
+	WINPR_ASSERT(settings);
 
 	if ((get_screen_info(wfi->screenID, NULL, 0, &wfi->servscreen_width, &wfi->servscreen_height,
 	                     &wfi->bitsPerPixel) == 0) ||
@@ -116,7 +125,10 @@ static BOOL wf_peer_post_connect(freerdp_peer* client)
 		settings->DesktopWidth = wfi->servscreen_width;
 		settings->DesktopHeight = wfi->servscreen_height;
 		settings->ColorDepth = wfi->bitsPerPixel;
-		client->update->DesktopResize(client->update->context);
+
+		WINPR_ASSERT(client->context->update);
+		WINPR_ASSERT(client->context->update->DesktopResize);
+		client->context->update->DesktopResize(client->context);
 	}
 
 	if (WTSVirtualChannelManagerIsChannelJoined(context->vcm, "rdpsnd"))
@@ -206,17 +218,25 @@ static DWORD WINAPI wf_peer_socket_listener(LPVOID lpParam)
 
 static BOOL wf_peer_read_settings(freerdp_peer* client)
 {
+	rdpSettings* settings;
+
+	WINPR_ASSERT(client);
+	WINPR_ASSERT(client->context);
+
+	settings = client->context->settings;
+	WINPR_ASSERT(settings);
+
 	if (!wf_settings_read_string_ascii(HKEY_LOCAL_MACHINE, SERVER_KEY, _T("CertificateFile"),
-	                                   &(client->settings->CertificateFile)))
+	                                   &(settings->CertificateFile)))
 	{
-		if (!freerdp_settings_set_string(client->settings, FreeRDP_CertificateFile, "server.crt"))
+		if (!freerdp_settings_set_string(settings, FreeRDP_CertificateFile, "server.crt"))
 			return FALSE;
 	}
 
 	if (!wf_settings_read_string_ascii(HKEY_LOCAL_MACHINE, SERVER_KEY, _T("PrivateKeyFile"),
-	                                   &(client->settings->PrivateKeyFile)))
+	                                   &(settings->PrivateKeyFile)))
 	{
-		if (!freerdp_settings_set_string(client->settings, FreeRDP_PrivateKeyFile, "server.key"))
+		if (!freerdp_settings_set_string(settings, FreeRDP_PrivateKeyFile, "server.key"))
 			return FALSE;
 	}
 
@@ -236,7 +256,11 @@ DWORD WINAPI wf_peer_main_loop(LPVOID lpParam)
 	if (!wf_peer_init(client))
 		goto fail_peer_init;
 
-	settings = client->settings;
+	WINPR_ASSERT(client->context);
+
+	settings = client->context->settings;
+	WINPR_ASSERT(settings);
+
 	settings->RemoteFxCodec = TRUE;
 	settings->ColorDepth = 32;
 	settings->NSCodec = FALSE;
@@ -248,12 +272,15 @@ DWORD WINAPI wf_peer_main_loop(LPVOID lpParam)
 	client->PostConnect = wf_peer_post_connect;
 	client->Activate = wf_peer_activate;
 	client->Logon = wf_peer_logon;
+
+	WINPR_ASSERT(client->context->input);
 	client->context->input->SynchronizeEvent = wf_peer_synchronize_event;
 	client->context->input->KeyboardEvent = wf_peer_keyboard_event;
 	client->context->input->UnicodeKeyboardEvent = wf_peer_unicode_keyboard_event;
 	client->context->input->MouseEvent = wf_peer_mouse_event;
 	client->context->input->ExtendedMouseEvent = wf_peer_extended_mouse_event;
 
+	WINPR_ASSERT(client->Initialize);
 	if (!client->Initialize(client))
 		goto fail_client_initialize;
 
diff --git a/server/Windows/wf_update.c b/server/Windows/wf_update.c
index 831271885..7eab50381 100644
--- a/server/Windows/wf_update.c
+++ b/server/Windows/wf_update.c
@@ -144,7 +144,13 @@ void wf_update_encode(wfInfo* wfi)
 
 void wf_update_peer_send(wfInfo* wfi, wfPeerContext* context)
 {
-	freerdp_peer* client = ((rdpContext*)context)->peer;
+	freerdp_peer* client;
+
+	WINPR_ASSERT(wfi);
+	WINPR_ASSERT(context);
+
+	client = ((rdpContext*)context)->peer;
+	WINPR_ASSERT(client);
 
 	/* This happens when the RemoteFX encoder state is reset */
 
@@ -168,8 +174,13 @@ void wf_update_peer_send(wfInfo* wfi, wfPeerContext* context)
 		         context->frame_idx + 1);
 	}
 
-	wfi->cmd.bmp.codecID = client->settings->RemoteFxCodecId;
-	client->update->SurfaceBits(client->update->context, &wfi->cmd);
+	WINPR_ASSERT(client->context);
+	WINPR_ASSERT(client->context->settings);
+	WINPR_ASSERT(client->context->update);
+	WINPR_ASSERT(client->context->update->SurfaceBits);
+
+	wfi->cmd.bmp.codecID = client->context->settings->RemoteFxCodecId;
+	client->context->update->SurfaceBits(client->context, &wfi->cmd);
 	context->frame_idx++;
 }
 
diff --git a/server/proxy/pf_client.c b/server/proxy/pf_client.c
index 1e5fae805..33ce4b98c 100644
--- a/server/proxy/pf_client.c
+++ b/server/proxy/pf_client.c
@@ -103,12 +103,13 @@ static void pf_client_on_activated(void* ctx, const ActivatedEventArgs* e)
 	WINPR_ASSERT(ps);
 	peer = ps->context.peer;
 	WINPR_ASSERT(peer);
+	WINPR_ASSERT(peer->context);
 
 	PROXY_LOG_INFO(TAG, pc, "client activated, registering server input callbacks");
 
 	/* Register server input/update callbacks only after proxy client is fully activated */
 	pf_server_register_input_callbacks(peer->context->input);
-	pf_server_register_update_callbacks(peer->update);
+	pf_server_register_update_callbacks(peer->context->update);
 }
 
 static BOOL pf_client_load_rdpsnd(pClientContext* pc)
@@ -243,7 +244,7 @@ static BOOL pf_client_pre_connect(freerdp* instance)
 	WINPR_ASSERT(ps->pdata);
 	config = ps->pdata->config;
 	WINPR_ASSERT(config);
-	settings = instance->settings;
+	settings = instance->context->settings;
 	WINPR_ASSERT(settings);
 
 	/*
@@ -319,7 +320,7 @@ static BOOL pf_client_pre_connect(freerdp* instance)
 
 	if (!pf_utils_is_passthrough(config))
 	{
-		if (!freerdp_client_load_addins(instance->context->channels, instance->settings))
+		if (!freerdp_client_load_addins(instance->context->channels, settings))
 		{
 			PROXY_LOG_ERR(TAG, pc, "Failed to load addins");
 			return FALSE;
@@ -619,9 +620,9 @@ static BOOL pf_client_post_connect(freerdp* instance)
 	WINPR_ASSERT(instance);
 	context = instance->context;
 	WINPR_ASSERT(context);
-	settings = instance->settings;
+	settings = context->settings;
 	WINPR_ASSERT(settings);
-	update = instance->update;
+	update = context->update;
 	WINPR_ASSERT(update);
 	pc = (pClientContext*)context;
 	WINPR_ASSERT(pc);
@@ -808,7 +809,7 @@ static BOOL pf_client_connect(freerdp* instance)
 	WINPR_ASSERT(instance);
 	pc = (pClientContext*)instance->context;
 	WINPR_ASSERT(pc);
-	settings = instance->settings;
+	settings = instance->context->settings;
 	WINPR_ASSERT(settings);
 
 	PROXY_LOG_INFO(TAG, pc, "connecting using client info: Username: %s, Domain: %s",
diff --git a/server/proxy/pf_server.c b/server/proxy/pf_server.c
index 7c8734a4e..f6b670bef 100644
--- a/server/proxy/pf_server.c
+++ b/server/proxy/pf_server.c
@@ -229,23 +229,27 @@ static BOOL pf_server_post_connect(freerdp_peer* peer)
 	pClientContext* pc;
 	rdpSettings* client_settings;
 	proxyData* pdata;
+	rdpSettings* settings;
 
 	WINPR_ASSERT(peer);
 
 	ps = (pServerContext*)peer->context;
 	WINPR_ASSERT(ps);
 
+	settings = peer->context->settings;
+	WINPR_ASSERT(settings);
+
 	pdata = ps->pdata;
 	WINPR_ASSERT(pdata);
 
-	PROXY_LOG_INFO(TAG, ps, "Accepted client: %s", peer->settings->ClientHostname);
+	PROXY_LOG_INFO(TAG, ps, "Accepted client: %s", settings->ClientHostname);
 	if (!pf_server_setup_channels(peer))
 	{
 		PROXY_LOG_ERR(TAG, ps, "error setting up channels");
 		return FALSE;
 	}
 
-	pc = pf_context_create_client_context(peer->settings);
+	pc = pf_context_create_client_context(settings);
 	if (pc == NULL)
 	{
 		PROXY_LOG_ERR(TAG, ps, "failed to create client context!");
@@ -295,6 +299,7 @@ static BOOL pf_server_activate(freerdp_peer* peer)
 {
 	pServerContext* ps;
 	proxyData* pdata;
+	rdpSettings* settings;
 
 	WINPR_ASSERT(peer);
 
@@ -304,8 +309,10 @@ static BOOL pf_server_activate(freerdp_peer* peer)
 	pdata = ps->pdata;
 	WINPR_ASSERT(pdata);
 
-	WINPR_ASSERT(peer->settings);
-	peer->settings->CompressionLevel = PACKET_COMPR_TYPE_RDP8;
+	settings = peer->context->settings;
+	WINPR_ASSERT(settings);
+
+	settings->CompressionLevel = PACKET_COMPR_TYPE_RDP8;
 	if (!pf_modules_run_hook(pdata->module, HOOK_TYPE_SERVER_ACTIVATE, pdata, peer))
 		return FALSE;
 
@@ -326,7 +333,6 @@ static BOOL pf_server_logon(freerdp_peer* peer, const SEC_WINNT_AUTH_IDENTITY* i
 
 	pdata = ps->pdata;
 	WINPR_ASSERT(pdata);
-	WINPR_ASSERT(peer->settings);
 	WINPR_ASSERT(identity);
 
 	info.identity = identity;
@@ -440,13 +446,13 @@ static BOOL pf_server_initialize_peer_connection(freerdp_peer* peer)
 
 	WINPR_ASSERT(peer);
 
-	settings = peer->settings;
-	WINPR_ASSERT(settings);
-
 	ps = (pServerContext*)peer->context;
 	if (!ps)
 		return FALSE;
 
+	settings = peer->context->settings;
+	WINPR_ASSERT(settings);
+
 	pdata = proxy_data_new();
 	if (!pdata)
 		return FALSE;
@@ -460,7 +466,9 @@ static BOOL pf_server_initialize_peer_connection(freerdp_peer* peer)
 
 	/* currently not supporting GDI orders */
 	ZeroMemory(settings->OrderSupport, 32);
-	peer->update->autoCalculateBitmapData = FALSE;
+
+	WINPR_ASSERT(peer->context->update);
+	peer->context->update->autoCalculateBitmapData = FALSE;
 
 	settings->SupportMonitorLayoutPdu = TRUE;
 	settings->SupportGraphicsPipeline = config->GFX;
@@ -508,7 +516,7 @@ static BOOL pf_server_initialize_peer_connection(freerdp_peer* peer)
 	peer->Activate = pf_server_activate;
 	peer->Logon = pf_server_logon;
 	peer->AdjustMonitorsLayout = pf_server_adjust_monitor_layout;
-	peer->settings->MultifragMaxRequestSize = 0xFFFFFF; /* FIXME */
+	settings->MultifragMaxRequestSize = 0xFFFFFF; /* FIXME */
 
 	/* virtual channels receive data hook */
 	pdata->server_receive_channel_data_original = peer->ReceiveChannelData;
diff --git a/server/shadow/Win/win_rdp.c b/server/shadow/Win/win_rdp.c
index a6f74f435..f26f511aa 100644
--- a/server/shadow/Win/win_rdp.c
+++ b/server/shadow/Win/win_rdp.c
@@ -128,7 +128,7 @@ static BOOL shw_pre_connect(freerdp* instance)
 	PubSub_SubscribeChannelConnected(context->pubSub, shw_OnChannelConnectedEventHandler);
 	PubSub_SubscribeChannelDisconnected(context->pubSub, shw_OnChannelDisconnectedEventHandler);
 
-	if (!freerdp_client_load_addins(context->channels, instance->settings))
+	if (!freerdp_client_load_addins(context->channels, context->settings))
 		return FALSE;
 
 	return TRUE;
@@ -138,18 +138,28 @@ static BOOL shw_post_connect(freerdp* instance)
 {
 	rdpGdi* gdi;
 	shwContext* shw;
+	rdpUpdate* update;
 	rdpSettings* settings;
+
+	WINPR_ASSERT(instance);
+
 	shw = (shwContext*)instance->context;
-	settings = instance->settings;
+	WINPR_ASSERT(shw);
+
+	update = instance->context->update;
+	WINPR_ASSERT(update);
+
+	settings = instance->context->settings;
+	WINPR_ASSERT(settings);
 
 	if (!gdi_init(instance, PIXEL_FORMAT_BGRX32))
 		return FALSE;
 
 	gdi = instance->context->gdi;
-	instance->update->BeginPaint = shw_begin_paint;
-	instance->update->EndPaint = shw_end_paint;
-	instance->update->DesktopResize = shw_desktop_resize;
-	instance->update->SurfaceFrameMarker = shw_surface_frame_marker;
+	update->BeginPaint = shw_begin_paint;
+	update->EndPaint = shw_end_paint;
+	update->DesktopResize = shw_desktop_resize;
+	update->SurfaceFrameMarker = shw_surface_frame_marker;
 	return TRUE;
 }
 
@@ -263,7 +273,12 @@ static BOOL shw_freerdp_client_new(freerdp* instance, rdpContext* context)
 {
 	shwContext* shw;
 	rdpSettings* settings;
+
+	WINPR_ASSERT(instance);
+	WINPR_ASSERT(context);
+
 	shw = (shwContext*)instance->context;
+	WINPR_ASSERT(shw);
 
 	if (!(shw->StopEvent = CreateEvent(NULL, TRUE, FALSE, NULL)))
 		return FALSE;
@@ -272,8 +287,11 @@ static BOOL shw_freerdp_client_new(freerdp* instance, rdpContext* context)
 	instance->PostConnect = shw_post_connect;
 	instance->Authenticate = shw_authenticate;
 	instance->VerifyX509Certificate = shw_verify_x509_certificate;
-	settings = instance->settings;
-	shw->settings = instance->context->settings;
+
+	settings = context->settings;
+	WINPR_ASSERT(settings);
+
+	shw->settings = settings;
 	settings->AsyncChannels = FALSE;
 	settings->AsyncUpdate = FALSE;
 	settings->IgnoreCertificate = TRUE;
diff --git a/server/shadow/shadow_client.c b/server/shadow/shadow_client.c
index e9cfe8e75..2077e4d41 100644
--- a/server/shadow/shadow_client.c
+++ b/server/shadow/shadow_client.c
@@ -164,6 +164,7 @@ static BOOL shadow_client_context_new(freerdp_peer* peer, rdpContext* context)
 
 	WINPR_ASSERT(client);
 	WINPR_ASSERT(peer);
+	WINPR_ASSERT(peer->context);
 
 	server = (rdpShadowServer*)peer->ContextExtra;
 	WINPR_ASSERT(server);
@@ -176,7 +177,7 @@ static BOOL shadow_client_context_new(freerdp_peer* peer, rdpContext* context)
 	client->subsystem = server->subsystem;
 	WINPR_ASSERT(client->subsystem);
 
-	settings = peer->settings;
+	settings = peer->context->settings;
 	WINPR_ASSERT(settings);
 
 	settings->ColorDepth = srvSettings->ColorDepth;
@@ -396,7 +397,7 @@ static BOOL shadow_client_post_connect(freerdp_peer* peer)
 	client = (rdpShadowClient*)peer->context;
 	WINPR_ASSERT(client);
 
-	settings = peer->settings;
+	settings = peer->context->settings;
 	WINPR_ASSERT(settings);
 
 	server = client->server;
@@ -423,9 +424,11 @@ static BOOL shadow_client_post_connect(freerdp_peer* peer)
 	/* Resize client if necessary */
 	if (shadow_client_recalc_desktop_size(client))
 	{
-		WINPR_ASSERT(peer->update);
-		WINPR_ASSERT(peer->update->DesktopResize);
-		peer->update->DesktopResize(peer->update->context);
+		rdpUpdate* update = peer->context->update;
+		WINPR_ASSERT(update);
+		WINPR_ASSERT(update->DesktopResize);
+
+		update->DesktopResize(update->context);
 		WLog_INFO(TAG, "Client from %s is resized (%" PRIu32 "x%" PRIu32 "@%" PRIu32 ")",
 		          peer->hostname, settings->DesktopWidth, settings->DesktopHeight,
 		          settings->ColorDepth);
@@ -579,12 +582,12 @@ static BOOL shadow_client_activate(freerdp_peer* peer)
 
 	WINPR_ASSERT(peer);
 
-	settings = peer->settings;
-	WINPR_ASSERT(settings);
-
 	client = (rdpShadowClient*)peer->context;
 	WINPR_ASSERT(client);
 
+	settings = peer->context->settings;
+	WINPR_ASSERT(settings);
+
 	client->activated = TRUE;
 	client->inLobby = client->mayView ? FALSE : TRUE;
 
@@ -611,7 +614,9 @@ static BOOL shadow_client_logon(freerdp_peer* peer, const SEC_WINNT_AUTH_IDENTIT
 	WINPR_ASSERT(peer);
 	WINPR_ASSERT(identity);
 
-	settings = peer->settings;
+	WINPR_ASSERT(peer->context);
+
+	settings = peer->context->settings;
 	WINPR_ASSERT(settings);
 
 	if (identity->Flags & SEC_WINNT_AUTH_IDENTITY_UNICODE)
@@ -1870,9 +1875,10 @@ static BOOL shadow_client_send_resize(rdpShadowClient* client, SHADOW_GFX_STATUS
 	}
 
 	/* Send Resize */
-	WINPR_ASSERT(peer->update);
-	WINPR_ASSERT(peer->update->DesktopResize);
-	if (!peer->update->DesktopResize(peer->update->context))
+	WINPR_ASSERT(peer->context);
+	WINPR_ASSERT(peer->context->update);
+	WINPR_ASSERT(peer->context->update->DesktopResize);
+	if (!peer->context->update->DesktopResize(peer->context->update->context))
 	{
 		WLog_ERR(TAG, "DesktopResize failed");
 		return FALSE;
@@ -2057,6 +2063,7 @@ static DWORD WINAPI shadow_client_thread(LPVOID arg)
 	wMessageQueue* MsgQueue;
 	/* This should only be visited in client thread */
 	SHADOW_GFX_STATUS gfxstatus = { 0 };
+	rdpUpdate* update;
 
 	WINPR_ASSERT(client);
 
@@ -2071,7 +2078,7 @@ static DWORD WINAPI shadow_client_thread(LPVOID arg)
 	WINPR_ASSERT(peer);
 	WINPR_ASSERT(peer->context);
 
-	settings = peer->settings;
+	settings = peer->context->settings;
 	WINPR_ASSERT(settings);
 
 	peer->Capabilities = shadow_client_capabilities;
@@ -2083,10 +2090,12 @@ static DWORD WINAPI shadow_client_thread(LPVOID arg)
 	rc = peer->Initialize(peer);
 	WINPR_ASSERT(rc);
 
-	WINPR_ASSERT(peer->update);
-	peer->update->RefreshRect = shadow_client_refresh_rect;
-	peer->update->SuppressOutput = shadow_client_suppress_output;
-	peer->update->SurfaceFrameAcknowledge = shadow_client_surface_frame_acknowledge;
+	update = peer->context->update;
+	WINPR_ASSERT(update);
+
+	update->RefreshRect = shadow_client_refresh_rect;
+	update->SuppressOutput = shadow_client_suppress_output;
+	update->SurfaceFrameAcknowledge = shadow_client_surface_frame_acknowledge;
 
 	if ((!client->vcm) || (!subsystem->updateEvent))
 		goto out;
@@ -2387,10 +2396,8 @@ BOOL shadow_client_accepted(freerdp_listener* listener, freerdp_peer* peer)
 	peer->ContextSize = sizeof(rdpShadowClient);
 	peer->ContextNew = shadow_client_context_new;
 	peer->ContextFree = shadow_client_context_free;
-	peer->settings = freerdp_settings_clone(server->settings);
-	WINPR_ASSERT(peer->settings);
 
-	if (!freerdp_peer_context_new(peer))
+	if (!freerdp_peer_context_new_ex(peer, server->settings))
 		return FALSE;
 
 	client = (rdpShadowClient*)peer->context;