topic RDP No Authentication ?? in General Topics

RDP No Authentication ??

tom_allen — Tue, 26 Feb 2019 20:48:02 GMT

Keep seeing this in the compliance reports tab. Not sure why. Can someone help me out?

Thanks!!

Re: RDP No Authentication ??

Mark_Mitchell — Tue, 26 Feb 2019 23:07:21 GMT

Hi Tom,

Could you post a screenshot please?

It could be that a destination server a connection has been made to doesn't have the NLA (Network Level Authentication) enabled so the gateway is flagging it .

Which compliance report is thus generated against?

Regards

Mark

Re: RDP No Authentication ??

tom_allen — Wed, 27 Feb 2019 13:10:12 GMT

Re: RDP No Authentication ??

Mark_Mitchell — Wed, 27 Feb 2019 13:13:03 GMT

Hi Tom,

From your screenshot, this looks like compliance within Endpoint Security? Rather than the Compliance blade for Security management, is this correct?

Regards

Mark

Re: RDP No Authentication ??

tom_allen — Wed, 27 Feb 2019 13:24:47 GMT

Re: RDP No Authentication ??

Mark_Mitchell — Wed, 27 Feb 2019 13:26:03 GMT

Ok so this the compliance check against Endpoint Security.

I've had a look into it and the compliance check is checking for the existence of the following registry key.

HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\UserAuthentication

Will need to look into this key to find out whether this is relevant to your OS version and company Windows configuration.

Hope this helps.

Regards

Mark

Re: RDP No Authentication ??

tom_allen — Wed, 27 Feb 2019 14:03:36 GMT

Mark, where do I check on what the compliance is checking? I go into the policy and do not see any mention of the registry. I go thru each one and click edit but don't see any reference to the registry. Thanks for the help.

Re: RDP No Authentication ??

Mark_Mitchell — Wed, 27 Feb 2019 14:10:58 GMT

Hi Tom,

Within the screen in your last screenshot. If you "right click" on "Prohibited - Malicious and Vulnerable Applications" and select "Edit Shared Action" you will see the list of checks. You can then select the RDP one, "Right Click" again and edit. You can then see the affected keys that the check is looking for.

In this occasion, the compliance check is actually checking for the existence of the registry key mentioned above.

Regards

Mark

Re: RDP No Authentication ??

tom_allen — Wed, 27 Feb 2019 14:14:27 GMT

Found it. Thanks. I will have a look at this. Thank you very much for your quick response.