Okta Advanced Server Access Remote Desktop Protocol Fails With "Hybrid Required By Server" Error

Okta generates a HYBRID_REQUIRED_BY_SERVER error when attempting to use the Remote Desktop Protocol (RDP) with traffic forwarded through the Okta Advanced Server Access (ASA) Gateway using the Active Directory (AD) joined feature. This occurs because the target server requires Network-Level Authentication (NLA), which is incompatible with the ASA AD-joined feature. Resolve this issue by disabling NLA on the target server via a Group Policy Object (GPO). When attempting to connect, the RDP client briefly opens to a black screen before closing. Enable verbose RDP logging on the Gateway using the Configure the Advanced Server Access gateway documentation to view the following errors in the ASA Gateway logs:

Sep 19 10:38:06 asagw sft-gatewayd[254598]: 2023-09-19T10:38:06.821-0500#011INFO#011[SessionID=3494B42A999289AB31D5A34D0C8E2AFA]: connecting using client info: Username: user@example.com, Domain: (null)#011{"peerchild": "gatewayd-agent", "T": "2023-09-19T10:38:06.821-0500", "source": "rdp_internal"}

Sep 19 10:38:11 asagw sft-gatewayd[254598]: 2023-09-19T10:38:11.829-0500#011ERROR#011[SessionID=3494B42A999289AB31D5A34D0C8E2AFA]: failed to connect with NLA. retrying to connect without NLA#011{"peerchild": "gatewayd-agent", "T": "2023-09-19T10:38:11.828-0500", "source": "rdp_internal"}

Sep 19 10:38:11 asagw sft-gatewayd[254598]: 2023-09-19T10:38:11.841-0500#011WARN#011Error: HYBRID_REQUIRED_BY_SERVER#011{"peerchild": "gatewayd-agent", "source": "rdp_internal", "T": "2023-09-19T10:38:11.840-0500"}

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Advanced Server Access (ASA)
• Active Directory (AD) Joined

The target server requires Network-Level Authentication (NLA), which is incompatible with the Okta Advanced Server Access (ASA) Active Directory (AD) joined feature.

How is the hybrid required by server error resolved?

Disable Network-Level Authentication (NLA) on the target server via a Group Policy Object (GPO) by following the group policy configuration documentation.

1. Consult with the Windows administrators before making changes to ensure there are no further environmental implications.
2. Disable NLA on the target server via GPO as detailed in step two of the Configure group policies documentation.