Network Level Authentication: what it is and how to turn it on or off

• Nobody gets a remote session, or even the sign-in screen, without a valid user name and password.
• The PC does less work for connections that never sign in, so floods of attempts cost it less.
• Microsoft lists NLA as a partial protection against some serious Remote Desktop flaws, because an attacker has to sign in first.

NLA doesn't make a weak password strong, and it doesn't make it safe to open Remote Desktop to the whole internet. The RDP port 3389 guide covers what to do instead.

Do this on the PC you connect to, signed in as an administrator.

1. 1

   Step 1: Open the Remote Desktop settings

   On Windows 11, open Settings, System, Remote Desktop, and click the arrow next to the Remote Desktop switch. On Windows 10, open Settings, System, Remote Desktop, Advanced settings.

2. 2

   Step 2: Tick or untick the NLA box

   The box is Require devices to use Network Level Authentication to connect (on Windows 10, "computers" instead of "devices"). Ticked is on. Confirm if Windows asks.

3. 3

   Step 3: Or use System Properties

   Press Win+R, type SystemPropertiesRemote and press Enter. On the Remote tab, with Allow remote connections to this computer selected, tick Allow connections only from computers running Remote Desktop with Network Level Authentication.

4. 4

   Step 4: Connect again

   The change applies to new connections straight away; no restart needed.

With PowerShell

Run as administrator: 1 turns NLA on, 0 turns it off.

Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 1

You can do this on another PC with remote PowerShell. On work PCs, Group Policy can enforce it: Computer Configuration, Administrative Templates, Windows Components, Remote Desktop Services, Remote Desktop Session Host, Security, Require user authentication for remote connections by using Network Level Authentication. When a policy sets it, the box in Settings is grayed out.

"The remote computer requires Network Level Authentication, which your computer does not support"

The PC you connect from is running a very old Remote Desktop client. Install Windows updates on it. Turning NLA off on the remote PC also works, but leaves it less protected.

"You must change your password" or "Your credentials did not work"

• With NLA, an expired password can't be changed during the connection. Sign in at the PC once and change it there, or turn NLA off just long enough to change it.
• If the PC signs in with a Microsoft account, use the account's email address and its password, not the Windows Hello PIN.
• If Windows is set to allow only Windows Hello sign-in for Microsoft accounts (Settings, Accounts, Sign-in options), Remote Desktop can't use the password. Turn that option off.
• Check the account is allowed: Administrators can connect; other accounts need adding under Remote Desktop users.

"An authentication error has occurred" mentioning CredSSP

One of the two PCs is missing security updates that the other requires. Update both PCs; don't relax the security policy to get around it.

"Remote access to the server is not enabled"

This is the start of a longer message that also lists "the remote computer is turned off" and "not available on the network". It isn't about NLA: it means the connection never reached Remote Desktop. Check that Remote Desktop is turned on (how to enable Remote Desktop), that the PC is awake and on the same network, and that the firewall allows port 3389. The full checklist is in Remote Desktop not working.

RemoteAccessApp doesn't use Remote Desktop's sign-in. A small app on the PC connects out to our relay, so there's no port to open, it works on Windows Home and Linux, and the PC asks before anyone connects unless you switched on unattended access at that PC. To keep using Remote Desktop for a PC on your network, save it in the app and connect through another of your PCs; NLA keeps working as usual on the PC you reach. More in remote desktop without port forwarding.