Fix CredSSP Encryption Oracle Remediation Error in RDP

The credssp encryption oracle remediation error in RDP means the client and remote Windows computer do not agree on the security level allowed for CredSSP. Update and restart both systems first; if you cannot update the remote computer immediately, use the temporary workaround below and revert it as soon as the connection works.

If you need a Windows RDP environment with full Administrator access, a private KVM VM, and browser-based console, VPSLake’s Buffalo Windows RDP 4 GB plan includes those controls. VPSLake supplies the Windows image and you bring your own Windows licence; the console is useful when an RDP client cannot connect and the server needs a restart.

What the CredSSP error means

CredSSP is the Windows security provider used by Remote Desktop to authenticate and protect the session. Microsoft changed its behavior after fixing CVE-2018-0886, an encryption-oracle vulnerability that could allow an attacker to relay or alter authentication traffic.

The familiar message is usually similar to this:

An authentication error has occurred. The function requested is not supported. This could be due to CredSSP encryption oracle remediation.

The problem is normally a mismatch: one computer has the CredSSP security update while the other is missing it, or a local or domain policy blocks the connection. Microsoft documents the update history and policy behavior in its CredSSP update overview and its RDP troubleshooting article.

Do not treat the message as a reason to disable Network Level Authentication or leave the policy at Vulnerable. Those changes reduce protection and do not fix the underlying patch mismatch.

Before you start

You need administrator access to both ends of the connection:

• The client is the computer running Remote Desktop Connection (mstsc.exe).
• The server is the Windows PC or VPS you are trying to reach.
• Both computers need a way to restart after updates. If RDP is unavailable, use a local login, a hypervisor console, or your provider’s browser console.
• Save open work before installing updates or changing the policy.

If the error is part of a broader connection problem, first follow the steps in how to connect to a Windows VPS using RDP. The steps below focus specifically on CredSSP.

Step 1: Confirm which computers are involved

Knowing the client and server prevents you from changing a policy on the wrong machine.

1. On the computer where you started the RDP connection, press Win + R, enter winver, and note the Windows edition and version.
2. Identify the remote computer’s Windows version from its console or from whoever manages it. Windows 10, Windows 11, and Windows Server installations can all be affected.
3. Check Settings > Windows Update > Update history on Windows client editions. On Windows Server, use the configured Windows Update, WSUS, or management tool used by your organization.
4. Look for pending security or quality updates on both computers. Do not assume that updating only the computer in front of you is enough.

Success looks like a clear update path for both sides. If you do not control the remote server, ask its administrator to update it rather than changing your own security policy permanently.

Step 2: Update and restart both computers

This is the recommended fix because it lets CredSSP use the protected protocol on both ends.

1. Install all available Windows security and quality updates on the RDP client.
2. Restart the client if Windows requests it.
3. Use the server’s console or its normal update management process to install its pending updates.
4. Restart the server, even if the update screen does not make the restart feel urgent.
5. After both restarts finish, try the RDP connection again.

On a Windows client, you can open Windows Update from PowerShell with:

Start-Process "ms-settings:windowsupdate"

For a server without a usable desktop session, use the server console or your organization’s approved update tooling. Avoid downloading random standalone packages from third-party sites. Microsoft’s CVE-2018-0886 security advisory is the authoritative reference for the vulnerability and affected products.

To inspect the CredSSP support file after an update, run this on each Windows computer in an elevated PowerShell window:

Get-Item "$env:windir\System32\TSpkg.dll" |
  Select-Object -ExpandProperty VersionInfo |
  Format-List FileVersion, ProductVersion

The exact version depends on the Windows release and cumulative updates. The useful check is that both computers have been updated through their normal supported servicing path and restarted; do not compare an old KB number from a different Windows release as if it were universal.

Step 3: Use a temporary workaround only when necessary

Use this step only when the remote computer cannot be updated yet and you need short-term access to complete the repair. The Vulnerable setting allows fallback to an insecure CredSSP version, so it exposes the connection to the risk the security update was designed to prevent.

Group Policy method

On the updated RDP client:

1. Press Win + R, type gpedit.msc, and press Enter.
2. Open Computer Configuration > Administrative Templates > System > Credentials Delegation.
3. Double-click Encryption Oracle Remediation.
4. Select Enabled.
5. Set Protection Level to Vulnerable.
6. Select Apply, then OK.
7. Open an elevated Command Prompt and run:

gpupdate /force

1. Restart the client and try the RDP connection once.

This is the common case documented by Microsoft: an updated client is trying to connect to a server that has not received the CredSSP update. If the setting is controlled by a domain policy, a local change may be overwritten; contact the administrator instead of repeatedly changing local policy.

Registry method

Use this only if Group Policy Editor is unavailable. Open Command Prompt as administrator on the affected client and run:

reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" /v AllowEncryptionOracle /t REG_DWORD /d 2 /f

Restart the computer before testing RDP. The value 2 corresponds to Vulnerable. Do not leave this value in place after the remote system has been updated.

Step 4: Revert the workaround

Reverting the setting closes the insecure fallback path after both ends are patched.

If you used Group Policy, return to Encryption Oracle Remediation, select Enabled, and set Protection Level to Mitigated while you still have any older managed systems. Once every remote host and client is updated, Force Updated Clients provides the strictest compatibility setting. Apply the change, run gpupdate /force, and restart the computer.

If you used the registry command, replace the value with the safer setting:

reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" /v AllowEncryptionOracle /t REG_DWORD /d 1 /f

The value 1 is Mitigated. Restart after changing it. If a domain policy manages this setting, make the change in the domain policy or the local value may not persist.

Verify the fix

Use this short check after the restart:

1. Start Remote Desktop Connection and enter the server name or IP address.
2. Confirm that the same Windows account and credentials work.
3. Check that the CredSSP message is gone and the session reaches the Windows sign-in screen.
4. On the client, open gpedit.msc and confirm the policy is Mitigated or Force Updated Clients, not Vulnerable.
5. If you changed the registry, verify the value with:

reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" /v AllowEncryptionOracle

Both sides being patched, restarted, and on a non-Vulnerable setting is the desired end state.

Troubleshooting when the error remains

If updating both computers did not solve the connection, check these points in order:

• One side was not really restarted. A completed download is not the same as an installed update. Restart the client and server and test again.
• A domain policy overrides the local setting. Run gpresult /h "%USERPROFILE%\Desktop\gp-report.html" from an elevated Command Prompt and inspect the resulting report for CredSSP or Credentials Delegation policies.
• The wrong computer was changed. The usual workaround belongs on the updated client that initiates RDP, not automatically on every server.
• A server is still on an older patch level. Use its console or ask the administrator to update it. Do not make every client Vulnerable just to accommodate one unpatched machine.
• The message changed. If you now see an internal error, account lockout, credentials error, or a network timeout, follow the relevant checks in our Windows RDP internal error guide. Those are different failure paths.

Do not disable Network Level Authentication as a first response. It changes the authentication boundary and can hide the actual CredSSP servicing problem rather than repairing it.

FAQ

What causes the CredSSP encryption oracle remediation error?

It usually occurs when the RDP client and server have different CredSSP update levels or incompatible Encryption Oracle Remediation policies. The updated side blocks an insecure connection to protect against CVE-2018-0886.

Is it safe to set Encryption Oracle Remediation to Vulnerable?

No. Vulnerable permits fallback to an insecure CredSSP version and should be used only as a short-lived emergency workaround while the other computer is updated. Restore Mitigated or Force Updated Clients immediately afterward.

Do I need to update both the RDP client and the server?

Yes. Microsoft’s recommended resolution is to install the CredSSP updates on both ends and restart them. Updating only your laptop or only the VPS can leave the protocol mismatch in place.

How do I fix CredSSP when RDP cannot connect at all?

Use a local login, hypervisor console, or provider browser console to update and restart the server. If you control only the client, contact the server administrator; changing the client to Vulnerable is temporary access, not a server repair.

What does AllowEncryptionOracle value 0, 1, or 2 mean?

0 means Force Updated Clients, 1 means Mitigated, and 2 means Vulnerable. Use 1 while older managed peers remain, and use 0 after all clients and servers support the updated CredSSP behavior.

DONE fix-credssp-encryption-oracle-error words=1570