--- title: "Fixing CredSSP encryption oracle remediation in RDP — Ivan Kahl" description: "After the CredSSP security patch, RDP connections to unpatched servers fail with an encryption oracle error. A temporary registry change gets connections working again." url: https://ivankahl.com/blog/fixing-credssp-encryption-oracle-remediation-in-rdp/ published: 2018-05-13T00:00:00.000Z tags: - "Tech Tips" - "Windows" --- 13 May 2018 · 2 min read # Fixing CredSSP encryption oracle remediation in RDP After the CredSSP security patch, RDP connections to unpatched servers fail with an encryption oracle error. A temporary registry change gets connections working again. ## What’s the whole story about CredSSP? CredSSP (Credential Security Support Provider) protocol is the protocol which ensures that your credentials for a target server are sent securely when using RDP. Researchers found a security vulnerability late last year that allows for a malicious user to gain access to the server and execute code on the server remotely over the network. This is done with a man-in-the-middle attack where the malicious user is connected to the same network. If you want to learn more about this security vulnerability, watch the video released by the researchers: [Video: CredSSP vulnerability explained by the researchers](https://www.youtube.com/watch?v=VywB2_o9Tsk) Microsoft released a patch to fix this vulnerability in May 2018. This is available as a Windows Update for many different versions of Windows, including Server versions. Unfortunately, the update can’t be applied to all machines immediately because many servers can’t just be shut down at sudden notice. Due to some machines having the update and others not, the below error appears: ## So how do I fix it? A temporary fix can be employed that will allow you to connect to servers even if they haven’t been updated yet. This is temporary though because I would encourage you to schedule an update for the server when possible to patch the security vulnerability. The temporary fix just requires adding a key to the registry on the client machine: 1. Open the Registry Editor by pressing **Start** and typing *regedit* 2. Right-click on the *System* folder and go to **New -> Key** and rename the key to *CredSSP* 3. Right-click on the *CredSSP* folder and go to **New -> Key** and rename the key to Parameters 4. Right click on the *Parameters* folder and go to **New -> DWORD (32-bit) Value** and rename the value to *AllowEncryptionOracle*. 5. Restart your computer for the change to take effect Double click on the new value and set the Value Data field to *00000002* as seen below. Click **OK** ![1526025865150-792ca4bd4f9726dc721584ca86f57aa2-e5774](https://blog.ivankahl.com/content/images/2019/02/1526025865150-792ca4bd4f9726dc721584ca86f57aa2-e5774.png) Your registry should now look as follows: ![1526025918415-c95125e9f87f160875733db3496b0746-52fd6](https://blog.ivankahl.com/content/images/2019/02/1526025918415-c95125e9f87f160875733db3496b0746-52fd6.png) Navigate to *HKEYLOCALMACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies* in the left panel: ![navigate\_to\_policies-5c0c264cd9d137385e71908421e6b905-52fd6](https://blog.ivankahl.com/content/images/2019/02/navigate_to_policies-5c0c264cd9d137385e71908421e6b905-52fd6.png) ## Final Thoughts That should be all that’s needed to get around the error. Keep in mind that this is a temporary fix though and you should try to update all your servers at the soonest convenient time. If you have any questions or comments, please leave them for me down below. Tags: [Tech Tips](https://ivankahl.com/blog/tags/tech-tips/), [Windows](https://ivankahl.com/blog/tags/windows/)