Terminal Services Doesn&#x27

Tenable plugin 58453 flags Windows Remote Desktop / Terminal Services hosts that do not require Network Level Authentication (NLA). In practice, that means systems with RDP enabled where UserAuthentication=0 on HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp, regardless of Windows version, can complete more of the RDP session setup before the user is authenticated.

Tenable's MEDIUM label is understandable as a security-control gap, but for enterprise patch prioritization the reality is lower. This is not memory corruption, auth bypass, or code execution by itself; it is a misconfiguration that increases pre-auth exposure and weakens RDP posture. Unless the host is internet-reachable on 3389 or sits behind a weak remote-access design, this should be treated as LOW backlog hygiene, not emergency patch work.

Why this verdict

• Not a software exploit: plugin 58453 reports a missing control, not RCE, auth bypass, or privilege escalation. That alone pushes the score down from Tenable's baseline.
• Requires attacker position first: the attacker needs network reachability to RDP. In real enterprises that usually implies VPN access, internal foothold, or a specifically exposed admin service — all of which narrow reachable population.
• Still needs a second win: absent NLA does not authenticate the attacker. They still need valid credentials, password spray success, or some other RDP weakness, and modern controls like RD Gateway, MFA, account lockout, and EDR commonly break that chain.

Why not higher?

This is not equivalent to BlueKeep-style pre-auth code execution. The blast radius is heavily gated by whether RDP is reachable at all and whether the environment allows direct password-based RDP without stronger controls. In most mature enterprises, those prerequisites are exactly where the chain dies.

Why not lower?

It is still a real security regression. Disabling NLA expands pre-auth attack surface, weakens server-authentication posture, and makes exposed RDP easier to abuse or chain with credential attacks. On externally reachable RDP systems, this finding deserves manual escalation even if the default portfolio score stays LOW.

1. Enforce NLA by policy — Set the Windows policy to require NLA for all managed RDP endpoints and verify UserAuthentication=1. Because the reassessed verdict is LOW, there is no SLA — treat this as backlog hygiene unless the host is internet-facing, in which case accelerate outside the baseline rating.
2. Remove direct RDP exposure — Push remote administration behind RD Gateway, VPN, or ZTNA so the attacker cannot reach raw 3389 from untrusted networks. For a LOW verdict there is no SLA, but internet-exposed exceptions should be corrected immediately as an architectural defect.
3. Require MFA at the entry point — Where RDP is still needed, put MFA on RD Gateway or the remote-access control plane so credential theft or spraying does not turn this misconfiguration into an incident. Baseline timing is backlog hygiene because LOW carries no SLA.
4. Monitor type 10 logons and failed RDP auth — Alert on Windows 4624 logon type 10, 4625 failures, lockouts, and unusual RDP session creation so exposed exceptions are watched even before reconfiguration is complete. For LOW, this is hygiene work rather than an SLA-bound mitigation.

Run this on the target Windows host or via your endpoint management tool with local administrator or equivalent registry-read rights. Save as Test-RdpNla.ps1 and run powershell -ExecutionPolicy Bypass -File .\Test-RdpNla.ps1; it prints VULNERABLE, PATCHED, or UNKNOWN and returns exit code 1, 0, or 2.

# Test-RdpNla.ps1

# Checks whether Windows RDP requires Network Level Authentication (NLA).

# Exit codes:

#   0 = PATCHED   (NLA required)

#   1 = VULNERABLE (NLA not required)

#   2 = UNKNOWN   (cannot determine / RDP not installed / access issue)


$ErrorActionPreference = 'Stop'
$regPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp'

try {
    if (-not (Test-Path $regPath)) {
        Write-Output 'UNKNOWN - RDP-Tcp registry path not found'
        exit 2
    }

    $props = Get-ItemProperty -Path $regPath

    if ($null -eq $props.UserAuthentication) {
        Write-Output 'UNKNOWN - UserAuthentication value missing'
        exit 2
    }

    $userAuth = [int]$props.UserAuthentication
    $securityLayer = if ($null -ne $props.SecurityLayer) { [int]$props.SecurityLayer } else { -1 }
    $portNumber = if ($null -ne $props.PortNumber) { [int]$props.PortNumber } else { 3389 }

    if ($userAuth -eq 1) {
        Write-Output ("PATCHED - NLA required (UserAuthentication=1, SecurityLayer={0}, Port={1})" -f $securityLayer, $portNumber)
        exit 0
    }
    elseif ($userAuth -eq 0) {
        Write-Output ("VULNERABLE - NLA not required (UserAuthentication=0, SecurityLayer={0}, Port={1})" -f $securityLayer, $portNumber)
        exit 1
    }
    else {
        Write-Output ("UNKNOWN - Unexpected UserAuthentication value: {0}" -f $userAuth)
        exit 2
    }
}
catch {
    Write-Output ('UNKNOWN - ' + $_.Exception.Message)
    exit 2
}

Sources

1. Tenable Nessus Plugin 58453
2. Microsoft Learn - Enable Remote Desktop on your PC
3. Microsoft Learn - UserAuthentication setting for RDP
4. Microsoft Learn - RemoteDesktopServices Policy CSP
5. Microsoft Support - CredSSP updates for CVE-2018-0886
6. Microsoft Learn - Remote Desktop Services overview
7. Microsoft Learn - Remote Credential Guard
8. Microsoft Learn - Troubleshoot authentication errors when you use RDP to connect to Azure VM