Skip to content
HackIndex logo

HackIndex

RDP NLA Not Enforced

3 min read May 15, 2026

Without NLA, the RDP server renders a full login screen before any credentials are verified. This exposes the host to pre-authentication interaction, anonymous screenshot capture, username enumeration via error message differences, and removes the CredSSP layer that blocks pre-auth exploitation paths including BlueKeep. On a domain host, it also means the NTLM challenge is reachable without logging in.

Start with the encryption probe to confirm what the server will accept.

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 3389 --script rdp-enum-encryption $TARGET_IP

If the output includes Native RDP or RDP Encryption succeeding alongside or instead of CredSSP (NLA), NLA is not enforced. A result showing only CredSSP (NLA) means NLA is required and the attack surface here is limited to credentialed paths.

Confirm with a direct connection attempt using classic RDP security mode.

┌──(kali㉿kali)-[~]
└─$ xfreerdp /v:$TARGET_IP /cert:ignore /sec:rdp

If this reaches a login screen instead of failing at connection time, the server accepts pre-NLA connections. A failure here — ERRCONNECT_SECURITY_NEGO_CONNECT_FAILED or similar — confirms NLA is enforced.

Capture the pre-auth login screen without credentials.

┌──(kali㉿kali)-[~]
└─$ nxc rdp $TARGET_IP --screenshot --screentime 3

A screenshot returned without credentials is confirmation. It also reveals hostname branding, active sessions on the login screen, and sometimes the domain name in the username field hint.

What NLA disabled enables

Pre-NLA access means the server's full Remote Desktop Services stack is reachable before any authentication completes. The practical consequences depend on what else is true of the host.

Password spraying is simpler — tools that rely on classic RDP negotiation work without CredSSP support. See RDP Brute Force and Password Spray.

Username enumeration becomes viable. The login screen returns different error messages for valid versus invalid accounts depending on Windows version and configuration. A The user name or password is incorrect response to a non-existent username on some older Windows versions can be distinguished from a response to a valid account with a wrong password.

BlueKeep (CVE-2019-0708) and DejaBlue (CVE-2019-1181) are pre-authentication vulnerabilities that affect the RDP stack before NLA completes. On hosts where NLA was enforced and then disabled, the full exploitation surface of both CVEs applies. See RDP Known Vulnerability Detection.

If NTLM is enabled on the host, the RDP pre-auth NTLM challenge leaks hostname and domain context, covered in RDP Service Fingerprinting and NTLM Info.

Confirming NLA enforcement across a subnet

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 3389 --script rdp-enum-encryption --open $TARGET_SUBNET/24 -oG - | grep "Native RDP\|RDP Encryption"

Any host returning Native RDP or a raw RDP encryption level without CredSSP as the primary result is worth investigating further.

References