WindowsAdvanced

RDP CredSSP Error – Complete Fix for “CredSSP Encryption Oracle Remediation” in Windows 10, Windows 11 and Windows Server

Remote Desktop Protocol (RDP) is widely used by system administrators, IT support teams, cloud administrators and businesses to remotely access Windows compu...

Bison Technical Team Enterprise IT specialists

Updated 19 Aug 2026 16 min read 3 total views

Remote Desktop Protocol (RDP) is widely used by system administrators, IT support teams, cloud administrators and businesses to remotely access Windows computers and Windows Servers.

Sometimes an RDP connection that previously worked correctly suddenly stops and displays an error similar to:

An authentication error has occurred.
The function requested is not supported.
Remote computer: ServerName or IP Address
This could be due to CredSSP encryption oracle remediation.

This problem commonly appears when the RDP client and remote computer have different Windows security update levels or incompatible Credential Security Support Provider (CredSSP) security policies.

The error became particularly well known after Microsoft introduced security changes addressing CVE-2018-0886, a vulnerability involving CredSSP. Microsoft's documentation confirms that updated RDP clients can block connections to systems that don't meet the required CredSSP security level.

This article explains what CredSSP is, why the error occurs, how to diagnose it, temporary workarounds, permanent solutions and important security considerations.

1. What Is CredSSP?

CredSSP stands for:

Credential Security Support Provider

It is a Windows security protocol used to securely delegate user credentials from one computer to another.

CredSSP is used by several Microsoft technologies, including Remote Desktop.

A simplified RDP authentication process looks like:

RDP Client → CredSSP Authentication → Remote Windows Server → User Session

When Network Level Authentication (NLA) is enabled, authentication normally occurs before Windows creates the complete remote desktop session.

CredSSP therefore plays an important role in protecting credentials during remote authentication.

2. What Is the CredSSP Encryption Oracle Remediation Error?

Microsoft introduced changes to CredSSP after the discovery of CVE-2018-0886.

The vulnerability could potentially allow an attacker to relay credentials and execute code in certain circumstances.

Microsoft therefore modified how patched systems communicate with systems using older or less secure CredSSP implementations.

A common problem occurs when:

RDP Client = Updated

but:

Remote Server = Unpatched / outdated / incompatible policy

The updated client may refuse to establish the RDP connection.

The result is the familiar:

CredSSP Encryption Oracle Remediation

error.

3. Typical Error Message

You may receive:

An authentication error has occurred.

The function requested is not supported.

Remote computer: 192.168.1.100

This could be due to CredSSP encryption oracle remediation.

The remote computer may be shown as:

IP address
Computer name
Server hostname
Fully Qualified Domain Name (FQDN)

4. Most Common Causes

Several conditions can produce CredSSP-related RDP problems.

Cause 1 – Client Updated but Server Not Updated

This is one of the most common causes.

Example:

Windows 11 PC
Latest Updates
        ↓
RDP
        ↓
Old Windows Server
Missing Security Updates

The client refuses the connection because the server does not support the required CredSSP security level.

Cause 2 – Server Updated but Client Is Outdated

The opposite situation is also possible.

For example:

Old Windows 10 PC
Missing Updates
        ↓
RDP
        ↓
Updated Windows Server

Depending on the policies applied to the systems, authentication may fail.

Cause 3 – Encryption Oracle Remediation Group Policy

Windows contains the policy:

Computer Configuration
   ↓
Administrative Templates
   ↓
System
   ↓
Credentials Delegation
   ↓
Encryption Oracle Remediation

The configured protection level determines which CredSSP connections are permitted.

Cause 4 – Windows Update Mismatch

The problem sometimes starts immediately after:

Windows Update
Server security update
Client security update
VM template restoration
Old server deployment
Snapshot restoration
Windows reinstall

One computer may therefore have newer CredSSP components than the other.

Cause 5 – Old Windows Server

The problem is particularly likely when connecting newer Windows clients to legacy or poorly maintained servers.

Examples can include older installations of:

Windows Server 2008 R2
Windows Server 2012
Windows Server 2012 R2
Windows Server 2016

The important factor is not simply the Windows version—it is whether the operating system is supported, properly patched and configured.

5. CredSSP Protection Levels Explained

The Encryption Oracle Remediation policy has three important protection levels.

Force Updated Clients

This is the strictest configuration.

Clients and servers are expected to support the corrected CredSSP implementation.

Security:

Highest

Compatibility with old/unpatched systems:

Lowest

Mitigated

This is the normal secure compatibility-oriented setting associated with the CredSSP remediation.

It prevents CredSSP client applications from falling back to insecure versions.

Microsoft changed the default behavior to Mitigated through the 2018 updates.

Vulnerable

This setting permits fallback to insecure CredSSP behavior.

It can sometimes restore RDP connectivity to an outdated server.

However:

Vulnerable should be considered a temporary troubleshooting workaround—not the permanent solution.

Microsoft explicitly warns that allowing an insecure connection can expose the remote server to attacks.

6. Recommended Permanent Fix

The preferred solution is straightforward:

Update BOTH computers.

Update:

RDP Client

and:

Remote RDP Server

Then restart both computers where practical.

Microsoft's recommended resolution is to update and restart affected systems rather than permanently weakening CredSSP security settings.

7. Method 1 – Update the RDP Client

On the computer from which you are connecting:

Open:

Settings
→ Windows Update

Click:

Check for updates

Install available:

Security updates
Cumulative updates
Relevant servicing updates

Restart the computer.

Try RDP again.

8. Method 2 – Update the Remote Server

This is extremely important.

Possible methods include:

Physical console
Hyper-V console
VMware console
Cloud provider console
Virtual machine console
Out-of-band management
Existing administrative session

Then run Windows Update.

Install available security and cumulative updates.

Restart the server.

After restart, test RDP again.

9. Best Troubleshooting Sequence

Instead of immediately weakening security settings, use this sequence:

Step 1
Check Windows Updates on client

Step 2
Check Windows Updates on server

Step 3
Restart both systems

Step 4
Test RDP

Step 5
Check Encryption Oracle Remediation policy

Step 6
Check domain Group Policy

Step 7
Use temporary Vulnerable mode only if absolutely necessary

Step 8
Patch the server

Step 9
Return the policy to a secure configuration

10. Method 3 – Temporary Group Policy Workaround

If the remote server cannot immediately be updated and urgent access is required, a temporary workaround may be possible.

On the RDP client computer, press:

Windows + R

Enter:

gpedit.msc

Navigate to:

Computer Configuration
→ Administrative Templates
→ System
→ Credentials Delegation

Open:

Encryption Oracle Remediation

Select:

Enabled

Under Protection Level select:

Vulnerable

Click:

Apply
OK

Run:

gpupdate /force

Try the RDP connection again.

SECURITY WARNING

Do not leave this configuration enabled permanently merely because RDP starts working.

The Vulnerable setting deliberately allows less-secure CredSSP connections. Microsoft's documentation recommends this only as a workaround while affected systems are brought up to date.

11. Method 4 – Registry Fix

Windows editions without Local Group Policy Editor may require a registry modification.

Open:

Command Prompt as Administrator

Run:

REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" /v AllowEncryptionOracle /t REG_DWORD /d 2 /f

Then run:

gpupdate /force

Restart the computer if required and test RDP.

Microsoft documents the AllowEncryptionOracle value of 2 as the registry equivalent of allowing the Vulnerable configuration for this workaround.

12. Understanding AllowEncryptionOracle Values

The important values are:

Value	Configuration
0	Force Updated Clients
1	Mitigated
2	Vulnerable

Therefore:

AllowEncryptionOracle = 2

means:

Vulnerable

This provides greater compatibility but reduces security.

13. How to Remove the Temporary Registry Workaround

After updating the remote server, remove the temporary override.

Run Command Prompt as Administrator:

REG DELETE "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" /v AllowEncryptionOracle /f

Then:

gpupdate /force

Restart if necessary.

This is generally preferable to leaving the value permanently configured as 2.

14. Check the Registry Manually

Open:

regedit

Navigate to:

HKEY_LOCAL_MACHINE
\Software
\Microsoft
\Windows
\CurrentVersion
\Policies
\System
\CredSSP
\Parameters

Look for:

AllowEncryptionOracle

If it exists, check its value.

A value of:

indicates the Vulnerable workaround.

15. What If the CredSSP Registry Path Does Not Exist?

You may not see:

CredSSP

or:

Parameters

This is not automatically an error.

The keys can be created when the relevant policy is configured.

The REG ADD command shown earlier can create the required key/value structure automatically.

16. Windows Home and gpedit.msc

Some Windows editions, particularly Home editions, do not provide the standard Local Group Policy Editor.

Running:

gpedit.msc

may display:

Windows cannot find 'gpedit.msc'

In this situation, do not download random Group Policy installers from third-party websites merely to change this setting.

Use the documented registry method if a temporary workaround is genuinely required.

17. Check Windows Update History

If the problem appeared suddenly, compare update history on both systems.

Open:

Settings
→ Windows Update
→ Update history

Determine whether:

Client recently updated
Server has not updated
Server recently restored from snapshot
VM image is outdated
Server has pending restart
Updates failed

A pending restart can be particularly important because updated components may not be fully active until Windows restarts.

18. Check the Windows Versions

Run:

winver

on both systems.

You can also run:

systeminfo

Check:

OS Name
OS Version
Build
Installed hotfixes
System type

PowerShell can also provide useful information:

Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber

Compare the client and server patch condition.

19. Check RDP Connectivity Before Blaming CredSSP

Not every RDP problem is a CredSSP problem.

From the client, test whether the RDP port is reachable:

Test-NetConnection SERVER-IP -Port 3389

Example:

Test-NetConnection 192.168.1.100 -Port 3389

Look for:

TcpTestSucceeded : True

If it is False, investigate:

Windows Firewall
Router/firewall
VPN
Port forwarding
RDP service
Network route
Server availability

A CredSSP policy change will not repair a blocked TCP port.

20. Check Remote Desktop Services

On the server run:

services.msc

Locate:

Remote Desktop Services

The service should normally be running.

PowerShell:

Get-Service TermService

You can also check whether Windows is listening on RDP:

netstat -ano | findstr :3389

21. Check Network Level Authentication

Network Level Authentication provides an important additional security layer for RDP.

Check:

System Properties
→ Remote

Normally, NLA should remain enabled.

Microsoft documents disabling NLA as one possible temporary workaround in certain authentication scenarios, but also warns that weakening these RDP security policies reduces deployment security.

Therefore, disabling NLA should not be your first solution to a CredSSP error.

22. Temporary NLA Troubleshooting

If you have console access and need to determine whether NLA is involved, you can temporarily test without it.

Open:

System Properties
→ Remote

Review the option requiring Network Level Authentication.

If temporarily disabled and RDP suddenly works, you have identified an authentication/security compatibility issue.

After troubleshooting:

Enable NLA again.

23. Domain Environment Considerations

In Active Directory environments, changing Local Group Policy may not solve the problem.

A domain policy can override the local configuration.

Generate a policy report:

gpresult /h C:\gpresult.html

Open:

C:\gpresult.html

Search for:

Encryption Oracle Remediation

Also run:

gpresult /r

This helps identify which Group Policy Objects are being applied.

24. Force Group Policy Refresh

After modifying Group Policy:

gpupdate /force

Then retry RDP.

In some cases, restarting the computer is advisable.

25. PowerShell Registry Check

Run PowerShell as Administrator:

Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" -ErrorAction SilentlyContinue

If configured, look for:

AllowEncryptionOracle

26. PowerShell Temporary Workaround

If emergency compatibility is required:

New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP" -Name "Parameters" -Force

Then:

New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" -Name "AllowEncryptionOracle" -Value 2 -PropertyType DWORD -Force

Remember:

2 = Vulnerable

This should be temporary.

27. Verify the Setting

Run:

reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters"

You may see:

AllowEncryptionOracle    REG_DWORD    0x2

That confirms the Vulnerable workaround is active.

28. Why Setting Vulnerable Works

Suppose:

Windows 11 Client
Fully Patched

tries connecting to:

Old Windows Server
Missing CredSSP Security Updates

The client detects that secure CredSSP requirements cannot be satisfied.

It blocks the connection.

When you configure:

AllowEncryptionOracle = 2

you essentially tell the client to permit the less-secure CredSSP connection.

Connectivity may return, but the underlying security problem remains.

That is why patching the server is the proper solution.

29. Why You Should Not Permanently Keep Vulnerable Mode

A configuration that fixes connectivity is not automatically a good permanent configuration.

Keeping:

AllowEncryptionOracle = 2

may expose RDP authentication to risks that the CredSSP security update was specifically designed to mitigate.

Microsoft warns that the workaround permits an insecure connection.

Therefore:

Compatibility should not take priority over security indefinitely.

30. Correct Permanent Configuration

A healthy environment should ideally look like:

Client
Fully Updated
        ↓
Secure CredSSP
        ↓
Server
Fully Updated

rather than:

Updated Client
        ↓
Vulnerable Mode
        ↓
Unpatched Server

31. RDP Through VPN

If the server is accessed through a VPN, first confirm:

VPN Connected
        ↓
Server Reachable
        ↓
TCP 3389 Reachable
        ↓
CredSSP Authentication
        ↓
RDP Session

Test:

Test-NetConnection SERVER-IP -Port 3389

If port connectivity succeeds but the exact CredSSP message appears, focus on authentication and patch compatibility.

32. RDP Through Public IP

Directly exposing RDP TCP 3389 to the Internet carries significant security risk.

Where possible, use:

VPN
RD Gateway
Zero Trust remote-access architecture
Restricted source IP addresses
Firewall allowlists
MFA-capable remote-access solutions

CredSSP remediation should not be treated as the only security layer protecting an Internet-facing RDP server.

33. Cloud VM CredSSP Error

The same problem can occur with cloud-hosted Windows servers.

Examples include:

Microsoft Azure
AWS
Google Cloud
VPS providers
Private cloud
Hosted Windows servers

If RDP is unavailable, use the provider's management or console facilities where available.

For Azure Windows VMs specifically, Microsoft documents recovery approaches involving Azure Serial Console and remote PowerShell.

34. Virtual Machine Environments

For Hyper-V, VMware or other virtualization platforms, use the VM console to access the server.

This is extremely useful because console access does not depend on a functioning external RDP connection.

Once logged in:

Install Windows Updates
→ Restart VM
→ Verify CredSSP policy
→ Test RDP

35. Server Snapshot Problems

A common scenario is:

Server fully updated
↓
Old snapshot restored
↓
Server becomes outdated
↓
Client remains updated
↓
CredSSP mismatch
↓
RDP fails

After restoring an old VM snapshot, check Windows Update before changing RDP security policies.

36. Troubleshooting Decision Tree

Use the following decision process:

RDP CredSSP Error
       |
       +--- Is server reachable?
       |          |
       |          No → Fix network/firewall/VPN
       |
       Yes
       |
       +--- Is TCP 3389 reachable?
       |          |
       |          No → Check firewall/RDP service
       |
       Yes
       |
       +--- Is exact CredSSP error displayed?
                  |
                  Yes
                  |
                  +--- Update client
                  |
                  +--- Update server
                  |
                  +--- Restart both
                  |
                  +--- Test RDP
                           |
                           +--- Works → Finished
                           |
                           +--- Fails
                                 |
                                 +--- Check Group Policy
                                 +--- Check domain policy
                                 +--- Check NLA/security policies
                                 +--- Temporary Vulnerable mode if required
                                 +--- Correct patch/policy mismatch
                                 +--- Restore secure configuration

37. Common Mistakes

Mistake 1 – Permanently Setting Vulnerable Mode

This may solve the immediate problem while unnecessarily weakening security.

Mistake 2 – Updating Only the Client

If the server remains unpatched, the compatibility issue may continue.

Mistake 3 – Disabling NLA Permanently

NLA is an important RDP security control.

Do not disable it permanently simply to avoid fixing the underlying problem.

Mistake 4 – Disabling Windows Firewall

Do not disable the entire firewall to troubleshoot one RDP issue.

Instead verify the required Remote Desktop rules and network path.

Mistake 5 – Assuming Every RDP Error Is CredSSP

Check:

Test-NetConnection SERVER-IP -Port 3389

A networking problem needs a networking solution.

Mistake 6 – Ignoring Domain Group Policy

In business environments, domain policy may continuously overwrite local settings.

Mistake 7 – Forgetting to Restart After Updates

Some security updates require a restart before the updated authentication components become effective.

38. Recommended Security Configuration After Repair

After RDP is working:

Keep Windows updated.
Update both RDP clients and servers.
Keep NLA enabled.
Remove temporary AllowEncryptionOracle=2 overrides.
Avoid exposing TCP 3389 directly to the Internet.
Use VPN or RD Gateway where practical.
Restrict RDP access with firewall rules.
Use strong passwords.
Use account lockout policies.
Use MFA where supported by the remote-access architecture.
Monitor failed logon attempts.
Maintain regular server backups.
Keep emergency console access available for servers and VMs.

39. Quick Fix Summary

Preferred Solution

Update RDP Client
+
Update RDP Server
+
Restart
+
Test RDP

Temporary Workaround

REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" /v AllowEncryptionOracle /t REG_DWORD /d 2 /f

After Server Is Updated

Remove the temporary override:

REG DELETE "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" /v AllowEncryptionOracle /f

Then:

gpupdate /force

The temporary workaround should not become the permanent solution.

40. Frequently Asked Questions (FAQ)

Q1. What does the RDP CredSSP error mean?

It normally indicates an authentication/security compatibility problem between the Remote Desktop client and remote computer involving the Credential Security Support Provider protocol.

Q2. Why did RDP suddenly stop working after Windows Update?

One system may have received a CredSSP-related security update while the other remains outdated.

This can create an authentication compatibility mismatch.

Q3. What is “Encryption Oracle Remediation”?

It is a Windows security policy controlling how CredSSP handles connections involving systems with different security capabilities.

Q4. Where is Encryption Oracle Remediation located?

Open:

gpedit.msc

Navigate to:

Computer Configuration
→ Administrative Templates
→ System
→ Credentials Delegation
→ Encryption Oracle Remediation

Q5. What does AllowEncryptionOracle = 2 mean?

It corresponds to:

Vulnerable

It allows less-secure CredSSP compatibility and should generally be used only as a temporary workaround.

Q6. Is the registry fix safe?

It can restore connectivity, but setting the value to 2 weakens CredSSP protection.

Microsoft warns that this workaround permits insecure connections.

Q7. What is the safest fix?

Update both the client and remote server and restart them.

That addresses the compatibility problem without permanently weakening authentication security.

Q8. Should I disable NLA?

Normally, no.

NLA improves RDP security. Temporarily disabling it can be useful in specific troubleshooting situations, but it should not be the default permanent fix.

Q9. Can CredSSP errors occur on Windows 11?

Yes.

A fully updated Windows 11 computer may encounter this problem when connecting to an outdated or incorrectly configured remote system.

Q10. Can it happen with Windows Server 2016?

Yes.

Windows Server 2016 environments can experience CredSSP compatibility issues, especially when updates differ between the client and server.

Q11. Can it happen with Windows Server 2019 or newer servers?

Yes.

Although newer supported servers are less likely to suffer from old patch-level problems when properly maintained, CredSSP-related errors can still result from policy settings, incomplete updates, restored images or other authentication configuration issues.

Q12. Does restarting the server help?

It can.

If security updates were installed but the server was never restarted, updated components may not yet be fully active.

Q13. Can I fix CredSSP without Group Policy Editor?

Yes.

The relevant configuration can be managed through the registry.

Q14. Why does gpedit.msc not open?

Some Windows editions do not include the standard Local Group Policy Editor.

Use supported registry or administrative management methods instead of downloading unofficial Group Policy installers.

Q15. Does changing the RDP port fix CredSSP?

No.

CredSSP is an authentication/security issue. Changing TCP port 3389 to another port does not correct a CredSSP compatibility problem.

Q16. Does disabling Windows Firewall fix CredSSP?

No.

If you receive the actual CredSSP authentication message, the connection has progressed far enough for an authentication problem to be identified.

Do not disable the entire firewall as a CredSSP solution.

Q17. How can I check whether RDP port 3389 is accessible?

Use:

Test-NetConnection SERVER-IP -Port 3389

Look for:

TcpTestSucceeded : True

Q18. Why does the registry workaround work immediately?

It allows the updated client to tolerate a less-secure CredSSP connection that would otherwise be blocked.

That improves compatibility but reduces security.

Q19. Should I keep AllowEncryptionOracle set to 2?

Generally, no.

Once both systems are updated and the underlying issue is corrected, remove the temporary override or restore the organization-approved secure policy.

Q20. Can Active Directory Group Policy cause the error?

Yes.

Domain Group Policy can enforce CredSSP, NLA and other RDP security settings.

Use:

gpresult /h C:\gpresult.html

to investigate applied policies.

Q21. How do I check the AllowEncryptionOracle value?

Run:

reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters"

Q22. Can an old VM snapshot cause this problem?

Yes.

Restoring an old snapshot can return the server to an outdated patch level while the client remains fully updated.

Q23. Can CredSSP errors occur over VPN?

Yes.

VPN only provides network connectivity. RDP authentication can still fail because of CredSSP policy or patch incompatibility.

Q24. Is CredSSP itself a virus or malware?

No.

CredSSP is a legitimate Microsoft Windows authentication technology.

The error relates to security protections around the protocol, not malware detection.

Q25. What should administrators do first when this error appears?

Use this order:

1. Confirm server connectivity
2. Confirm TCP 3389
3. Update client
4. Update server
5. Restart systems
6. Test RDP
7. Review CredSSP Group Policy
8. Review domain policies
9. Use insecure workaround only when necessary
10. Remove workaround after permanent repair

Conclusion

The RDP CredSSP Encryption Oracle Remediation error is usually not a failure of Remote Desktop itself. It is a security protection triggered when the RDP client and server cannot establish an acceptable CredSSP authentication session.

The most important principle is:

Do not permanently weaken RDP security simply to restore connectivity.

The preferred solution is:

Patch Client
+
Patch Server
+
Restart
+
Verify CredSSP Policy
+
Keep NLA Enabled
+
Remove Temporary Vulnerable Overrides

The AllowEncryptionOracle=2 registry modification and the Vulnerable Group Policy option can be useful for emergency access, but they should be treated as temporary compatibility measures.

Keeping Windows clients and servers consistently patched is the best way to prevent the CredSSP error from returning.