Network Level Authentication (NLA)

What NLA changes

Pre-NLA RDP handed out real session resources to every connection attempt, authenticated or not, which was both a denial-of-service problem and an attack-surface problem at the same time. NLA moves authentication down to the network layer instead. The CredSSP exchange completes inside a TLS channel before any session gets created, so a failed logon costs the server almost nothing and the graphical logon screen never shows itself to a stranger. NLA can mitigate vulnerabilities that require an unauthenticated RDP session, although it is not a substitute for patching.

NLA and CredSSP

NLA is the policy; CredSSP is the machinery. The client collects credentials locally, CredSSP authenticates and delegates them over TLS, and only a successful outcome triggers session setup. This coupling is why CredSSP patch mismatches (the encryption-oracle error) surface as NLA connection failures.

NLA's limits

NLA provides Windows credential authentication; it is not, by itself, a substitute for MFA. It will not stop an attacker who already has a valid password, will not hide the listener from a scanner, and will not limit what an authenticated user can reach once inside. It is table stakes, enabled by default on modern Windows, and it should stay enforced everywhere without exception. Everything it does not cover, meaning MFA, exposure, and least privilege, is the rest of RDP security →