RDP "An authentication error has occurred": CredSSP encryption oracle and other causes
Fix Remote Desktop "An authentication error has occurred" and "CredSSP encryption oracle remediation": update both machines, check NLA, passwords, time and port 3389.
by OhSudo ··
Remote Desktop connects, and then stops with this:
An authentication error has occurred.The function requested is not supported
Remote computer: 203.0.113.40This could be due to CredSSP encryption oracle remediation.CredSSP is the protocol RDP uses to send your credentials to the server. In 2018, Microsoft fixed a vulnerability in it (CVE-2018-0886), and the fix made client and server check each other’s patch level. If one side is updated and the other isn’t, the updated side may refuse to talk. So the message usually means one of the two machines is missing updates.
The first line alone, with a different second line, has other causes. Read section 4 before changing anything.
- RDP clientupdatedsends credentials via
- CredSSPcompares patch levelslevels don't match(fails)
- Servernot updated(breaks here)
TL;DR
- Install Windows updates on both machines. That is the real fix.
- Can’t reach the server to update it? Use its console from your cloud provider or hypervisor.
- Only if you must connect first: temporarily lower the setting on the client (section 3), then put it back.
1. Which side is out of date?
The fix has three levels, set by the policy Encryption Oracle Remediation:
| Value | Name | Behaviour |
|---|---|---|
| 0 | Force Updated Clients | Only talks to updated machines |
| 1 | Mitigated | Refuses to connect to unpatched servers (the default after the update) |
| 2 | Vulnerable | Allows connections, exposed to the vulnerability |
The typical case is an updated client and a server that has missed its updates for years, and the same message also appears the other way round. Check what’s installed on each:
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5winver2. The real fix: update the machine that’s behind
Update through Windows Update on the out-of-date machine. If you can’t log in over RDP, you need another way in:
- the serial or web console of your cloud provider (AWS EC2 Serial Console, Azure Serial Console, and similar) or your hypervisor;
- PowerShell remoting, if it’s enabled:
Enter-PSSession -ComputerName server01; - the Azure route: Run Command on the VM.
3. Temporary workaround on the client
If you must get in to update the server, allow the connection from the client for as long as it takes.
With the Local Group Policy Editor (gpedit.msc, not in Home editions): Computer Configuration → Administrative Templates → System → Credentials Delegation → Encryption Oracle Remediation, set to Enabled and Vulnerable.
Or in an elevated PowerShell, in all editions:
$path = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters'New-Item -Path $path -Force | Out-NullSet-ItemProperty -Path $path -Name AllowEncryptionOracle -Value 2 -Type DWordThen update the server and undo this:
Remove-ItemProperty -Path $path -Name AllowEncryptionOracleWarning
Don’t leave it on Vulnerable. While it is, an attacker in the middle of the connection could take over the session and run commands on the server. It’s a key to get in once, not a fix.
4. The same first line, other causes
An authentication error has occurred has other second lines:
| You see | What it means | What to do |
|---|---|---|
The Local Security Authority cannot be contacted |
Often an expired password, or no domain controller can be reached | Change the password; with Network Level Authentication on, you can’t change it from the RDP login screen |
The logon attempt failed |
Wrong user or password, or the account has no RDP rights | Use DOMAIN\user, and check the Remote Desktop Users group |
There is a time and/or date difference between the client and server |
The clocks differ by too much for Kerberos | Fix the time: w32tm /resync |
The token supplied to the function is invalid |
A TLS or certificate problem on the server, or something in between | Check the server’s RDP certificate, and any proxy or gateway |
NLA (Network Level Authentication) asks for your credentials before a session opens, which protects the server, so leave it on. If you have an expired password and no other way in, turn it off for a moment from the console in System Properties → Remote, change the password, and turn it back on.
5. No connection at all
If you get Remote Desktop can't connect to the remote computer instead, the problem comes earlier. Test the port:
Test-NetConnection -ComputerName server01 -Port 3389TcpTestSucceeded : False means a firewall or a stopped service: see “Connection timed out” vs “Connection refused”. On the server, check that Remote Desktop is enabled, and:
Get-Service TermServiceGet-NetFirewallRule -DisplayGroup 'Remote Desktop' | Select-Object DisplayName, EnabledA connection that fails with only “An internal error has occurred” is a different problem, usually the server’s RDP certificate or the network.
Note
Don’t open 3389 to the whole internet. It’s one of the most attacked ports there is, as the Port Lookup notes. Reach RDP through a VPN or a Remote Desktop Gateway, or at least allow only your own address.
Found this useful? Share it.
Found a mistake? Let us know at contact@ohsudo.com.