How to Enable Network Level Authentication for RDP

What NLA does

• It checks the user first. NLA completes user authentication before the Remote Desktop connection is set up and before the logon screen appears.
• It spends less before it knows who you are. The remote machine uses a limited set of resources until the user is authenticated, which Microsoft says helps reduce the risk of denial-of-service attacks.
• It needs a modern client. The client must support the Credential Security Support Provider (CredSSP) protocol and RDP version 6.0 or later.

Step 1: Check whether NLA is on

The setting lives in the registry value UserAuthentication on the RDP listener. 1 means NLA is required; 0 means it is not.

Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication

The Remote Desktop WMI provider gives the same answer, and also tells you where the setting came from. Run it from an elevated PowerShell window:

Get-CimInstance -Namespace root\cimv2\TerminalServices -ClassName Win32_TSGeneralSetting -Filter "TerminalName='RDP-Tcp'" |
  Select-Object TerminalName, UserAuthenticationRequired, PolicySourceUserAuthenticationRequired, MinEncryptionLevel

Step 2: Check your clients first

Once NLA is required, only clients that support RDP 6.0 or later can connect. Microsoft recommends getting those clients in place before you switch the setting on. To check a Windows client, open Remote Desktop Connection, click the icon in the top-left corner of the window, choose About, and look for the words "Network Level Authentication supported".

Step 3: Turn it on for one machine

In the GUI, open System Properties and go to the Remote tab. Under Remote Desktop, choose the option that allows connections only from computers running Remote Desktop with Network Level Authentication.

In PowerShell, call the documented WMI method. A return value of 0 means it worked:

Get-CimInstance -Namespace root\cimv2\TerminalServices -ClassName Win32_TSGeneralSetting -Filter "TerminalName='RDP-Tcp'" |
  Invoke-CimMethod -MethodName SetUserAuthenticationRequired -Arguments @{ UserAuthenticationRequired = 1 }

Or set the registry value directly:

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 1

Step 4: Turn it on across the domain with Group Policy

Edit a GPO linked to the machines you want and enable this setting:

Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security
  Require user authentication for remote connections by using Network Level Authentication

The Group Policy setting takes precedence over the Remote tab, so once it applies, the NLA option in System Properties is greyed out. Run gpupdate /force on a test machine, re-run the Step 1 check, then roll out to a small group before the whole domain.

Step 5: Set the RDP encryption level

The encryption level sits next to NLA in the same policy folder:

Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security
  Set client connection encryption level

On the machine, the active level shows up as MinEncryptionLevel, both in the WMI query from Step 1 and in the RDP-Tcp registry key:

Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name MinEncryptionLevel

Errors you may see after enabling NLA

• Older clients are refused. Any client that does not support RDP 6.0 or CredSSP cannot connect. Update the client rather than switching NLA off. Microsoft suggests turning NLA off only temporarily if you have to connect from such a device, and keeping it on whenever possible.
• "This could be due to CredSSP encryption oracle remediation." NLA relies on CredSSP. This error appears when one side has the CredSSP updates for CVE-2018-0886 and the other does not, and policy blocks the insecure connection. Microsoft’s fix is to install the CredSSP updates on both client and server. Its workaround, setting Encryption Oracle Remediation to Vulnerable, exposes the server to attack, so do not leave it in place.
• The NLA checkbox is greyed out. A Group Policy setting is in force. Change it in the GPO, not on the machine.

How Sentrivox checks this

Each time it scans, the Sentrivox agent reads two values under HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp on every Windows endpoint:

• UserAuthentication. A value of 1 passes. Any other value, or a missing value, is reported as a High severity finding.
• MinEncryptionLevel. A value of 2 or higher passes. A value of 1, or a missing value, is reported as a Medium severity finding, with a suggested fix of 3 (High).

The check reads these two registry values directly. It does not read the Group Policy key or query WMI, so if you set NLA by Group Policy, run the Step 1 commands on one machine to confirm what it reports.