Network Level Authentication (NLA) makes a Remote Desktop client authenticate before a full RDP session is created. Without NLA, the server starts a login screen (and spends resources) for anyone who connects, which helps attackers and exposes the server to some pre-authentication vulnerabilities. With NLA, unauthenticated connections are rejected early.

Why keep NLA on

  • Security: blocks unauthenticated users from reaching the Windows logon screen. Several serious RDP vulnerabilities (such as BlueKeep) were only exploitable without NLA.
  • Resources: brute-force bots can’t make the server create full sessions.
  • Compatibility: every modern RDP client (Windows 7+, macOS Windows App, iOS, Android, FreeRDP) supports it.

Check and enable NLA

GUI: System Properties (SystemPropertiesRemote.exe) → Remote tab → “Allow connections only from computers running Remote Desktop with Network Level Authentication”.

PowerShell:

# 1 = NLA required, 0 = not required
(Get-CimInstance -Namespace root\cimv2\TerminalServices -ClassName Win32_TSGeneralSetting -Filter "TerminalName='RDP-Tcp'").UserAuthenticationRequired

Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 1

Or Group Policy: Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Security → Require user authentication for remote connections by using Network Level Authentication → Enabled.

“The remote computer requires Network Level Authentication, which your computer does not support” Old client. Update the RDP client (or the operating system), or use a current client on macOS, iOS or Android. See RDP from a Mac and RDP from Android and iOS.

“An authentication error has occurred. The function requested is not supported” / “This could be due to CredSSP encryption oracle remediation” The client and server have mismatched CredSSP security updates. Install Windows updates on both sides. Avoid lowering the “Encryption Oracle Remediation” policy to “Vulnerable”, except as a short-lived emergency workaround.

“The user account has expired / You must change your password before logging on” NLA can’t show the password-change dialog. Change the password another way: the VNC console in your VPS control panel, or via another admin session. See VPS VNC console.

“The Local Security Authority cannot be contacted” Often an expired password with NLA, or a time or DNS problem on domain-joined servers. Check the server clock. See Windows Server time sync.

Microsoft account or Azure AD / Entra ID users can’t log in Use the correct username format (MicrosoftAccount\[email protected] or AzureAD\[email protected]), or create a local account.

Test from the client side

If only one computer fails, the problem is usually that client: outdated RDP software, saved credentials with an old password, or a corporate policy forcing an older protocol. Delete the saved credentials in the client, update it, and try again from another device to narrow it down. If every client fails, look at the server: the account status, its password, the Security event log (event 4625 shows the failure reason), and pending updates.

Locked out by NLA?

If you can’t authenticate over RDP at all, use the VNC console from your control panel to log in locally, then fix the password, account, or policy. Disable NLA only temporarily, if you must, and re-enable it afterwards.

NLA is one layer

Combine it with:

Quick reference

Task How
Check NLA Win32_TSGeneralSetting.UserAuthenticationRequired
Enable Registry UserAuthentication = 1, or System Properties
CredSSP error Update client and server
Password expired Change via VNC console
Locked out VNC console, local login

Related: RDP connection errors and Windows VPS.

  • RDP
  • Windows Server
  • Security