# RDP NTLM Info Fingerprinting

- **URL:** https://hackindex.io/services/rdp/enumeration/rdp-service-fingerprinting-and-ntlm-info
- **Path:** RDP > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/rdp/enumeration.md)
- **Published:** 2026-01-04
- **Updated:** 2026-05-15

RDP with CredSSP (NLA) often leaks useful identity and OS details during the NTLM handshake before any real login. This is fast signal for domain context, naming, and rough Windows build without creds.

## Nmap rdp-ntlm-info

Run it directly:

```bash
nmap -Pn -p $PORT --script rdp-ntlm-info $TARGET_IP
```

If you’re scanning multiple hosts, keep it quiet and output for parsing:

```bash
nmap -Pn -n -p $PORT --script rdp-ntlm-info -oA rdp_ntlm_info $TARGET_IP
```

### What good output looks like

Expect fields like NetBIOS and DNS naming plus a product version:

```
| rdp-ntlm-info:
|   Target_Name: CONTOSO
|   NetBIOS_Domain_Name: CONTOSO
|   NetBIOS_Computer_Name: WIN10-WS01
|   DNS_Domain_Name: contoso.local
|   DNS_Computer_Name: win10-ws01.contoso.local
|   Product_Version: 10.0.19045
|_  System_Time: 2026-01-19T10:12:03+00:00

```

### How to use it

- **DNS_Domain_Name / Target_Name present**: treat it as domain-joined until proven otherwise. Set `$DOMAIN` from this and align user spraying formats and AD targeting: see [RDP Brute Force and Password Spray](https://hackindex.io/services/rdp/exploitation/brute-force-password-spray).
- **DNS_Computer_Name / NetBIOS_Computer_Name present**: you’ve got a reliable hostname for pivoting into DNS, SMB, LDAP, and certificate-based targeting.
- **Product_Version present**: prioritize older-looking builds for deeper vuln checks, and don’t waste time guessing OS family.

## When rdp-ntlm-info returns nothing

This usually means CredSSP isn’t in play, the service isn’t Windows RDP, or the endpoint is doing something odd with negotiation.

Confirm the port really speaks RDP:

```bash
nmap -Pn -sV -p $PORT $TARGET_IP
```

If you still need identity hints, try pulling the server cert via a client handshake (you’ll often get a CN/SAN with the host naming pattern):

```bash
xfreerdp /v:$TARGET_IP:$PORT /u:$USER /p:$PASSWORD /cert:ignore /sec:nla
```

If you don’t have creds, you can still try with empty values just to trigger negotiation and see what it prints before auth fails:

```bash
xfreerdp /v:$TARGET_IP:$PORT /u: /p: /cert:ignore /sec:nla
```

What you’re looking for:

- Any displayed **server name** or **certificate subject** that gives you a hostname pattern.
- Clear errors about required security modes, which changes how you approach follow-on enumeration.

## Fast TCP sanity check

This is only for “is something listening”, not fingerprinting:

```bash
nc -nv -w 3 $TARGET_IP $PORT
```

If it connects, treat it as “open”. Don’t expect a readable banner.

## References

- [rdp-ntlm-info NSE script](https://nmap.org/nsedoc/scripts/rdp-ntlm-info.html) - Script behavior and returned fields for NTLM-based RDP info disclosure