How to Enable Network Level Authentication (NLA) on an RDP Client

Remote Desktop Protocol (RDP) is a powerful feature in Microsoft Windows that allows users to connect to another computer over a network connection. While it's highly convenient for IT administrators and remote workers, it can expose systems to security risks if not properly secured. One of the key security features introduced in modern Windows operating systems is Network Level Authentication (NLA).

This article will guide you through what NLA is, why it matters, and how to enable it on your RDP client step by step.

What is Network Level Authentication (NLA)?

Network Level Authentication is a security feature introduced in Remote Desktop Protocol 6.0 and above. The connecting user must authenticate before a full RDP session is established. Traditionally, RDP connections allowed a session to start before the system requested login credentials. This exposed the host system to unnecessary risk, such as denial-of-service or brute-force attacks.

With NLA, the Remote Desktop Session Host (RDSH) requires that the connecting client provide valid user credentials before it will create a session. This approach enhances security by:

• Reducing the resources used on unauthenticated connection attempts.

• Protecting the server from unauthenticated users.

• Integrating with Windows' Credential Security Support Provider (CredSSP) for better encryption and credential management.

Prerequisites for Enabling NLA

Before you can enable NLA on your RDP client or server, you need to ensure the following conditions are met:

1. Both client and host machines must be running Windows Vista or later.

2. The system must be joined to a domain (optional, but some group policies require it).

3. The user account used for connection must be part of the Remote Desktop Users group on the host system.

4. Remote Desktop must be enabled on the host machine.

5. Both systems must support and have CredSSP enabled.

Enabling NLA on the RDP Server (Host Side)

Although the focus of this article is enabling NLA on the client side, enabling it on the host machine is usually the first step. Here’s how to do it:

Through System Settings

1. Right-click on “This PC” or “Computer” on your desktop or in File Explorer, and select “Properties.”

2. Click on “Remote settings” on the left panel.

3. In the “System Properties” window, under the “Remote” tab, look for the “Remote Desktop” section.

4. Choose the option:

   “Allow connections only from computers running Remote Desktop with Network Level Authentication (recommended).”

5. Click Apply and then OK.

Via Group Policy

If you're managing multiple machines in a domain:

1. Open the Group Policy Management Console (GPMC).

2. Navigate to:

   pgsql
   Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security
   

3. Find and enable the setting:

   “Require user authentication for remote connections by using Network Level Authentication.”

After applying these changes, use the gpupdate /force command in the command line to update the Group Policy.

Enabling NLA on the RDP Client (Client Side)

Method 1: Using the Remote Desktop Connection App (mstsc)

1. Press Windows + R, type mstsc, and press Enter.

2. In the Remote Desktop Connection window, click on Show Options.

3. Switch to the Advanced tab.

4. Under Server authentication, ensure that the option:

   “If server authentication fails” is set to “Warn me” or “Do not connect.”

5. Click Connect, enter your credentials when prompted.

Note: The client will automatically attempt to use NLA if the host requires it and both systems support it.

Method 2: Modifying the RDP File Manually

If you are using a saved .rdp file to connect, you can manually enable NLA by editing the file in a text editor:

1. Locate your .rdp file.

2. Right-click and choose Edit with Notepad or any text editor.

3. Add or modify the following line:

   makefile
   enablecredsspsupport:i:1
   

   • This ensures that CredSSP is used for authentication.

4. Optionally, you can enforce authentication level:

   less
   authentication level:i:2
   

   • 0 = No authentication

   • 1 = Optional

   • 2 = Required (NLA enforced)

Save the file and double-click it to initiate the connection.

Method 3: Group Policy on the Client Side

For enterprise environments where NLA should be enforced from the client side as well, you can use Group Policy:

1. Open the Group Policy Editor (gpedit.msc).

2. Navigate to:

   pgsql
   Computer Configuration > Administrative Templates > System > Credentials Delegation
   

3. Enable the setting:

   “Allow delegating default credentials with NTLM-only server authentication”

4. Click Show, then enter the value:

   TERMSRV/*
   

5. Repeat for:

   “Allow delegating saved credentials”

Use gpupdate /force to apply the changes.

Troubleshooting NLA Issues

Enabling NLA can sometimes result in connection issues. Here are some common problems and solutions:

Error: “The remote computer requires Network Level Authentication…”

Cause: The host requires NLA, but the client doesn't support it or NLA is disabled.

Fix: Ensure the client is running Windows Vista or later and that enablecredsspsupport:i:1 is set in the RDP file.

Error: “An authentication error has occurred…”

Cause: CredSSP updates missing on either host or client.

Fix: Apply the latest Windows Updates. Microsoft released patches for known CredSSP vulnerabilities.

Credential Prompt Not Appearing

Cause: Local policy may block automatic credential prompting.

Fix: Enable the policy:

pgsql
User Configuration > Administrative Templates > Windows Components > Credential User Interface

Enable: “Do not display last username” and other related settings.

Final Thoughts

Enabling Network Level Authentication for RDP clients is a best practice for securing remote desktop sessions. It adds an extra layer of authentication that helps prevent unauthorized access and protects system resources from being consumed by malicious users.

For individual users, simply ensuring their system is updated and enabling the proper options in the RDP client is sufficient. For system administrators in enterprise environments, Group Policy is the ideal tool to enforce NLA across multiple machines consistently.

By configuring NLA properly on both server and client sides, you create a more secure and resilient remote access environment—an increasingly important priority in today's hybrid and remote work landscape.