Network Level Authentication (NLA) in Windows Server

To disable Network Level Authentication (NLA) in Windows Server, you have several options depending on whether you can access the server locally, via RDP, or only through Safe Mode or offline registry. Below are the most common methods:

---

✅ Method 1: Disable NLA via System Properties (GUI)

1. Log into the server locally or via RDP.
2. Press Win + R → type SystemPropertiesRemote.exe → Enter.
3. Under Remote Desktop, uncheck: “Allow connections only from computers running Remote Desktop with Network Level Authentication (recommended)”
4. Click Apply → OK.

---

✅ Method 2: Disable NLA via Registry (regedit)

1. Open regedit.exe.
2. Navigate to: pgsql
3. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
4. Find the value:
   • UserAuthentication → Double-click and set to 0.
5. Reboot the server.

---

✅ Method 3: Disable NLA via PowerShell

Run this in an elevated PowerShell session:

powershell

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name "UserAuthentication" -Value 0

Optional (ensure RDP is enabled):

powershell

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Value 0
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

---

✅ Method 4: Disable NLA via Group Policy

1. Run gpedit.msc.
2. Navigate to:
3. pgsql
4. Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Security
5. Set “Require user authentication for remote connections by using Network Level Authentication” to Disabled.
6. Run gpupdate /force.

---

🛠️ Offline or Recovery Mode (if locked out)

If you’re locked out due to NLA and cannot RDP, you can:

1. Boot into Safe Mode with Networking (F8 or Shift+Restart).
2. Then disable NLA via registry or PowerShell as shown above.
   • OR mount the drive offline on another machine and edit the registry manually.