Enforce Remote Desktop NLA via Regedit

Network Level Authentication (NLA) is an essential security layer for the Windows Remote Desktop Protocol (RDP) that requires connecting users to authenticate with the network before a full session is established. This article provides a direct guide for system administrators to configure and enforce NLA on a local Windows machine using the Windows Registry Editor (Regedit), thereby mitigating unauthorized access attempts and denial-of-service risks.

Prerequisites

Administrative privileges on the target Windows machine.
Standard caution when modifying the registry; creating a backup or a system restore point prior to editing is recommended.

Step-by-Step Registry Configuration

Open the Registry Editor
- Press Windows Key + R to open the Run dialog.
- Type regedit and press Enter (or click OK).
- Confirm the User Account Control (UAC) prompt if prompted.
Navigate to the RDP Configuration Key
- In the Registry Editor address bar, paste or navigate to the following path:
```
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
```
Modify the UserAuthentication Value
- Locate the DWORD (32-bit) value named UserAuthentication in the right-hand pane.
- If the key does not exist:
  - Right-click an empty area in the right pane.
  - Select New > DWORD (32-bit) Value.
  - Name it UserAuthentication.
- Double-click UserAuthentication.
- Set the Value data to 1.
- Ensure the Base is set to Hexadecimal (or Decimal).
- Click OK.
Verify RDP Connectivity (Optional but Recommended)
- Navigate to the parent key:
```
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
```
- Locate the value fDenyTSConnections.
- Ensure its value is set to 0 to allow incoming RDP connections. Setting this to 1 disables Remote Desktop entirely.
Apply the Changes
- Close the Registry Editor.
- The policy takes effect immediately for new RDP connection requests. A system restart or restarting the Remote Desktop Services (TermService) via the Services management console (services.msc) will guarantee all active sessions and listeners re-initialize under the new security policy.