Will Sysinternals consider adding the capability to disable NLA authentication on a per server basis?

Question

The mstsc client supports this with the RDP file option enablecredsspsupport:i:0.

While I recognize that NLA model is the recommended model to avoid denial of service (resource consumption), there are scenarios where Credential Providers are used to provide MFA or alternate authentication mechanisms.

This creates a problem, because if the server is set to SecurityLayer = 1 or SecurityLayer = 2, there is no mechanism by which an RDP client with CredSSP support enabled can pass the local prompt to get the Credential Provider driven authentication.

That means one must use the Security Layer = 0 which is the legacy RDP protocol and doesn't provide a way to verify the server (SecurityLayer = 2 with CredSSP disabled still allows TLS authentication of the server).