Remote Desktop Enabled
Whether inbound RDP is on, whether NLA is required, and the listening port.
Use it to tell whether a host accepts RDP, whether it requires NLA, and whether the port changed.
- SYSTEM
- Defence Evasion
What It Is
Remote Desktop lets a user work on this machine from another computer over the Remote Desktop Protocol (RDP). This key, in the SYSTEM hive, holds its settings, and fDenyTSConnections says whether the machine accepts Remote Desktop connections, which it denies by default. Its WinStationsRDP-Tcp subkey holds PortNumber, the network port Remote Desktop listens on, which is 3389 by default. UserAuthentication there says whether Network Level Authentication (NLA) is required, which makes a user prove who they are before the remote session is set up.
What It Proves
fDenyTSConnections set to 0 lets the host accept inbound RDP. UserAuthentication 0 drops the Network Level Authentication requirement, and a non-standard PortNumber moves the listener off 3389.
What It Does Not Prove
The settings show the host will accept RDP, not that anyone connected. Many servers enable RDP on purpose, so read these with the logon history.
Where It Lives
Remote Desktop Enabled lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| Inbound RDP is enabled. On a host that should not accept RDP, check who enabled it. Then review type 10 logons in event 4624 in the Security log, where Audit Logon is on. |
| NLA is not required, so connections are accepted before authentication. Set it to 1 and look for recent RDP connections. |
| The value is the standard RDP port. A non-standard value moves the listener off 3389, so check it against listening ports and firewall rules. |
How to Read It
Read fDenyTSConnections under Control\Terminal Server, where 1 means RDP is off. Read UserAuthentication and PortNumber under WinStations\RDP-Tcp, where 1 and 3389 are the secure defaults. To put it right, set fDenyTSConnections to 1 if RDP is not needed, require NLA, and check type 10 logons.
- When Windows Writes It
- When an administrator or an attacker with admin rights changes the setting.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper (termserv)
Hunt It
Defender records writes to the Terminal Server keys. fDenyTSConnections at 0 shows inbound RDP allowed, not that anyone connected. Check type 10 logons.
// RDP enabled, NLA dropped or port changedDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Remote Desktop Enabled shows.
- Firewall RulesShows whether the firewall lets RDP in, which the setting alone does not.
- RDP Logons, Security Event 4624 (Type 10)Not in the RegistryShows who actually connected over RDP, and when.
Sources
The facts on this page come from these public pages, which say more on each point.