Require Network Level Authentication for Remote Desktop

Set UserAuthentication to 1 so RDP clients must authenticate before a session is created.

Windowshardeningsecurityremote-desktopMedium risk

Run `reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 1 /f` as administrator to force NLA for Remote Desktop.

01Command

Command

$ reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 1 /f

02What it does

With Network Level Authentication (NLA), a remote user must prove their identity before the full Windows login screen is ever exposed — it blocks many automated brute-force and pre-auth attacks against RDP. The UserAuthentication value under RDP-Tcp controls this: 1 requires NLA, 0 allows unauthenticated clients. Modern Windows clients all support NLA, so enabling it rarely causes connection problems.

03Risk

RiskMedium risk

RequirementsAdministrator terminal required. Clients must support NLA (all modern Windows versions do).

!Warning: Very old clients (Windows XP pre-SP3, some thin clients and third-party RDP apps) cannot connect once NLA is required — test your devices after changing it.

04Undo

Undo

$ reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f

05Sources

Allow access to your PC from outside your app's network
Microsoft Learn · vendor-doc · 2026-09-17
Evidence: Covers securing Remote Desktop connections and Network Level Authentication for RDP hosts.
Reg - Read and edit the registry
SS64 · technical · 2026-09-17
Evidence: reg add syntax for setting the UserAuthentication value under the RDP-Tcp key.

Last verified: 2026-09-18 · Category: Security & Privacy

06Related solutions

Fix 'scripts is disabled on this system' with Set-ExecutionPolicy

WindowsTerminaldevelopersecurity

Understand PowerShell's execution policy scopes and set the one that lets you run your own local scripts without gutting the security model.

Medium risk ✓ 2026-09-17

Take ownership of a file or folder with takeown and icacls

WindowsFilessystemsecurity

Two-step command sequence that makes you the owner of a locked file tree and grants yourself full control — the standard fix for 'Access is denied' on old profiles and OS reinstall leftovers.

High risk ✓ 2026-09-17

Verify File Hashes with certutil -hashfile

Windowshashcmdsecurity

Built-in Windows command to compute MD5, SHA1 or SHA-256 hashes of any file.

Low risk ✓ 2026-09-17