This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Today I had to restore a virtual machine from a backup from 2 weeks ago. Once booted I received the error message that I was not able to connect because of the following error:
The remote computer that you are trying to connect to requires Network Level Authentication (NLA), but your Windows domain controller cannot be contacted to perform NLA.
Use the following option to Disable NLA, This usually happens in machines created with Image or Migrated VMs.
You can re-join the VM to domain if the problem persist.
Please "Accept as Answer" if this helps
Good afternoon, martins jackson . I executed reg via console and restarted the vm, but the same error remained, as shown in the image. Tried with a domain user and local user (whom I'm accessing via serial console)
try to also put the entire domain + user ex:
reddog.microsoft.com\username
Try adding these other regs too:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v fAllowSecProtocolNegotiation /t REG_DWORD /d 0 /f
did you change the dns of your windows vm? If yes, try to put in default mode on ip configuration
Try creating a new local account and connecting to it using .\ as in the example below:
net user USER_NAME PASSWORD /add
net localgroup administrators USER_ACCOUNT /add
Try connecting normally, if it doesn't work, try connecting using the /admin parameter in mstsc -v like:
mstsc -v 192.x.x.x. /admin
and use MACHINE_NAME\admin not DOMAINNAME\user
try to create a local user with the above commands, it may not try to contact the domain and release the connection
@Gabriel Barreto
Were you able to connect using a new local user? the symptoms seemed to be DNS related
--please don't forget to "[Accept the answer]" if the reply is helpful--
Just checking if there's any progress or updates?
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
You can connect via console and disable the option NLA on system properties -> remote
Allow connections only from computers running Remote Desktop with Network Level Authentication
there are also options to use powershell script or change registry remotely to disable this option:
Best
You can go to Azure Portal -> Operations -> Run and execute DisableNLA script
Reboot VM and make a new test
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(204.8, 46%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
This option does not work. The script executes and completes successfully, you restart the VM yourself, you try to RDP again but the error remains.
Hi @martins jackson. I tried to perform the procedure, finished and it appears that it worked that it is to restart the vm to apply, as shown in the image above. However after restarting the error remains. It is a machine that is joined to a domain. Do you know any other way?
@Gabriel Barreto
Try using your VM's Serial Console,
Connect with prompt and run:
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-TCP" /v UserAuthentication /t REG_DWORD /d "0" /f
restart your vm and try to connect again
Open you VM, go to Serial console and type:
CMD
ch -si 1
Put your credencials
and run reg add above
Hello there!
As the VM is part of a Domain, can you check if you have a GPO that configures the NLA?
This worked for me. Thanks!!
Unfortunately it was not, I tried to restart the vm but the error allowed. Do you know any 3rd option to be able to access the vm?
try to create a local user with the above commands, it may not try to contact the domain and release the connection
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 25%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPC%3C/text%3E%3C/svg%3E)
Hi Gariel,
I am having the same issue when restoring an Azure VM. Did you ever find a workaround or solution? Many times restoring VMs in Azure is not pleasant and these unexpected errors occur.
Thanks,
Patty
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(243.2, 31%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDN%3C/text%3E%3C/svg%3E)
I had the exact same problem after restoring a VM from a backup and setting the registry key didn't fix the problem. What I did was start a PowerShell session from the serial console (as described above). Of course, this requires that you have a local account that you can log in to. Once you are in PowerShell, run the command Test-ComputerSecureChannel. If it returns false, you need to repair the connection using the -repair parameter. You will need to pass a domain username and password. I did something like this, and it fixed the problem.
$User = "domainname\username"
$Pword = ConvertTo-SecureString "plaintextpassword" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $User, $PWord
Test-ComputerSecureChannel -Repair -Credential $Credential
