Require devices to use Network Level Authentication to connect
A DWORD value of `1` requires Network Level Authentication (NLA) for incoming connections through the RDP-Tcp listener.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\UserAuthentication
A DWORD value of 1 requires Network Level Authentication (NLA) for incoming connections through the RDP-Tcp listener. Users must therefore authenticate before Windows establishes the full Remote Desktop connection or remote session.
This setting does not enable Remote Desktop or grant any account permission to sign in. Remote Desktop access must be allowed separately, and the account must still have the user rights and permissions required to sign in through Remote Desktop Services.
Notes
Security
NLA moves user authentication to an earlier stage of the connection process. Windows does not need to create a full Remote Desktop session for a user who has not yet been authenticated. This reduces the RDP service's exposure and the resources consumed by unauthenticated connection attempts. Microsoft also identifies improved protection against malicious users or software and a reduced risk of denial-of-service attacks.
NLA does not replace authorization checks or other Remote Desktop protections. After authentication, the account remains subject to its user rights, group memberships, and resource permissions.
Possible side effects
RDP clients that do not support Network Level Authentication cannot connect. Problems with account, domain, or authentication configuration can also cause the connection to fail during pre-session authentication, before an interactive Remote Desktop session is displayed.
Notes
This value is a local setting for the RDP-Tcp listener. It is distinct from the registry value used by the similarly named Administrative Templates policy Require user authentication for remote connections by using Network Level Authentication. Microsoft documents that policy under HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\UserAuthentication. An effective administrative policy can govern the requirement instead of the local setting.
Microsoft documentation
Microsoft Learn: UserAuthentication
Microsoft Learn: Enable Remote Desktop on your PC
Microsoft Learn: Policy CSP – ADMX_TerminalServer