What is NLA? (network level authentication)
NLA stands for network level authentication, an RDP setting that requires the connecting user to authenticate before a desktop session is created. Without NLA, anyone who can reach the port gets a full login screen and consumes a session while trying passwords; with it, invalid credentials are rejected up front and several historical RDP vulnerabilities became unexploitable.
Why you leave it on
It is on by default on anything modern, and the only legitimate reasons to disable it (ancient clients, some password-expiry edge cases) are almost never worth it. Note what NLA does not do: it does not make exposing RDP to the internet safe, since attackers with a password list authenticate just fine. It reduces the attack surface; it does not remove the login prompt from the internet.
Related terms: MFA, zero trust.