Configure RDP Network Level Authentication via Regedit

Configuring Network Level Authentication (NLA) for Remote Desktop Protocol (RDP) via the Windows Registry allows administrators to enforce or disable pre-authentication security requirements locally or remotely without using the standard graphical interface. This guide outlines the exact registry keys, values, and steps needed to toggle NLA by modifying the Windows Registry Editor (regedit.exe).

Required Registry Path and Values

To manage NLA settings, navigate to the following registry path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

Within this key, two specific DWORD (32-bit) values dictate the NLA and security layer behavior:

  1. UserAuthentication
    • 1 = Enabled (Network Level Authentication is required).
    • 0 = Disabled (Network Level Authentication is not required).
  2. SecurityLayer
    • 0 = Low (RDP encryption).
    • 1 = Negotiate (Uses TLS if supported).
    • 2 = High (SSL/TLS required; standard when NLA is enabled).

Step-by-Step Configuration via Registry Editor

  1. Press Win + R, type regedit, and press Enter to open the Registry Editor.

  2. Navigate to:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

  3. Locate the UserAuthentication value in the right pane:

    • Double-click UserAuthentication, set the Value data to 1 to enable NLA, or 0 to disable NLA, and select Hexadecimal or Decimal (both work for 0 and 1). Click OK.

  4. Locate the SecurityLayer value:

    • To fully enforce NLA, set SecurityLayer to 1 or 2.
    • If disabling NLA to troubleshoot legacy clients, set SecurityLayer to 0 or 1.

  5. Close the Registry Editor.

Applying the Changes

Registry changes to the RDP configuration take effect immediately after restarting the Remote Desktop service or rebooting the machine.

To restart the service via an elevated Command Prompt:

net stop TermService /y
net start TermService

Alternatively, you can apply these registry values directly from an elevated Command Prompt using the reg add command: