Step-by-Step Guide: How to Set Up Network Level Authentication

What is Network Level Authentication? Learn how NLA works, why it matters for remote desktop security, and follow simple steps to set it up without compromising access or increasing risk.

Remote access is convenient—until it becomes a security concern. If you're responsible for connecting to machines over a network, even a small misstep can open the door to unwanted risks.

So, how do you protect remote desktop connections without making access a hassle?

That’s where Network Level Authentication (NLA) comes in.

But how does it work? And more importantly, how to set up network-level authentication?

This blog breaks it all down. From what NLA does behind the scenes to setting it up correctly, you'll get clear steps and helpful context to make your remote connections safer.

What is Network Level Authentication (NLA)?

Before jumping into configuration steps, it helps to know what network-level authentication does.

Network Level Authentication is a security feature for the Remote Desktop Protocol that requires the user's credentials to be authenticated before establishing a remote session. In simple terms, it performs front authentication — meaning only authorized users get a session with the remote computer.

Without NLA, anyone can connect to the remote desktop login screen — even unauthorized users, making brute force attacks easier.

With NLA enabled, this risk reduces significantly.

Why Use NLA for Remote Desktop?

Here’s why network-level authentication is worth enabling on computers running remote desktop:

This feature is especially useful in environments where remote access is frequent — think of remote desktop services, managing remote devices, or handling sensitive files.

Pre-Checklist: Requirements to Support NLA

To support NLA on both ends, you need:

• Windows Vista or later (client and server)

• RDP client version 6.0 or higher

• Both client and remote computer must support Credential Security Support Provider (CredSSP)

• Valid user account with administrative privileges

• Remote desktop feature enabled

Let’s break down the actual steps.

Step-by-Step Guide: Enable Network Level Authentication (NLA)

There are different ways to enable NLA. You can use the Control Panel, System Properties, or Registry Editor depending on your needs.

Method 1: Using System Properties (Most Common)

This is the easiest method for enabling network-level authentication on Windows machines.

1. Right-click This PC and select Properties

2. Click Remote settings on the left pane

3. In the System Properties window, go to the Remote tab

4. Under Remote Desktop, select:

Allow connections only from computers running Remote Desktop with Network Level Authentication

5. Click Apply and OK

That’s it — NLA is now enabled on your remote computer.

This is usually enough for most admins working with remote desktop access or standard remote connections.

Method 2: Via Registry Editor

Use this if you’re automating or managing multiple systems.

Warning: Changing the registry can cause problems if not done carefully.

1. Open Registry Editor (regedit)

2. Navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

3. Locate the key: UserAuthentication

4. Set its value to 1 to enable NLA

5. Restart the system or the Remote Desktop Services

This enforces level authentication during remote desktop logins. Registry edits can be deployed via scripts for manual configuration across multiple machines.

Method 3: Using Group Policy

Perfect for domain environments.

1. Run gpedit.msc

2. Navigate to:

Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security

3. Double-click Require user authentication for remote connections by using Network Level Authentication

4. Set to Enabled

5. Click Apply

This forces all RDP sessions to require network-level authentication. Ideal for enterprises managing remote work or multiple remote computers.

What if You Need to Disable NLA?

There are legitimate reasons to disable network-level authentication, such as working with legacy systems that don’t support NLA or troubleshooting certain remote desktop protocol issues.

Here’s how to disable NLA safely:

Option A – System Properties

Follow the same steps as enabling, but this time, choose:

Allow connections from computers running any version of Remote Desktop

Option B – Registry Editor

Change UserAuthentication value to 0.

Option C – Safe Mode/Recovery Console

If you're locked out of the remote desktop, boot into Safe Mode and edit the registry to disable NLA.

But be aware: disable NLA only when necessary. It lowers the security feature level and increases security risks.

NLA, CredSSP, and Security Risks

Network Level Authentication (NLA) uses Credential Security Support Provider (CredSSP) to verify user credentials before the remote session begins.

Here’s how each part contributes to security:

• CredSSP (Credential Security Support Provider):

  ◦ Acts as a secure bridge for credential delegation.

  ◦ Allows users to send login details to the remote host safely.

  ◦ Helps prevent credential interception.

• Early Authentication:

  ◦ Takes place before loading the full desktop.

  ◦ Reduces exposure to brute force login attempts.

• Trust Establishment:

  ◦ Builds a secure channel between client and server.

  ◦ Blocks access from unknown or compromised systems.

• Reduced Attack Surface:

  ◦ No login screen is exposed until the user is verified.

  ◦ Protects against common RDP vulnerabilities.

• Security Risks to Watch For:

  ◦ Outdated CredSSP can allow man-in-the-middle attacks.

  ◦ Misconfigured group policies or registry edits might unintentionally weaken protections.

  ◦ Older Windows versions may not support updated protocols.

Keep your Windows components updated, monitor remote desktop settings, and avoid unnecessary tweaks in the registry or policies. When properly set up, NLA adds an extra layer of protection to your remote access.

How NLA Works

Here's a simple visual flow showing how NLA secures a remote desktop session:

This extra layer of security ensures the remote device is only accessible by authenticated users.

As described by Shlomi Boutnaru, Ph.D., in a recent Medium post, “NLA adds an extra layer of protection by validating the user’s credentials before creating the remote desktop connection”

View complete post on Medium

Common Errors When Enabling NLA

• "The remote computer requires network level authentication" — Your client OS doesn’t support NLA

• "An authentication error has occurred" — Check CredSSP settings

• Can't connect — Try disabling temporarily to test, then re-enable securely

Tips for Managing NLA and Remote Access

When managing network-level authentication across a group of machines, it helps to follow reliable and consistent practices. These not only improve security but also streamline remote desktop usage.

• Use strong access controls: Access controls limit remote desktop sessions to authorized users only. This reduces exposure to unauthorized users and protects sensitive systems from potential threats.

• Restrict remote desktop services: Only enable remote desktop services for users who genuinely need it. Disabling unnecessary access points simplifies system management and helps reduce vulnerabilities.

• Monitor failed login attempts: Keeping an eye on login activity allows you to detect brute force attacks. Configure account lockout policies to temporarily block access after multiple failed attempts.

• Use VPN for remote access: VPNs provide an encrypted connection and an extra layer of protection. They prevent attackers from intercepting communication during remote sessions.

• Keep systems updated: Always update Windows servers and clients. Regular updates include security patches for CredSSP and other components that help maintain a secure authentication process.

Combining these actions with network-level authentication strengthens your remote desktop environment and lowers the risk of breaches or misuse.

Why Securing Remote Access Starts with the Right Setup

Learning how to setup network level authentication adds a strong first layer of defense to your remote desktop connection. It reduces exposure to threats and maintains tighter access from the start.

With NLA in place, only verified users reach the sign-in screen. This small step builds a safer environment for both users and systems.

Take control early. Set the rules before the connection begins.