<p>Another update from Microsoft brings a new set of issues in a corporate environment. Users started reporting errors when they have tried to connect to a remote computer via RDP. The error message says: <strong>An authentication error has occurred. The function requested is not supported.</strong></p>
<p><a href="https://www.wincert.net/wp-content/uploads/2018/05/rdp-issue.png"><img class="alignnone wp-image-2597 size-full" title="An authentication error has occurred" src="https://www.wincert.net/wp-content/uploads/2018/05/rdp-issue.png" alt="An authentication error has occurred" width="469" height="193" /></a></p>
<p><strong>Short info from Microsoft:</strong></p>
<p><em>Credential Security Support Provider protocol (CredSSP) is an authentication provider that processes authentication requests for other applications.</em></p>
<p><em>A remote code execution vulnerability exists in unpatched versions of CredSSP. An attacker who successfully exploits this vulnerability could relay user credentials to execute code on the target system. Any application that depends on CredSSP for authentication may be vulnerable to this type of attack.</em></p>
<p><em>This security update addresses the vulnerability by correcting how CredSSP validates requests during the authentication process.</em></p>
<p><em>By default, after this update is installed, <strong>patched clients cannot communicate with unpatched servers</strong>. Use the interoperability matrix and group policy settings described in this article to enable an “allowed” configuration.</em></p>
<p>Even though I have patches the client and the server I was unable to connect to some of our servers in the network. So, to resolve this, and having in mind that our network is behind a firewall I had to create a new group policy and apply it to these servers.</p>
<p>You can also edit local security policy on the problematic server and make necessary changes to be able to connect to the server.</p>
<p>Open Local Group Policy Editor (<strong>gpedit.msc</strong>)</p>
<p>In the <strong>left pane</strong> navigate to <strong>Computer Configuration | Administrative Templates | System | Credentials Delegation</strong></p>
<p>In the right pane double-click on the &#8220;<strong>Encryption Oracle Remediation</strong>&#8221; setting</p>
<p><a href="https://www.wincert.net/wp-content/uploads/2018/05/oracle.png"><img class="alignnone wp-image-2590 size-full" title="An authentication error has occurred" src="https://www.wincert.net/wp-content/uploads/2018/05/oracle.png" alt="An authentication error has occurred" width="1195" height="663" /></a></p>
<p>Click on <strong>Enabled</strong> to enable the setting and change the Protection Level to <strong>Vulnerable</strong></p>
<p>This was the only way to be able to connect to remote server via RDP without being blocked with <strong>An authentication error has occurred</strong> error message, even though my servers and clients are patched regularly.</p>
<p><a href="https://www.wincert.net/wp-content/uploads/2018/05/oracle2.png"><img class="alignnone wp-image-2591 size-full" title="An authentication error has occurred" src="https://www.wincert.net/wp-content/uploads/2018/05/oracle2.png" alt="An authentication error has occurred" width="686" height="636" /></a></p>
<p>Comments are welcome!</p>