CredSSP Encryption Oracle Remediation Error: How to Fix RDP

Fixing the CredSSP Connection Error

If you try to reach a Windows Server over Remote Desktop (RDP) and get this message, you are in the right place:

An authentication error has occurred.
The function requested is not supported.

This could be due to CredSSP encryption oracle remediation.
For more information, see https://go.microsoft.com/fwlink/?linkid=866660

The error usually appears right after a Windows update and is one of the most common issues remote desktop server users run into. Below are three ways to fix it.

Why Does This Happen?

CredSSP (Credential Security Support Provider) is the security protocol RDP uses for authentication. Microsoft shipped an update to close the CVE-2018-0886 vulnerability, and that update changed which combinations are allowed to talk to each other.

After the patch:

The most common scenario by far: your workstation got updated and the server did not.

Fix 1: Group Policy (Recommended Temporary Fix)

This one is applied on your local machine, the client side.

Step by Step

1. Press Win + R
2. Type gpedit.msc and press Enter
3. Navigate to:

Computer Configuration
  → Administrative Templates
    → System
      → Credentials Delegation
        → Encryption Oracle Remediation

4. Double click the Encryption Oracle Remediation policy
5. Set it to Enabled
6. In the Protection Level dropdown, select Vulnerable
7. Click Apply, then OK

Result

Your RDP connection will work again. Keep in mind this is a temporary workaround. Once the server is patched, you should reverse it.

Fix 2: The Registry

On Windows editions without gpedit.msc, such as Home, use the registry instead.

Manual Method

1. Win + R → type regedit and press Enter
2. Navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters

3. If the path does not exist, create it:
   • Create the CredSSP key
   • Create a Parameters key inside it
4. Inside Parameters, create a new DWORD (32-bit) value:
   • Name: AllowEncryptionOracle
   • Value: 2

With PowerShell (Faster)

# Create the registry keys and set the value
New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP" -Force
New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" -Force
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" -Name "AllowEncryptionOracle" -Value 2 -PropertyType DWord -Force

With CMD

REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" /v AllowEncryptionOracle /t REG_DWORD /d 2 /f

What the AllowEncryptionOracle Values Mean

Fix 3: Update the Server (The Permanent Fix) ✅

The correct long term answer is to patch Windows on the server itself.

Reaching the Server When RDP Is Down

If you cannot get in over RDP, try these instead:

1. VDS control panel: use VNC or console access from the White Bilişim customer panel
2. PowerShell Remoting: connect over WinRM

# Open a PowerShell session on the remote server
Enter-PSSession -ComputerName SERVER_IP -Credential Administrator

Running Windows Update

Once you are on the server:

# Start the Windows Update service
Start-Service wuauserv
 
# Check for updates and install them
Install-Module PSWindowsUpdate -Force
Get-WindowsUpdate
Install-WindowsUpdate -AcceptAll -AutoReboot

Manual Update

1. Open the Microsoft Update Catalog on the server
2. Search for the CredSSP update matching your OS version
3. Download and install it
4. Reboot the server

The Recommended Order of Operations

1. First: apply Fix 1 or Fix 2 on the client for temporary access
2. Then: connect to the server over RDP
3. Next: run Windows Update on the server
4. Finally: revert the temporary client side change

Reverting the Workaround

# Remove the registry value
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" -Name "AllowEncryptionOracle" -Force

Or set the Group Policy back to Not Configured.

Frequently Asked Questions

Will I hit this error after every update?

Not if both machines are patched regularly. The problem only appears when one side is current and the other is behind.

Is setting it to Vulnerable dangerous?

Yes, which is why it should only ever be temporary. That setting leaves you exposed to the CredSSP vulnerability. Revert it as soon as the server is patched.

I connect from Linux, will I see this?

No. This error is specific to the Windows RDP client. Linux clients such as Remmina and FreeRDP are not affected.

💡 Every White Bilişim VDS comes with full administrator access, so you can run Windows Update and any other configuration yourself. Our support team is available 24/7 if you get stuck.

Conclusion

The CredSSP error is almost always an update mismatch and takes a couple of minutes to resolve. Patching the server is the fix that actually holds.

👉 For Windows Server workloads, look at Xeon Enterprise VDS or Ryzen Premium VDS, both backed by 24/7 technical support.