Credssp windows 10 home

Ошибка CredSSP encryption oracle remediation при RDP подключении к рабочему столу удаленного компьютера указывает, что на удаленном хосте (скорее всего) или на вашем компьютере отсутствует обновление безопасности, которое исправляет критическую уязвимость в протоколе CredSSP.

Remote Desktop connection
An authentication error has occurred.
The function is not supported.
 Remote Computer: hostname
This could be due to CredSSP encryption oracle remediation.

Картинка с сайта: winitpro.ru

Подключение к удаленному рабочему столу
Произошла ошибка при проверке подлинности.
Указанная функция не поддерживается.
Причиной ошибки может быть исправление шифрования CredSSP.

Протокол Credential Security Support Provider (CredSSP), используются для пре-аутентификации пользователей, когда для RDP доступа включен протокол NLA (Network Level Authentication). Критическая уязвимость в протоколе CredSSP, позволяющая удаленно выполнить произвольный код в системе через открытый RDP порт, была обнаружена и исправлена в 2018 году (CVE-2018–0886 — CredSSP Remote Code Execution Vulnerability).

Если у вас такая ошибка, возможны два сценария:

• Ваш компьютер с установленным обновлением CredSSP блокирует подключение к непропатченному RDP хосту с уязвимой версией CredSSP. Это самый частый сценарий. Обычно вызван тем, что на удаленном RDP компьютере ОС развернута из старого дистрибутива (RTM версии Windows Server 2016/2012 R2/2008 R2, Windows 7, 8.1 или Windows 10 младше 1803).
• Пропатченный удаленный RDP (RDS) сервер блокирует подключение с необновлённого клиента. Обратный сценарий – когда на клиенте развернута старая версия Windows, а удаленный сервер переведен в принудительный режим блокирования уязвимых версий CredSSP

(Рекомендованный способ исправления ошибки подключения) – скачайте и установите последний накопительный пакет обновления безопасности для вашей версии Windows, выпущенный после мая 2018 года, на удаленный RDP хост (или на клиент, в зависимости от сценария). Проверьте последнюю дату установки обновлений Windows на компьютере с помощью модуля PSWindowsUpdate или через WMI команду в консоли PowerShell:

gwmi win32_quickfixengineering |sort installedon -desc

Картинка с сайта: winitpro.ru

Если обновления после 2018 года отсутствуют, вы можете скачать обновление вручную через Microsoft Update Catalog, или установить его через Windows Update или сервер обновлений WSUS.

Как временное решение (не рекомендуется использовать постоянно), можно разрешить клиенту подключаться к компьютерам с уязвимой версией RDP CredSSP.

1. Откройте редактор локальных групповых политик (
   gpedit.msc
   ) на клиентском компьютере (с которого вы выполняете RDP подключение);
2. Перейдите в раздел Computer Configuration -> Administrative Templates -> System -> Credentials Delegation (Конфигурация компьютера -> Административные шаблоны -> Система -> Передача учетных данных);
3. Включите политику Encryption Oracle Remediation (Исправление уязвимости шифрующего оракула), и измените ее значение на Vulnerable / Оставить уязвимость;
   

   Картинка с сайта: winitpro.ru

4. Обновите настройки политик на вашем компьютере (команда
   gpupdate /force
   )
5. Попробуйте подключится по RDP к удаленному компьютеру.

Если у вас отсутствует редактор локальных GPO (например, в Home редакциях Windows), можно разрешить подключение к хостам с непропатченной версия CredSSP с помощью команды:

REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters /v AllowEncryptionOracle /t REG_DWORD /d 2

Картинка с сайта: winitpro.ru

После успешного подключения к удаленному RDP компьютеру, нужно установить на нем актуальные обновления безопасности. После отключить политику Encryption Oracle Remediation на клиенте, или верните значение 0 для ключа реестра AllowEncryptionOracle.

REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters /v AllowEncryptionOracle /t REG_DWORD /d 0 /f

Some users abruptly confront CredSSP error after installing the latest patches of Windows 10 which repeatedly obstructs the Remote desktop connections. Before starting the solution part let’s see what is CredSSP. “Credential Security Support Provider Protocol” (in short CredSSP) is a security provider that helps to pass on user credentials securely from a client computer to a Windows server using the Transport Layer Security (viz TLS) as an encrypted pipe. Applications depending on CredSSP for their authentication might also be under the threat of this error. If you have installed an update on a vulnerable workstation and then made an attempt to connect to an unpatched server, the below-mentioned error message will float up after typing the password for connecting an RDP session – “An authentication error has occurred. The function requested is not supported. Remote computer: This could be due to CredSSP encryption oracle remediation”.

In the past, Microsoft gives users the ability to connect computers to Remote Desktop connection without updating them. However, with releasing the latest patches, Microsoft has maximized the security and you can no more connect to an RDP server without updating. CredSSP is in fact an authentication provider that helps in processing the authentication requests for various programs. The latest update has caused many people to suffer from CredSSP error nevertheless releasing a few security patches for resolving the same. However, we can fix the issue using some conventional workarounds to be discussed in this write up today. Let us begin with methods list –

CredSSP Error

Here is How to Fix CredSSP error during Remote Desktop or RDP in Windows 10 –

1] Change Group Policy Settings

With the latest update, Microsoft restricts the users from getting a connection to a computer that has not been updated yet in order to maintain security control. In the end, you may experience the CredSSP error during Remote Desktop or RDP in Windows 10. You can fix the issue either by updating to the latest patches to the other computer or downgrade the protection level to Vulnerable using Group Policy Editor. Here are the steps to follow for changing the group policy in the local computer –

1. Invoke the Run dialog pressing Windows key and R.
2. Type gpedit.msc in the text space.
3. Press Enter key and let Group Policy Editor window open.
4. In the left pane, navigate to the following path –

Computer Configuration => Administrative Templates => System => Credentials Delegation

1. Once reached to Credentials Delegation, jump to the corresponding right side.
2. Locate “Encryption Oracle Remediation” and make a double click on it to edit. This option should set to Not Configured by default.

1. Select the radio button set to Enabled.
2. Move ahead to the Options area and click the drop-down menu beside “Protection Level“.
3. Choose Vulnerable from the context.

1. Click Apply button first followed by hitting OK to save the settings.
2. Finally, Restart the computer to make the changes effective so that, CredSSP error doesn’t come up again.

2] Modify Windows Registry to fix CredSSP error

If you are using the Home Edition of Windows 10, Group Policy Editor will not be available since it doesn’t come by default. However, you can follow the ways to achieve the same – How to Activate Local Group Policy Editor / Gpedit.msc in Windows 10 Home. So in such situations, you can easily change the DWORD in Registry for the downgrading Protection Level. Here is how to perform this task –

1. Press Win+Q hotkeys at once to call Taskbar Search.
2. Type regedit in the empty text area and press Enter key. Click Yes when the UAC prompts for permission.
3. When you access Registry Editor, navigate to below path in the left pane –

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

1. Once reached System, right-click on it and choose Key. Name the new key as CredSSP.
2. Create another key under CredSSP using the above way and name it as Parameters.
3. Click Parameters and shift to adjacent right side pane.
4. Here, right-click on any empty space and select New => DWORD (32-bit) Value.
5. Name the new DWORD as AllowEncryptionOracle.
6. Double click AllowEncryptionOracle DWORD and insert the value data 2.
7. Leave the Registry Editor window and reboot Windows 10 for making the changes effective.

3] Tweak the Remote Desktop Settings

Readjusting Remote Desktop Settings can sometimes resolve CredSSP error in Windows 10 effectively. For that, follow the below instructions –

1. Load the Desktop area pressing Win+D hotkey together.
2. Right-click This PC icon and select Properties.
3. When the System window arrives in the display, click Advanced system settings link from the left pane.
4. In few seconds, System Properties wizard will float up, jump into its Remote tab.
5. Here clear off the checkmark from the box set for “Allow connections only from computers running Remote Desktop with Network Level Authentication (recommended)“.

1. Press the Apply button and then OK for saving the changes.
2. Finally, reboot the computer for the modifications to take place.

4] Remove the dreadful Update patches from the system

Credssp error during Remote Desktop or RDP in Windows 10 is associated with the KB4103727 patch. Therefore, you need to remove this to resolve the error easily. To uninstall an update patch, follow the below guidelines –

1. Invoke Run dialog, type appwiz.cpl, and hit Enter.
2. This will open Programs and Features window.
3. Click View installed updates from the left pane.
4. After a new page unveils, move out for the desired patch.
5. Right-click the same and select Uninstall option.
6. Click Yes for confirmation from the popup.

5] Perform System Restore and load the previous working state

As already mentioned above, Credssp error during Remote Desktop or RDP in Windows 10 occurs after installing the latest patches for the Operating System. There is an easy escape from this issue and that is to perform System Restore. The process allows Windows to load back the previous state where the OS was not experiencing the error. This is not actually a recommended resolution but can be the best alternative in case you fail to resolve it by any other means. Here are the steps to follow –

1. Click on the taskbar search icon and insert the command rstrui in it.
2. Press Enter key to access System Restore wizard.
3. Click Next button from the bottom to pass forward.
4. Choose the latest Restore Point from here. If you want to discover more, check the box that reads Show more points and select one where you opt to return back.
5. On the next window, click Finish to start the process.
6. Click Yes when a pop up floats up asking for your confirmation.

Methods:
1] Change Group Policy Settings
2] Modify Windows Registry Editor
3] Tweak the Remote Desktop Settings
4] Remove the dreadful Update patches from the system
5] Perform System Restore and load the previous working state

That’s all!!

FIX CredSSP Encryption Oracle Remediation Error in Windows 10 Home Edition

This is how you get rid of the CredSSP Encryption Oracle Remediation Error in Windows 10 Home Edition:

REG ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters\ /v AllowEncryptionOracle /t REG_DWORD /d 2