Partager via

Configuring the Network Level Authentication Setting for an RD Session Host Server

  • Article

Updated: February 16, 2011

Applies To: Windows Server 2008 R2

Network Level Authentication can be used to enhance RD Session Host server security by requiring that the user be authenticated to an RD Session Host server before a session is created.

Network Level Authentication is an authentication method that completes user authentication before you establish a remote desktop connection and the logon screen appears. This is a more secure authentication method that can help protect the remote computer from malicious users and malicious software. The advantages of Network Level Authentication are:

  • It requires fewer remote computer resources initially. The remote computer uses a limited number of resources before authenticating the user, rather than starting a full remote desktop connection as in previous versions.

  • It can help provide better security by reducing the risk of denial-of-service attacks.

To use Network Level Authentication, you must meet the following requirements:

  • The client computer must be using at least Remote Desktop Connection 6.0.

  • The client computer must be using an operating system, such as Windows® 7 or Windows Vista®, that supports the Credential Security Support Provider (CredSSP) protocol.

  • The RD Session Host server must be using Windows Server 2008 R2 or Windows Server 2008.

You can configure an RD Session Host server to only support connections from clients running Network Level Authentication. The Network Level Authentication setting for an RD Session Host server can be set in the following ways:

  • During the installation of the RD Session Host role service in Server Manager, on the Specify Authentication Method for Remote Desktop Session Host page in the Add Roles Wizard.

  • On the Remote tab in the System Properties dialog box on an RD Session Host server.

    If the Allow connections from computers running any version of Remote Desktop (less secure) is not selected and not enabled, the Require user authentication for remote connections by using Network Level Authentication Group Policy setting has been enabled and has been applied to the RD Session Host server.

  • On the General tab of the Properties dialog box for a connection in the Remote Desktop Session Host Configuration tool by selecting the Allow connections only from computers running Remote Desktop with Network Level Authentication check box.

    If the Allow connections only from computers running Remote Desktop with Network Level Authentication check box is selected and is dimmed, the Require user authentication for remote connections by using Network Level Authentication Group Policy setting has been enabled and has been applied to the RD Session Host server.

  • By applying the Require user authentication for remote connections by using Network Level Authentication Group Policy setting.

    This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Remote Desktop Session Host Configuration or on the Remote tab.

To determine whether a computer is running a version of Remote Desktop Connection that supports Network Level Authentication, start Remote Desktop Connection, click the icon in the upper-left corner of the Remote Desktop Connection dialog box, and then click About. In the About Remote Desktop Connection dialog box, look for the phrase Network Level Authentication supported.

For more information about Network Level Authentication and Remote Desktop Services, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (https://go.microsoft.com/fwlink/?LinkID=138055).

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (https://go.microsoft.com/fwlink/?LinkId=138134).