Remote Desktop Connection Error: CredSSP encryption oracle remediation

fixwindows

“You can change this registry parameter on multiple computers in AD using domain GPO (gpmc.msc console) or with a PowerShell script (you can obtain a list of computers in the domain using the Get-ADComputer cmdlet from the RSAT-AD-PowerShell module):

1. PowerShell using the RSAT-AD-PowerShell module:

   First, make sure you have the RSAT-AD-PowerShell module installed. If it’s not installed, run the following command:

   Install-WindowsFeature RSAT-AD-PowerShell


After that, you can use the following PowerShell script to change the parameter on multiple computers in the domain:

1. # Get a list of computers in the domain
   $computers = Get-ADComputer -Filter *

   # Iterate through each computer and make changes to the registry
foreach ($computer in $computers) {
# Set the registry parameter value on the computer
Invoke-Command -ComputerName $computer.Name -ScriptBlock {
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" -Name "AllowEncryptionOracle" -Value 2
}
}


2. Group Policy through gpmc.msc:
   • Open the Group Policy Management Console on a domain controller or another computer with RSAT Tools installed.
   • Create a new GPO or use an existing one that you want to configure.
   • Inside the GPO, navigate to Computer Configuration -> Preferences -> Windows Settings -> Registry.
   • Create a new registry entry (New -> Registry Item).
   • Configure this registry entry to set the parameter value on computers in your domain.

   After configuring the GPO, ensure that it is applied to the desired computers and perform a Group Policy update on client computers.”

This should help you apply the necessary changes to multiple computers in your domain to address the issue mentioned earlier.

After successfully connecting to a remote RDP server (computer), you need to install the latest security updates on it via the Windows Update service (make sure the service is enabled) or manually. Download and install the latest cumulative Windows updates as shown above. If you encounter the error “This update is not applicable to your computer” during the installation of an MSU update, please refer to the article at the provided link.

For Windows XP/Windows Server 2003, which are no longer supported, you should install updates for Windows Embedded POSReady 2009. For example, https://support.microsoft.com/en-us/help/4056564.

After installing updates and restarting the server, don’t forget to disable the policy on clients (or set it to “Force Updated Clients”), or set the registry key “AllowEncryptionOracle” to 0. In this case, your computer will not be at risk of connecting to unprotected hosts with CredSSP and exploiting the vulnerability.

There is another scenario where updates are missing on your computer. For instance, the RDP server is updated, but it has a policy that blocks RDP connections from computers with a vulnerable version of CredSSP (Force Updated Clients). In this case, when attempting an RDP connection, you will also see the error “This could be due to CredSSP encryption oracle remediation.”

Check the last installation date of Windows updates on your computer using the PSWindowsUpdate module or through a WMI command in the PowerShell console:

In this example, you can see that the latest Windows security updates were installed on June 17, 2018.

This article incorporates information and material from various online sources. We acknowledge and appreciate the work of all original authors, publishers, and websites. While every effort has been made to appropriately credit the source material, any unintentional oversight or omission does not constitute a copyright infringement. All trademarks, logos, and images mentioned are the property of their respective owners. If you believe that any content used in this article infringes upon your copyright, please contact us immediately for review and prompt action.

This article is intended for informational and educational purposes only and does not infringe on the rights of the copyright owners. If any copyrighted material has been used without proper credit or in violation of copyright laws, it is unintentional and we will rectify it promptly upon notification. Please note that the republishing, redistribution, or reproduction of part or all of the contents in any form is prohibited without express written permission from the author and website owner. For permissions or further inquiries, please contact us.