Configure Network Level Authentication for Remote Desktop Services Connections

Network Level Authentication completes user authentication before you establish a remote desktop connection and the logon screen appears. This is a more secure authentication method that can help protect the remote computer from malicious users and malicious software. Further this can help provide better security by reducing the risk of denial-of-service attacks.

To use Network Level Authentication, you must meet the following requirements:

• The client computer must be using at least Remote Desktop Connection 6.0.
• The client computer must be using an operating system, such as Windows 7, Windows Vista, or Windows XP with Service Pack 3, that supports the Credential Security Support Provider (CredSSP) protocol.
• The RD Session Host server must be running Windows Server 2008 R2 or Windows Server 2008.

To configure Network Level Authentication for a connection in Windows Server 2008 R2 or Windows Server 2008.

1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.
2. Under Connections, right-click the name of the connection, and then click Properties.
3. On the General tab, select the Allow connections only from computers running Remote Desktop with Network Level Authentication check box.
4. Clikc OK

To determine whether a computer is running a version of Remote Desktop Connection that supports Network Level Authentication, start Remote Desktop Connection, click the icon in the upper-left corner of the Remote Desktop Connection dialog box, and then click About. Look for the phrase Network Level Authentication supported in the About Remote Desktop Connection dialog box.

To disable (Alternative method):
If you want, you can disable NLA by running tsconfig.msc on your 2008 R2 server, and deselecting the "Allow connection only from computers running Remote Desktop with Network Level Authentication" option under the RDP service.

To enable NLA in XP machines; first install XP SP3, then edit the registry settings on the XP client machine to allow NLA

1. Click Start, click Run, type regedit, and then press ENTER.
2. In the navigation pane, locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
3. In the details pane, right-click Security Packages, and then click Modify.
4. In the Value data box, type tspkg. Leave any data that is specific to other SSPs, and then click OK.
5. In the navigation pane, locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders
6. In the details pane, right-click SecurityProviders, and then click Modify.
7. In the Value data box, type credssp.dll. Leave any data that is specific to other SSPs, and then click OK.
8. Exit Registry Editor.
9. Restart the computer.

RDP mechanisms supported on different Server OS versions

	Server OS Version
Client OS	Windows Server 2000, 2003 Windows Server 2003 SP1 / R2 Windows Server 2008
Windows XP SP2 and earlier	Network Level Protection or VPN Pure SSL/TLS Pure SSL/TLS
Windows XP SP3*, Windows Vista, Windows Vista SP1	Network Level Protection or VPN Pure SSL/TLS NLA or Pure SSL/TLS

Pure SSL/TLS is a standard mechanism that enables clients to authenticate to servers and provides a secure channel by encrypting communications. To use SSL/TLS, you must obtain certificates issued by a trusted Certificate Authority and configure them on each terminal server on which you want to have server authentication.


Microsoft Windows Remote Desktop Protocol Server Man-in-the-Middle Weakness

Remote Desktop Protocol Server (Terminal Service) is vulnerable to a man-in-the-middle (MiTM) attack. The RDP client makes no effort to validate the identity of the server when setting up encryption. An attacker with the ability to intercept traffic from the RDP server can establish encryption with the client and server without being detected. A MiTM attack of this nature would allow the attacker to obtain any sensitive information transmitted, including authentication credentials.

Solution :
- Force the use of SSL as a transport layer for this service if supported, or/and
- Select the 'Allow connections only from computers running Remote Desktop with Network Level Authentication' setting if it is available.

Reference:
[1] http://blogs.msdn.com/b/rds/archive/2008/07/21/configuring-terminal-servers-for-server-authentication-to-prevent-man-in-the-middle-attacks.aspx
[2] https://technet.microsoft.com/en-gb/library/cc732713.aspx