Rdp Nla Ntlm Auth

Matches RDP sessions where the authentication method is Network Level Authentication (NLA) using NTLM. This occurs during the CredSSP security negotiation phase when the client performs NTLM challenge–response authentication before a remote desktop session is established. Indicates the client selected NLA with NTLM as the credential exchange mechanism rather than legacy plaintext RDP authentication.