Unable to connect by RDP (CredSSP Authentication Issue)

Question

Hi all,

I hope anyone of you can help me out. I'm in trouble with a virtual machine after applying GPOs on it.

It says:

• "Authentication Error"
• "The cause could be a CredSSP Encryption Oracle defense"

https://support.microsoft.com/en-us/topic/credssp-updates-for-cve-2018-0886-5cbf9e5f-dc6d-744f-9e97-7ba400d6d3ea

I believe that the Error message is false positive as the GPO for CredSSP is not configured, also the registry key mentioned in the documentation is not existing.

I'm really out of ideas. 😑

It's a Windows 10 VM hosted at Azure. Neither RDP or AVD is working.

Best regards,

Philipp

Answer 1

Hello,

If the policy is not present, then it could be that the VM can't communicate due to having a set restriction in place after applying other GPO. If that is the cause, then you would have to configure it so it accepts communication.

If you follow the Interoperability matrix on the link you share, you can check if any of the "Blocked" scenarios is the one you have. Also, search the System Event Logs for EventID 6041, to confirm if it's really the CredSSP or a false positive as you suspect. You ca pair that with the corresponding RDP event to confirm your scenario.

If it was only a false positive, you would be able to connect despite the message. Check the different combinations of connection blocked scenarios to find how to solve the block.

Answer 2

Hello,

Actually, it is quite complex, and it would be beneficial for you to have a thorough understanding of the negotiation process between the server and the client.

I would recommend updating both your server and client to the latest version. Additionally, it would be helpful to configure your registry in the client.

You can type this command in cmd :

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters /v AllowEncryptionOracle /t REG_DWORD /d 2 /f