title: Using Kerberos for RDP
body: <p>We are in the process of turning off NTLM in our environment for both inbound and outbound traffic via GPO. In our lab testing we have encountered the following when blocking inbound NTLM on a remote host:</p>
  <ol>
  <li>RDP'ing to the remote host with inbound NTLM blocked via cross-forest generated a CredSSP error message.</li>
  <li>Setting Encryption Oracle Remediation to either Mitigated or Vulnerable as a workaround did not work.</li>
  <li>Turning off NLA on the remote host as a workaround will allow cross-forest RDP</li>
  <li>I have tried applying &quot;Allow delegating fresh credentials&quot; via policy on the remote host but it  is still getting the CredSSP error</li>
  <li>I have also tried setting the policy on the remote host to use SSL for &quot;Require use of specific security layer for remote (RDP) connections&quot;, and I still got the same CredSSP error.</li>
  <li>What did work is if I try to RDP from the same forest to the remote host, it will allow the connection and I can confirm it is using Kerberos for RDP instead of NTLM.</li>
  <li>Another observation is once the same forest RDP worked on the remote host, cross-forest RDP connection on the remote host with the blocked inbound NTLM will now work.</li>
  </ol>
  <p>Has anyone encountered something similar like this before?
  If so, has anyone found a solution for cross-forest RDP to work on a remote host with blocked inbound NTLM without the need to pre-auth on the remote host in the same forest?</p>