Verifying NLA support on Remote Desktop

Question

What is the best way to verify if an MSRDP server has NLA enabled or not?

My understand is that if enabled, it will not show a graphical screen when trying to connect, but ask for credentials first.

Would one way to verify this be to use the rdesktop utility and if a GUI screen is shown for login, note that NLA is not enabled?

Answer 1

rdp-sec-check is a Perl script to enumerate the different security settings of an remote desktop service

The following potential security issues are flagged if present:

• The service supports Standard RDP Security. This is known to be vulnerable to an active Man in the Middle attack.
• The service supports weak encryption (40-bit or 56-bit).
• The service does not mandate Network Level Authentication (NLA). NLA can help to prevent certain types of Denial of Service attack.
• The service supports FIPS encryption but doesn’t mandate it – may only be interesting for jurisdictions where FIPS is required

Answer 2

Powershell:

(Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices).UserAuthenticationRequired

Will return 1 if NLA is enabled. Or 0 otherwise.

Source: https://lazywinadmin.com/2014/04/powershell-getset-network-level.html (a great site, BTW!)

Answer 3

rdesktop supports CredSSP + Kerberos which is one subset of NLA support. If no kerberos ticket is initialized, rdesktop will and handshake to use SSL for transport with the server. If the remote server is forcing the use of NLA this fallback path will fail and rdesktop will report this to console. This way you can detect if remote terminal server is forcing the use of NLA.

The error message rdesktop reports in this case is: "Failed to connect, CredSSP required by server."

Answer 4

Even rdesktop's changelog indicates that it can support CredSSP + Kerberos authentication (NLA), but if your windows server forces to use NLA, then you still will get error message: Failed to connect, CredSSP required by server..