RDP Network Level Authentication (NLA)

Network Level Authentication (NLA) requires an RDP client to authenticate using CredSSP, the Credential Security Support Provider protocol, before the server allocates resources for a full graphical session or shows any logon interface at all. Without NLA, an unauthenticated connection still reaches Windows’ logon screen, consuming server resources and giving an attacker a visible target to brute-force or exploit even if the account behind it is never compromised. CISA’s Binding Operational Directive 23-02 treats a management interface like RDP as needing exactly this kind of authentication enforced ahead of the interface itself, not layered on after a session already exists. NLA is a configuration setting on every supported Windows version, not a separate product, and AdminKit’s own RDP hardening guidance lists it as the first step after confirming the port itself isn’t openly reachable.