Network Level Authentication

We have enabled Network Level Authentication on all of our test servers.  We are now having issues with 2 servers where folks are receiving an error stating that the remote computer Network Level Authentication which your computer does not support.
All clients are Windows 7 SP1, and can access other servers that have Network Level Authentication.
When comparing the servers to working servers, there doesn't appear to be any differences.
Any Ideas?
DJ

Hi DJ,
From the current description it seem is the self-signed certificate corrupt, please perform the following action, open the Certificate Management mmc snap-in with the Local
Computer account. You will find the self-signed certificate in the 'Remote Desktop' store of the server.
Delete the certificate here.
For Windows 2003/ 2008, a server restart is required for this certificate to be re-generated.
On Windows 2008 R2, you can restart the Remote Desktop Services Configuration service to get the certificate re-generated.
The similar thread:
Configure Certificate for NLA...
https://social.technet.microsoft.com/Forums/windowsserver/en-US/d7d45464-dcb6-4dc6-b840-cb29578a9f23/configure-certificate-for-nla
Windows Server 2008 R2: Why Use Network Level Authentication?
https://technet.microsoft.com/en-us/magazine/hh750380.aspx
Secure RDS (Remote Desktop Services) Connections with SSL
https://technet.microsoft.com/en-us/magazine/ff458357.aspx
Configure Server Authentication and Encryption Levels
https://technet.microsoft.com/en-us/library/cc770833.aspx
I’m glad to be of help to you!
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Similar Messages

  • Remote Desktop Connection - Windows Network Level Authentication

    Hi
    I'm trying to find a piece of Remote Desktop "Manager" software for Mac which supports Network Level Authentication (NLA). When NLA is enabled on a Windows Server I am unable to connect via CoRD or Royal TSX.
    The reason I say "Manager" is because I have many, many windows servers I need to connect to and so I like to use software such as the above to save a list of all the servers for ease of access - this saves me having to type in the name of the server each time.
    At the moment, for those servers with NLA enabled, I have to fire up Remote Desktop Connection for Mac and enter the name. I realise I could save this each time but then I would have LOADS of shortcuts.
    Any ideas/proposals on pieces of software that can cater for this?
    Thanks!

    Hi!
    Royal TSX actually supports NLA but you have to use the FreeRDP plugin instead of CoRD and enable the setting in the advanced settings of your RDP connection.
    cheers,
    felix

  • AD "Log on to" restriction causes RDP connections with network level authentication to fail

    I am running a Server 2008 R2 environment and have recently enabled network level authentication for RDP connections. Since the change, users who have their logons restricted to specific servers via AD, now get an error when logging on via RDP:
    An Authentication error has occured
    The Local security authority cannot be contacted
    After investigating this error and reading technet I found that removing the "log on to" restriction within their user object solved the problem even tho they had rights to this server. Adding the users client PC name to the "Log on
    to" list also solves this issue.
    My question is, is there another way around this? We have an environment where some users may require an RDP connection from a client PC not on the same domain (over VPN) as the server. It will not be practical to add many different client PC names
    to the log on to list and I don't understand why client PC's must be specified in the Log on to list and not just the actual server they are logging onto.
    Any pointers appreciated

    I have just come across this problem on one of my client’s domains; they have recently enforced a policy to “Allow connections only from computers running Remote Desktop with Network Level Authentication (more secure)”  and users with “Log on To” restrictions
    on their account are no longer able to RDP using their second account.
    After a lot of fiddling around I finally resolved the problem by adding the connecting computer name into “Log on To” list.  Ultimately it appears that Network Level Authentication (NLA) requires authentication to take place on both the host initiating
    the connection and the remote host.

  • Configure Network Level Authentication for Remote Desktop client

    We publish Remote Desktop in our Windows 2008 R2 terminal server.
    However, in Windows 2008R2 , the remote desktop client will a lillte bit slow
    I found out that if I modify the setting in default.rdp
    authentication level:i:0
    enablecredsspsupport:i:0
    it will increase the speed a lot
    however, how can I set all user use remote desktop will disable those feature as well?
    Thanks

    Hi Kenneth, 
    I suggest you to see similar thread "disable
    Network Level Authentication Terminal Server 2008"
    If above thread does not helps, seek help from RDS/TS experts in here.
    Or wait until any of our moderator move this post to respective forum.
    Thank you for understanding.
    Regards, Ravikumar P

  • NLA Disabled. Still can't RDP; "requires Network Level Authentication"

    Had a server I could RDP onto without any issue running Hyper V.
    I removed the Hyper V role.
    I then rebooted and attempted to RDP onto the server and can't:
    The remote computer that you are trying to connect to requires Network Level Authentication (NLA), but your Windows domain controller cannot be contacted to perform NLA. If you are an administrator on the remote computer, you can disable NLA by using
    the options on the Remote tab of the System Properties dialog box.
    OK... Never needed before.
    I checked the network settings remotely with netsh and confirmed correct DC as DNS. So I'm scratching my head why Microsoft are lying to me?
    OK, so I check the NLA settings remotely, sure enough is enabled. So I disabled via remote registry, reboot the machine, confirm the registry is set to NLA disabled again remotely and attempt to connect.
    And... Same message.
    I can access any other of the 2012 R2 servers on my domain without issue. I can open AD or any other Domain tools from other servers with the same DC as the problem server as their primary DNS.
    How can I get that message when both the DC is contactable and NLA is disabled?
    How did removing a role cause this BS suddenly?

    Hi,
    Thank you for posting in Windows Server Forum.
    Which version of client RDP you are using?
    You can use RDP v8.1 for better performance.
    Apart from above, Use local admin account to log on to the virtual machine and set the DNS to point to your DC. Alternatively, assign the IP address of the DC/DNS under DNS servers of virtual network.
    Also when trying to remote desktop check the option “Allow connection from computers running any version of Remote desktop (less secure)” under system properties.
    Hope it helps!
    Thanks.
    Dharmesh Solanki
    TechNet Community Support

  • Remote Desktop Network Level Authentication

    Recently, I began getting failed connections from a Windows 7 Enterprise client to another Windows 7 Enterprise host where the host is requiring NLA. This has been a problem on and off for YEARS and I have found no link that can tell me to configure something
    that I haven't already configured. Neither system underwent any configurations changes that I know of with the exception of Windows security updates/patches. In fact, some people in my company have the same issue while other do not. I can find no rhyme or
    reason to it. Heres where I'm at:
    "The remote computer requires Network Level Authentication, which your computer does not support. For assistance, contact your system administrator or technical support."
    But I do. when i click the upper left hand corner of my RDP client window and select "About", I see this:
    "Remote Desktop Connection
    Shell Version 6.1.7601
    Control Version 6.1.7601
    Network Level Authentication Supported.
    Remote Desktop Protocol 7.1 supported."
    And the above info is exactly what it says on the host.
    Here's the SecurityProvider registry settings on the client:
    Windows Registry Editor Version 5.00
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders]
    "SecurityProviders"="credssp.dll"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SaslProfiles]
    "GSSAPI"="Kerberos"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL]
    "EventLogging"=dword:00000001
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\CipherSuites]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client]
    "DisabledByDefault"=dword:00000001
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest]
    "Debuglevel"=dword:00000000
    "Negotiate"=dword:00000000
    "UTF8HTTP"=dword:00000001
    "UTF8SASL"=dword:00000001
    "DigestEncryptionAlgorithms"="3des,rc4"
    Every link I have looked at tells me to look at those things. Anyone got something new? :)
    Also if someone knows how to log the RDP failures that would be cool too. Presently I have turned on Audit Other Security Events in GPO but it doesn't tell me if someone attempted to authenticate with a less then desirable security protocol.
    As a fix, for now, I have reduced the security requirements on the host to not require NLA. <-- This is the only consistent fix I have ever seen that works.
    By the way, just about every link I see also starts talking about setting up RD session host service. I am not running Windows Server 2008. This a Windows 7 to Windows 7 problem

    Hi,
    On both Windows 7, Please go to System Properties,
    Remote tab and make sure that Allow connections only from computers running Remote Desktop with Network Level Authentication
    is unchecked.
    If problem persists, please check if there was any Windows updates need to install, if so, try to install updates for test.
    Roger Lu
    TechNet Community Support

  • 802.11 X port-level authentication or user-level authentication

    I have read many online documents about 802.11x, all that i found they named port-level authentication.
    It makes sense for a wired network, since we have got a physical port, then if the supplicant has been authenticated, his port will be open to transfer data.
    And same thing with a wireless network, but we do not have physical port, we have got logical port.
    I have read one document that mentioned that 802.11 is user-level authentication,,,any comment about this ?
    Regards

    Thanks steprodr
    That means in both cases (wired. wireless) a client has to be authenticated to pass through physical port or logical port to be able to access(use)network resources,,,,,
    What is my interpretation (correct me) to your reply, that with the wire we call it port level while with wireless (my conclusion, because explicitly you have mentioned that)we do not call it port level (i.e. it is called user level) ?

  • What changes occurred in version 8+ of itunes at a network level

    Hi all
    I am very desperate to solve a problem that has been nagging me for nearly two years now. Any PC in my network (Belkin wireless router / Hub) that tries to connect iTunes 8+ to airport express using a wireless card instead of Ethernet to the hub does not work. I get an error 15000 and no sound.
    Version 7.7 - is OK but i cannot talk to my shiny new iPhone with that version...
    EG. I upgrade to version 9 and loose my connection to the airports. I take the pc to the Belkin router and plug it with an Ethernet cable and it works fine to the airports... every thing else is OK just kills wireless streaming.
    Given that i have been scouring any posts going and tried EVERYTHING... I can conclude that Itunes 8+ versions have a fundamental change that kills of air tunes streaming only through wireless network cards.
    My question is that only what is the basic network level change in itunes 8+

    Create a group:

  • How to solve the error message "Could not activate cellular data network: PDP authentication failure"when using 3g or gPRS on safari with an iphone 4 and latest software updates

    Please can someone help me to solve the error message "Could not activate cellular data network: PDP authentication failure"when using 3G or GPRS on safari with an iphone 4GS and latest software updates. I have tried resetting the network and phone settings. I have restored the factory settings on itunes and still the problem persists.

    All iPhones sold in Japan are sold carrier locked and cannot be officially unlocked by the carrier. If you unlocked it, it was by unauthorized means (hacked), and support cannot be given to you in this forum.
    Hacked iPhones are subject to countermeasures by Apple, particularly when updating the firmware. It is likely permanently re-locked or permanently disabled.
    Message was edited by: modular747

  • How to solve this problem? '' can not activate cellular data network failure'' authenticating PDP  from already thank you

    how to solve this problem? '' can not activate cellular data network failure'' authenticating PDP  from already thank you

    What does this have to do with using an iPhone in an enterprise environment?
    What carrier are you using and where did you get the phone?

  • Unable to caluclate cost in CJ20 for wbs and network level.

    Hi All,
    I have a query in the project Builder(CJ20N).
    I created Project>WBS Elements>Network> and posted costs via assigning activity.
    If I select an activity and go to edit>Costs,  the "calculate costs" option is activated.  ( I get "Message Costs were calculated: See menu Edit -> Costs -> Planned - Actual")
    And also I am able to view the cost in Edit>Costs> Plan/Actual.. "Activity/Element". Please see the screenshots of Plan /actual comparison.
    However if I select the WBS or Network and go to edit>Costs,  the "calculate costs" option is disabled (frozen) and also in the same path Plan/Actual> "activity/Element"  option is disabled (Frozen).
    Request you to review the attached screenshot and advise is there any way to defreeze the option "calculate costs" and view the costs in WBS and Network level?

    Hi,
    why you want to see plan cost in project builder CJ20n? any specific reason please let us know...
    every structure report having this kind of feather as CN41n/CNS41 then check these two report.
    and lots of hierarchical report is there for seeking plant cost in project as Gokul suggested above.
    so in project builder only plan VS actual cost can be look like by network activity.
    Regards,
    Sanjeev

  • Enabling HTTPS level authentication in SOAP adapter (PI 7.1)

    Hi,
    I am using SOAP to SOAP scenario using HTTPS level authentication in PI 7.11
    As per the SAP Note https://websmp130.sap-ag.de/sap(bD1lbiZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=891877
    We have enabled HTTPS level authentication in sender communication channel using SOAP adapter (version 7.0).
    But We are not able to have the HTTPS level authentication option in sender communication channel using SOAP adapter (version 7.1) while selecting the adapter type.
    Please suggest on this

    Hello Gabriel,
    You are right,  that option is still available in PI 7.1
    http://help.sap.com/saphelp_nwpi71/helpdata/EN/fc/5ad93f130f9215e10000000a155106/frameset.htm
    But disappeared in PI 7.11
    http://help.sap.com/saphelp_nwpi711/helpdata/en/48/3555240bea31c3e10000000a42189d/frameset.htm
    The closest seems to be under Security Profile S/MIME. And when you use the sender cc in sender agreement, you are given the choice for validation/decryption/decryption and validation/validation and decryption.
    Hope this helps,
    Mark

  • I have problem c connecting to cellular data network. There is massage "couldn't activate cellular data network, PDP authentication failure". What is it and how I solve this problem?

    I have problem c connecting to cellular data network. There is massage "couldn't activate cellular data network, PDP authentication failure". What is it and how I solve this problem?

    If you have a data only plan for the iPad with your carrier, if no change after powering your iPad off and on you will need to contact your carrier.

  • Easy Cost Planning at Network Level

    Hi All,
    I was able to implement ECP at WBS level, but not able to implement at network level. I am using SAP ECC 6.0 EHP 4.
    I have activated the business function ops_ps_ci_1 and also activated the 'Activate Planning for Network Activities with Easy Cost Planning' in the configuration settings in SPRO-IMG. I had gone through most of the threads on this topic like :
    Network Activity Easy Cost planning
    ECP at activity level not triggered
    I am not able to find the option for 'Create Alternate CO Version' and 'Activate Multiple CO Version' under the Easy Cost Planning and Execution Services in SPRO-IMG.Please advise me in implementing Easy Cost Planning at Network Level and correct me if I was wrong in completing the configuration steps.

    Thanku All,
    I have done all the steps as you mentioned
    1. Activated the business function OPS_PS_CI_1.
    3
    2.
    3.
    Activated Multiple Plan Version using the tcode RCNPRECP
    Still not able to view the options under SPRO-IMG Easy Cost Planning
    * Create Alternate CO Version
    * Activate Multiple CO Version
    Also not able to implement ECP at network level.

  • How to do .1x port based network access authentication through ACS

    How to do .1x port based network access authentication through ACS.

    Hi,
    802.1x can authenticate hosts either through the username/password or either via the MAC address of the clients (PC's, Printers etc.). This process is called Agentless Network Access which can be done through Mac Auth Bypass.
    In this process the 802.1x switchport would send the MAC address of the connected PC to the radius server for authentication. If the radius server has the MAC address in it's database, the authentication would be successful and the PC would be granted network access.
    To check the configuration on the ACS 4.x, you can go to http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.1/configuration/guide/noagent.html
    To check the configuration on an ACS 5.x, you can go to http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-2/user/guide/acsuserguide/common_scenarios.html#wp1053005
    Regards,
    Kush

Maybe you are looking for