Kerberos NLA for workstations
Domain workstations that require NLA sign in to the RDS bastion with their Kerberos ticket, on a dedicated listener.
Some Windows workstations are set to require Network Level Authentication (NLA).
Such a workstation refuses a server that only offers TLS, so it cannot open a session on the standard bastion listener.
The NLA listener solves this for workstations that belong to the Active Directory domain.
The workstation authenticates with its Windows Kerberos ticket, then the bastion asks for the second factor and shows the target selector.
How it works
The bastion runs a second RDP listener dedicated to NLA, on port 3390 by default.
The standard listener on port 3389 does not change.
Workstations outside the domain, connections by IP address and tunnel agents keep using port 3389, with the bastion login screen.
- The user opens the Remote Desktop client to the DNS name of the bastion, on the NLA port.
- Windows gets a Kerberos ticket for the bastion service principal
TERMSRV/<bastion DNS name>. - The bastion checks the ticket with its own keytab.
No login screen is shown. - The bastion reads the user's Active Directory groups with the service account of the Active Directory connection.
The policies apply as on port 3389. - The bastion asks for the TOTP code.
On this listener the code is always asked, even for users and groups exempted from MFA.
A Kerberos ticket alone never opens a session. - The user picks a target in the selector.
Credentials sent to the target
The bastion chooses the target credentials in this order.
- The credentials stored on the target.
- If the target has none, the credentials that the Remote Desktop client sends during NLA.
The bastion uses them only when their account matches the Kerberos identity of the user. - If the client sends no password, the bastion asks for the target login and password.
This happens with Restricted Admin mode, Remote Credential Guard, or when a GPO blocks credential delegation.
If the target refuses the stored credentials, the session fails as on port 3389.
The bastion does not retry with other credentials.
Requirements
- An Artica license.
Without a license the NLA listener stays stopped. - The Active Directory feature of the appliance turned on.
This feature requires the Artica license. - RDS engine 12.3.31 or later.
Version 12.3.31 fixes the Kerberos exchange that some RDP clients use with Active Directory.
The status card says when the engine is too old. - RDS authentication service 1.10.0 or later.
- An Active Directory connection already configured for the RDS Proxy, with its service account.
- A DNS name for the bastion, resolved by the workstations to the bastion address.
- The bastion clock in sync with the domain controllers.
Kerberos refuses a clock offset of more than five minutes. - An Active Directory account allowed to create computer accounts, for the join only.
- Workstations joined to the domain.
Workstations must connect with the DNS name of the bastion, not with its IP address.
With an IP address, Windows cannot get a Kerberos ticket and the NLA authentication fails.
The bastion never falls back to NTLM on this listener.
Set up the NLA listener
All the steps are in the NLA authentication (Kerberos) card of the RDS Proxy status page, next to the Encryption card.
1. Join the domain
Click Join the domain and fill in the form.
- Domain: the Active Directory DNS domain, for example
corp.example.com. - Administrator account and its password.
The password is used for the join only.
It is never stored. - DNS name of the bastion: the name the workstations use.
The service principalTERMSRV/<name>is registered for this name. - Computer account: optional, 15 characters at most.
Left empty, it is derived from the DNS name with the-RDSsuffix.
The bastion gets its own computer account and its own keytab, /etc/rdpproxy/krb5.keytab.
The Active Directory join of the proxy service is not changed.
The bastion refuses to reuse the computer account of the machine.
When the appliance is also a proxy joined to the domain, the bastion needs a DNS name different from the machine name.
2. Turn on the listener
Open NLA listener settings.
- NLA listener: turns the dedicated listener on or off.
- Port: between 1024 and 65535, 3390 by default.
It must differ from the port of the main listener. - Interface: the network interface to listen on.
Leave it empty to listen on all interfaces.
The listener only listens on IPv4. - Allowed sources: one IPv4 address or network (CIDR) per line, for example
10.0.0.0/8.
The appliance firewall opens the NLA port only for the allowed sources.
Leave the list empty to accept every source.
The card then shows a warning, because any address can reach the port.
A single invalid line rejects the whole list.
The firewall keeps the port closed until the list is corrected.
The listener starts within a few seconds once every condition is met.
The card shows Active, or the reason why the listener does not run.
3. Prepare the workstations
- Create a DNS record for the bastion name if it does not exist.
- Give the users an RDP file or a shortcut to
<bastion DNS name>:3390. - For single sign-on with the Windows session, set the GPO
Computer Configuration > Administrative Templates > System > Credentials Delegation > Allow delegating default credentials.
AddTERMSRV/<bastion DNS name>to its server list.
Without this GPO, Windows asks the user for a password before it connects.
Health checks
Click Run the checks in the card.
The checks can take up to 40 seconds.
| Check | What it verifies |
|---|---|
| DNS resolution of the bastion name | The DNS name resolves to an address of the bastion. |
| Clock offset with the domain controller | The bastion reads the time of the domain controller. The offset must stay within the Kerberos tolerance. |
| Service principal present in the keytab | The keytab holds TERMSRV/<name> for the domain. |
| Service principal registered on a single account | No other Active Directory account holds the same service principal. A duplicate makes Kerberos fail. |
| Renewal of the computer account password | Date of the last keytab renewal. |
The bastion checks the computer account password once a day.
It changes the password when the last change is more than 30 days old.
Renew the keytab changes the password at once.
Why the listener does not run
The card shows one of these reasons.
| Reason | What to do |
|---|---|
| An Artica license is required | Install an Artica license. |
| The NLA listener is disabled | Turn it on in NLA listener settings. |
| The Active Directory feature is disabled (it requires an Artica license) | Install an Artica license. Then check that the Active Directory feature is turned on. |
| The RDS engine is too old for NLA | Update the RDS engine to 12.3.31 or later. |
| The running RDS authentication service is too old for NLA | Update the authentication service to 1.10.0 or later. |
| Not joined to a domain | Join the domain. |
| The keytab of the bastion is missing or invalid | Join the domain again, or renew the keytab. |
| The NLA port is the port of the main RDS proxy listener | Choose another port. |
| The listening interface has no IPv4 address | Check the interface, or leave the field empty. |
| The NLA instance failed to start | Read the RDS engine log. |
A short outage of a domain controller or of the settings database does not stop the listener.
The bastion keeps the current state until the information can be confirmed.
Access events
A sign-in through NLA appears in the access events as "Authenticated by Kerberos (NLA)".
Two refusal reasons are specific to this listener.
- nla_untrusted: the engine reported an NLA sign-in, but the NLA state of the bastion was not active.
The session is refused. - nla_realm_unknown: the Kerberos identity belongs to a domain other than the one the bastion is joined to.
The other reasons are the same as on port 3389, for example a user outside the authorized groups or a wrong MFA code.
Leave the domain
Leave the domain turns the NLA listener off and removes the keytab.
Give an administrator account to also delete the computer account from Active Directory.
This action stays available without a license.
REST API
| Method | Path | Use |
|---|---|---|
| GET | /rdpproxy/nla |
NLA state. Add ?checks=1 to run the health checks. |
| POST | /rdpproxy/nla/join |
Join the domain. Body: domain, admin, password, dns_name, optional computer. |
| POST | /rdpproxy/nla/settings |
Body: enabled, port, listen, sources. A missing field keeps its value. |
| POST | /rdpproxy/nla/renew |
Renew the keytab. The password of the computer account changes at once. |
| POST | /rdpproxy/nla/leave |
Leave the domain. Optional body: admin, password. |
An unreachable domain controller returns HTTP 503 with the code kdc_unreachable.
A refused operation returns HTTP 400 with the code refused.
Without a license, the join, settings and renew routes return HTTP 403.
Limits
- Kerberos only.
The engine does not support NTLM for NLA on the user side. - One Active Directory domain: the one the bastion is joined to.
- IPv4 only.
- The bastion still connects to the targets with its own NLA settings, set per target.
Targets declared by IP address use NTLM.
Microsoft has announced that NTLM will be disabled by default in a future major release of Windows.
Declare the targets by DNS name to prepare for it.