We have an environment where we use smartcards to log in to remote resources. It works just fine when we try to remote desktop from a machine that is domain joined, but does not work at our homes or on personal machines brought to work.
Things start working from home when we disable NLA though... but we would like to use NLA for an extra layer of security. OR if we leave NLA on, but only use a username and password it works (but again, we want to use smartcards for the extra layer of security with multifactor blah blah blah).
Stuff I have tried that has not worked:
Installing the internal Domain CA's certs to the off-domain machine and user cert store.
Issuing a "real" certificate from a major 3rd party CA and configuring RDS to use this certificate.
Tweaked some certificate properties, tested CRL paths off-location, anything I could find on BI-NGLE that was related... (shot-in-the-dark methods).
Any ideas out there that I have missed?