# RDP NLA Not Enforced

> Identifies RDP servers lacking Network Level Authentication, enabling pre-authentication attacks and brute force without valid credentials.

- **URL:** https://hackindex.io/services/rdp/vulnerability-discovery/rdp-nla-not-enforced
- **Path:** RDP > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/rdp/vulnerability-discovery.md)
- **Published:** 2026-05-15
- **Updated:** 2026-05-15

Without NLA, the RDP server renders a full login screen before any credentials are verified. This exposes the host to pre-authentication interaction, anonymous screenshot capture, username enumeration via error message differences, and removes the CredSSP layer that blocks pre-auth exploitation paths including BlueKeep. On a domain host, it also means the NTLM challenge is reachable without logging in.

Start with the encryption probe to confirm what the server will accept.

Risks when NLA is not enforced:

- Pre-authentication access to the full login screen
- Username enumeration via login error message differences
- NTLM challenge reachable without credentials
- Pre-auth exploitation paths (BlueKeep) no longer blocked by CredSSP

```bash
nmap -Pn -p 3389 --script rdp-enum-encryption $TARGET_IP
```

If the output includes `Native RDP` or `RDP Encryption` succeeding alongside or instead of `CredSSP (NLA)`, NLA is not enforced. A result showing only `CredSSP (NLA)` means NLA is required and the attack surface here is limited to credentialed paths.

Confirm with a direct connection attempt using classic RDP security mode.

```bash
xfreerdp /v:$TARGET_IP /cert:ignore /sec:rdp
```

If this reaches a login screen instead of failing at connection time, the server accepts pre-NLA connections. A failure here: `ERRCONNECT_SECURITY_NEGO_CONNECT_FAILED` or similar: confirms NLA is enforced.

Capture the pre-auth login screen without credentials.

```bash
nxc rdp $TARGET_IP --screenshot --screentime 3
```

A screenshot returned without credentials is confirmation. It also reveals hostname branding, active sessions on the login screen, and sometimes the domain name in the username field hint.

## **What NLA disabled enables**

Pre-NLA access means the server's full Remote Desktop Services stack is reachable before any authentication completes. The practical consequences depend on what else is true of the host.

Password spraying is simpler: tools that rely on classic RDP negotiation work without CredSSP support. See [RDP Brute Force and Password Spray](https://hackindex.io/services/rdp/exploitation/brute-force-password-spray).

Username enumeration becomes viable. The login screen returns different error messages for valid versus invalid accounts depending on Windows version and configuration. A `The user name or password is incorrect` response to a non-existent username on some older Windows versions can be distinguished from a response to a valid account with a wrong password.

BlueKeep (CVE-2019-0708) and DejaBlue (CVE-2019-1181) are pre-authentication vulnerabilities that affect the RDP stack before NLA completes. On hosts where NLA was enforced and then disabled, the full exploitation surface of both CVEs applies. See [RDP Known Vulnerability Detection](https://hackindex.io/services/rdp/vulnerability-discovery/rdp-known-vulnerabilities-detection).

If NTLM is enabled on the host, the RDP pre-auth NTLM challenge leaks hostname and domain context, covered in [RDP Service Fingerprinting and NTLM Info](https://hackindex.io/services/rdp/enumeration/rdp-service-fingerprinting-and-ntlm-info).

## **Confirming NLA enforcement across a subnet**

```bash
nmap -Pn -p 3389 --script rdp-enum-encryption --open $TARGET_SUBNET/24 -oG - | grep "Native RDP\|RDP Encryption"
```

Any host returning `Native RDP` or a raw RDP encryption level without `CredSSP` as the primary result is worth investigating further.

## References

- [rdp-enum-encryption NSE script](https://nmap.org/nsedoc/scripts/rdp-enum-encryption.html) - Supported security layers and encryption level detection
- [NetExec RDP screenshot without NLA](https://www.netexec.wiki/rdp-protocol/screenshot-without-nla-not-connected) - --screenshot usage and behavior