Short answer: Network Level Authentication (NLA) makes RDP ask for your username and password before it opens a full remote desktop session, instead of showing the Windows logon screen first and checking credentials after. That moves authentication earlier and cheaper for the server — an unauthenticated connection attempt never gets far enough to spend memory on a session — and it is why an old or non-Windows client that does not speak NLA’s underlying protocol, CredSSP, cannot connect to a server that requires it.
Where it lives in Windows
On the server: System Properties → Remote (or Settings → System → Remote Desktop → Advanced settings on current Windows) has a checkbox Allow connections only from computers running Remote Desktop with Network Level Authentication. Checked (the default on every supported Windows version) means NLA is required; a client without it is rejected before the logon screen ever appears. Unchecking it allows older clients through, at the cost of exposing the full pre-authentication logon screen to anyone who can reach the port.
| Scope | Location | Setting |
|---|---|---|
| One machine, GUI | System Properties → Remote → Remote Desktop | “Allow connections only from computers running Remote Desktop with Network Level Authentication” |
| One machine, registry | HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp | UserAuthentication |
| Domain or many machines, Group Policy | Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Security | “Require user authentication for remote connections by using Network Level Authentication” |
The registry value UserAuthentication under that RDP-Tcp key is a DWORD: 1 requires NLA, 0 does not. It is the same setting the GUI checkbox and the Group Policy both ultimately write.
Why it exists
- Less exposed before login. Without NLA, anyone who can reach port 3389 gets as far as the Windows logon screen itself before presenting any credentials — that screen, and the session infrastructure behind it, is surface a remote, unauthenticated party can poke at. NLA authenticates first, over CredSSP, and only then allocates a real session.
- Cheaper for the server under load or attack. A flood of connection attempts against an NLA-protected server fails at the lightweight credential check; the same flood against a server without NLA each gets as far as spinning up session infrastructure before failing, which is a meaningfully heavier cost per attempt.
- It does not replace a firewall or a VPN. NLA changes when authentication happens, not whether port 3389 is reachable from the internet at all. Pair it with the usual hardening: a non-default port, a firewall rule limiting source IPs, or putting RDP behind a VPN entirely — see securing a Windows RDP server.
“The remote computer requires Network Level Authentication”
This exact message means the client you are using does not support NLA and the server requires it. The usual causes, in order of likelihood:
- An old client. NLA support arrived with RDP 6.0 and is standard on every Windows client from Windows Vista (with an update) and Windows 7 onward, and on current mobile and Mac RDP clients. A genuinely old client — an unpatched Windows XP box, an ancient third-party RDP app — is the classic case.
- Connecting to an older/legacy target that cannot speak NLA at all, such as some embedded or kiosk systems. There the fix runs the other way: relax the requirement on the target rather than touching the client.
- mstsc’s /admin or legacy switches occasionally interact oddly with very old server configurations; try a plain connection first before troubleshooting further.
If you control the server and the client genuinely cannot be upgraded, uncheck the NLA requirement in System Properties → Remote as above — understanding that this is a deliberate trade of security for compatibility, not a bug being worked around.
The CredSSP encryption oracle remediation error
A second, unrelated-looking error that is actually about the same protocol NLA relies on:
An authentication error has occurred.
The function requested is not supported
This could be due to CredSSP encryption oracle remediation.This is Microsoft’s May 2018 patch for CVE-2018-0886, a CredSSP vulnerability, and it shows up when a patched client and an unpatched server (or the reverse) disagree about how strictly to enforce the fix. It is controlled by a registry value, AllowEncryptionOracle, under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters, or the Group Policy Encryption Oracle Remediation under Computer Configuration → Administrative Templates → System → Credentials Delegation:
| Value | Policy name | Meaning |
|---|---|---|
| 0 | Force Updated Clients | Refuses any connection from a client that has not applied the CredSSP fix — the secure setting, and the one Microsoft moved everything to over time |
| 1 | Mitigated | Accepts an unpatched client, but only once that client has itself been updated enough to negotiate safely — a middle ground |
| 2 | Vulnerable | No protection at all — accepts the old, exploitable behaviour unconditionally |
The practical fix for the error above, on either end, is patching Windows fully rather than permanently loosening this setting — it exists to close a real vulnerability in the credential delegation protocol NLA depends on. Lowering it to Vulnerable as a one-off to get back into an old box you are about to patch anyway is a reasonable stopgap; leaving it there is not.
If the connection fails before NLA is even the question
NLA errors assume the connection reaches the RDP service at all. If nothing happens, or the error is about the connection itself rather than authentication, see Remote Desktop can’t connect for the firewall, port and network checks that come before this one.
Frequently asked
What is Network Level Authentication?
A Remote Desktop setting that authenticates the connecting user over CredSSP before a full remote session is opened, instead of showing the Windows logon screen first and checking credentials afterward. It reduces what an unauthenticated connection attempt can reach and is cheaper for the server under a flood of attempts.
Why does my RDP client say it requires Network Level Authentication?
The server has NLA required (the default on every supported Windows version) and your client does not support CredSSP — usually a genuinely old client. Update the client, or uncheck “Allow connections only from computers running Remote Desktop with Network Level Authentication” in System Properties → Remote on the server, understanding that this trades security for compatibility.
What does the CredSSP encryption oracle remediation error mean?
It's Microsoft's May 2018 fix for CVE-2018-0886 in the CredSSP protocol NLA relies on, triggered when a patched and an unpatched machine disagree about how strictly to enforce it. It's controlled by the AllowEncryptionOracle registry value (or the “Encryption Oracle Remediation” Group Policy): 0 forces updated clients only, 1 is a mitigated middle ground, 2 is unprotected. The real fix is patching Windows fully on both ends.
Is it safe to turn off NLA?
It removes a real layer of protection — an unauthenticated connection then reaches the full logon screen and session infrastructure instead of being rejected earlier and more cheaply. Only do it when an old client genuinely cannot be upgraded, and pair it with other hardening such as a firewall rule limiting who can reach port 3389 at all.