Skip to main content
The error “This could be due to CredSSP encryption oracle remediation” means that one side of the Remote Desktop connection has the CredSSP security update (CVE-2018-0886) and the other doesn’t, or a policy forces only updated clients. The fix is to install the latest Windows updates on both your PC and the server, then connect again. Lowering the Encryption Oracle Remediation policy is only a temporary workaround. The full message in Remote Desktop Connection is:

​
Before you start

  • CredSSP (Credential Security Support Provider) is the protocol Remote Desktop uses to check your credentials before the session starts, as part of Network Level Authentication.
  • If RDP is blocked, sign in to a VPS through the VNC console. On a dedicated server without console access, open a ticket.

​
Why the error appears

Microsoft changed CredSSP in March 2018. From the May 2018 update onwards, updated clients default to Mitigated and refuse to talk to servers without the update. Microsoft documents three blocked combinations: Windows Server 2019, 2022 and 2025 include the update, so the usual causes are an old, unpatched PC or an older Windows release on the other side.

​
Cause 1: your PC or the server is missing updates (most likely)

Check: on each machine, open PowerShell and list recent updates:
If the newest entry is very old, or Windows Update shows pending updates, this is the cause. Fix: install all updates and restart.
On Windows 11, open Start > Settings > Windows Update; on Windows 10, open Start > Settings > Update & Security > Windows Update. Click Check for updates, install everything and restart.

​
Cause 2: a policy forces updated clients

Check: on the server and on your PC, open gpedit.msc and go to Computer Configuration > Administrative Templates > System > Credentials Delegation > Encryption Oracle Remediation. Or read the registry value:
No value means the default (Mitigated) applies. Fix: update the out-of-date machine (cause 1). Keep Force updated clients if you set it on purpose; it is the safest setting once every client is updated.

​
Temporary workaround: allow the connection while you update

If you can’t reach the server any other way to install updates, Microsoft documents setting the policy to Vulnerable on your PC (the client), connecting, updating the server, and then undoing the change.
Vulnerable allows an insecure fallback that Microsoft says “will expose the remote servers to attacks”. Use it only for the few minutes you need to update the server, then set it back. Prefer the VNC console, which needs no change at all.
1

Set the client policy to Vulnerable

On your PC, open gpedit.msc, go to Computer Configuration > Administrative Templates > System > Credentials Delegation, open Encryption Oracle Remediation, select Enabled and choose Vulnerable under Protection Level. On Windows Home editions without gpedit.msc, run this in an elevated Command Prompt instead and restart:
2

Connect and update the server

Connect with Remote Desktop, install all Windows updates on the server and restart it.
3

Undo the workaround

Set the policy back to Not Configured, or delete the value and restart your PC:

​
How to check it worked

Connect again with mstsc. The CredSSP message no longer appears and you see the sign-in prompt or the desktop.

​
Frequently asked questions

​
Should I turn off Network Level Authentication instead?

No. NLA protects the server from unauthenticated connections. Install the updates instead; see protect RDP from brute-force attacks.

​
Do I need to restart after changing the policy?

Microsoft lists a restart as required for the AllowEncryptionOracle registry value. Restart the machine you changed.

​
The error appears from a Mac or Linux client. What now?

Update the client app (Windows App, Remmina or FreeRDP) and the server. See Remote Desktop from Mac, Linux and mobile.

VPS and dedicated server guides

Every guide in this section.

Install Windows updates

SConfig, Settings and PowerShell.

Remote Desktop can't connect

When RDP doesn’t reach the server.

Windows Update stuck or failing

Fix updates that won’t install.

VNC console

Reach your VPS without RDP.
Checked against Microsoft Support: CredSSP updates for CVE-2018-0886 and Microsoft Learn: CredSSP encryption oracle remediation error on 4 November 2026. Steps were not tested on a live Windows server for this page; menu names can differ slightly between Windows versions.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026