RDP NLA enabled but not working

[Sheridan]

We've had NLA enforced via GPO for some time (and before my time here as well) and it seems to work, showing as on in the client rdp settings  and in the registry as:

 

HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\UserAuthentication=1

 

However, a recent security audit has flagged this up as not working, and allowing access to the rdp session without NLA (still need to login though) but its highlighted a possible issue

 

How are you enforcing NLA, is it just via the GPO setting or is there more to it? We've only set this via GPO but its obviously not working 100% as it should

[Koldov]

Personally I would ask for a far more detailed explanation of what they found, before I start trying to mess around with any settings.

 

NLA enforced by GPO or whatever is fine, but from my research "NLA is available on Windows operating systems starting from Windows Vista and Windows Server 2008" and "Remote Desktop Protocol (RDP) 6.0" and "Network Level Authentication (NLA) is typically enabled by default on Windows Server 2012 and later, as well as newer versions of Windows 10 and Windows 11 for Remote Desktop connections".

 

I started when we had Server 2008 (and maybe one old 2003), but they were both upgraded to 2012R2 not long after I started. I don't know what RDP sessions used to look like (so I don't know what they looked like before NLA), but I have always had to authenticate with username and password before the connection is established and I thought that was the point of NLA. On my network opening an RDP session brings up a dialogue/prompt where I select the computer and enter credentials, possibly before NLA you would connect to the computer desktop and then enter credentials.

 

Before this I guess you established a connection to the desktop and then typed in a username and password, this is what I thought NLA stopped, so when you say "allowing access to the rdp session without NLA (still need to login though)" what do you mean exactly...?

 

Somehow (and I don't know now) I just checked my two physical hosts and both of them do NOT have the tick in 'Settings > System > Remote Desktop > Advanced Settings > Require computers to use NLA... and neither have the Registry entry (or they do but it is 0)... and yet both require me to sign on with credentials. The trouble is without being more specific about why they believe NLA is not working and how they proved it, you can't test. I only have 1 RD enabled user in my network and only 1 IP that is allowed to connect to anything, so it's difficult to test.

 

You can try this...

 

https://digi.ninja/blog/rdp_show_login_page.php

 

EDIT: Also, where is your GPO? As I noticed my hosts (apparently) didn't have NLA enabled, I've created one at the root of my Domain as I guess every computer and server should have it.

Edited June 6, 2025 by Koldov

[Sheridan]

Done a bit more poking with this and received a lot more detail from the scanning team - it does appear their results show NLA was not enabled across a lot of PCs

 

However I've set up my own test (to replicate theirs almost exactly) and it shows failures as NLA is enabled - even the ones that were failing initially. I've tested this with a linux laptop and rdesktop and also nmap to scan the settings.

 

The GPO was set by my predecessor at the domain level (well - not quite but covers all PCs and laptops!) and doesn't seem to be overidden anywhere or by another policy. Its the sort of policy setting I've had enabled since way back in previous jobs as well

 

So it seems now NLA is enforced but wasn't a few weeks ago when this scan was done. The only thing I can think of is somehow this GPO wasn't applying, or an update flipped the setting and it was flipped back again - I'm grasping here as the scan results are detailed and its been a useful test

 

Looking on the bright side it did find an issue, even if that issue has self corrected somehow!