diff --git a/xmpp_agent_core.py b/xmpp_agent_core.py
index 056e411..53a2f8d 100644
--- a/xmpp_agent_core.py
+++ b/xmpp_agent_core.py
@@ -334,7 +334,8 @@ def _rdp_enable_run():
         _rdp_log(name, status, detail)
 
     try:
-        # Step 1: 开注册表
+        # Step 1: 开注册表（开RDP + 隧道场景统一关NLA——SSH已加密，NLA的CredSSP预认证
+        # 正是"卡正在配置远程电脑"的根源：连接到达TermService但NLA协商挂起、建不了会话）
         try:
             k = _wr.OpenKey(_wr.HKEY_LOCAL_MACHINE, r'SYSTEM\CurrentControlSet\Control\Terminal Server', 0, _wr.KEY_SET_VALUE)
             _wr.SetValueEx(k, 'fDenyTSConnections', 0, _wr.REG_DWORD, 0)
@@ -342,6 +343,13 @@ def _rdp_enable_run():
             mark('registry', 'ok', 'fDenyTSConnections=0')
         except Exception as e:
             mark('registry', 'fail', str(e))
+        try:
+            k2 = _wr.OpenKey(_wr.HKEY_LOCAL_MACHINE, r'SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp', 0, _wr.KEY_SET_VALUE)
+            _wr.SetValueEx(k2, 'UserAuthentication', 0, _wr.REG_DWORD, 0)
+            _wr.CloseKey(k2)
+            mark('registry', 'ok', 'NLA已关闭(UserAuthentication=0，隧道场景)')
+        except Exception as e:
+            mark('registry', 'warn', '关NLA失败: ' + str(e))
 
         # Step 2: 加入 RDP 用户组
         try: