> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Fix the CredSSP Encryption Oracle Remediation Error

> Fix the RDP error "This could be due to CredSSP encryption oracle remediation": install the CredSSP security updates on both your PC and the Windows server.

The error "This could be due to CredSSP encryption oracle remediation" means that one side of the Remote Desktop connection has the CredSSP security update (CVE-2018-0886) and the other doesn't, or a policy forces only updated clients. The fix is to install the latest Windows updates on both your PC and the server, then connect again. Lowering the **Encryption Oracle Remediation** policy is only a temporary workaround.

The full message in Remote Desktop Connection is:

```text theme={null}
An authentication error has occurred.
The function requested is not supported.
Remote computer: 203.0.113.10
This could be due to CredSSP encryption oracle remediation.
```

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Beginner | 10 to 30 minutes (mostly updates) | Windows Server 2019 / 2022 / 2025; Windows 10 / 11 clients | Administrator rights on both machines |

## Before you start

* CredSSP (Credential Security Support Provider) is the protocol Remote Desktop uses to check your credentials before the session starts, as part of Network Level Authentication.
* If RDP is blocked, sign in to a VPS through the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md). On a dedicated server without console access, [open a ticket](https://freakhosting.com/clientarea/submitticket.php).

## Why the error appears

Microsoft changed CredSSP in March 2018. From the May 2018 update onwards, updated clients default to **Mitigated** and refuse to talk to servers without the update. Microsoft documents three blocked combinations:

| Client (your PC) | Server | Result |
| - | - | - |
| Updated, **Force updated clients** or **Mitigated** | Not updated | Blocked |
| Not updated | Updated, **Force updated clients** | Blocked |
| Any other combination | | Allowed |

Windows Server 2019, 2022 and 2025 include the update, so the usual causes are an old, unpatched PC or an older Windows release on the other side.

## Cause 1: your PC or the server is missing updates (most likely)

**Check:** on each machine, open PowerShell and list recent updates:

```powershell theme={null}
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5
```

If the newest entry is very old, or Windows Update shows pending updates, this is the cause.

**Fix:** install all updates and restart.

> [tab] Your PC (Windows 10 / 11)
>
> On Windows 11, open **Start > Settings > Windows Update**; on Windows 10, open **Start > Settings > Update & Security > Windows Update**. Click **Check for updates**, install everything and restart.

> [tab] The server
>
> Sign in through the VNC console, run `SConfig`, choose **6** (**Install updates**), then **1** (**All quality updates**) and **A** to install all. Restart when asked. Details are in [install Windows updates on Windows Server](https://help.freakhosting.com/portals/other/how-to-install-windows-updates-on-windows-server.md).

## Cause 2: a policy forces updated clients

**Check:** on the server and on your PC, open `gpedit.msc` and go to **Computer Configuration > Administrative Templates > System > Credentials Delegation > Encryption Oracle Remediation**. Or read the registry value:

```powershell theme={null}
Get-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters' -Name AllowEncryptionOracle -ErrorAction SilentlyContinue
```

| `AllowEncryptionOracle` | Policy option | Meaning |
| - | - | - |
| `0` | Force updated clients | Most secure. Refuses unpatched clients and servers. |
| `1` | Mitigated | Default after May 2018. Clients refuse unpatched servers; servers still accept unpatched clients. |
| `2` | Vulnerable | Allows fallback to the insecure version. |

No value means the default (**Mitigated**) applies.

**Fix:** update the out-of-date machine (cause 1). Keep **Force updated clients** if you set it on purpose; it is the safest setting once every client is updated.

## Temporary workaround: allow the connection while you update

If you can't reach the server any other way to install updates, Microsoft documents setting the policy to **Vulnerable** on **your PC** (the client), connecting, updating the server, and then undoing the change.

> [!WARNING]
>
> **Vulnerable** allows an insecure fallback that Microsoft says "will expose the remote servers to attacks". Use it only for the few minutes you need to update the server, then set it back. Prefer the VNC console, which needs no change at all.

**1. Set the client policy to Vulnerable**

On your PC, open `gpedit.msc`, go to **Computer Configuration > Administrative Templates > System > Credentials Delegation**, open **Encryption Oracle Remediation**, select **Enabled** and choose **Vulnerable** under **Protection Level**. On Windows Home editions without `gpedit.msc`, run this in an elevated Command Prompt instead and restart:

```bat theme={null}
REG ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters /v AllowEncryptionOracle /t REG_DWORD /d 2
```

**2. Connect and update the server**

Connect with Remote Desktop, install all Windows updates on the server and restart it.

**3. Undo the workaround**

Set the policy back to **Not Configured**, or delete the value and restart your PC:

```bat theme={null}
REG DELETE HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters /v AllowEncryptionOracle /f
```

## How to check it worked

Connect again with `mstsc`. The CredSSP message no longer appears and you see the sign-in prompt or the desktop.

## Frequently asked questions

### Should I turn off Network Level Authentication instead?

No. NLA protects the server from unauthenticated connections. Install the updates instead; see [protect RDP from brute-force attacks](https://help.freakhosting.com/portals/other/how-to-protect-rdp-from-brute-force-attacks.md).

### Do I need to restart after changing the policy?

Microsoft lists a restart as required for the `AllowEncryptionOracle` registry value. Restart the machine you changed.

### The error appears from a Mac or Linux client. What now?

Update the client app (Windows App, Remmina or FreeRDP) and the server. See [Remote Desktop from Mac, Linux and mobile](https://help.freakhosting.com/portals/other/how-to-use-remote-desktop-from-mac-linux-and-mobile.md).

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [Install Windows updates](https://help.freakhosting.com/portals/other/how-to-install-windows-updates-on-windows-server.md)
>
> SConfig, Settings and PowerShell.

> [card] [Remote Desktop can't connect](https://help.freakhosting.com/portals/other/how-to-fix-remote-desktop-cant-connect.md)
>
> When RDP doesn't reach the server.

> [card] [Windows Update stuck or failing](https://help.freakhosting.com/portals/other/how-to-fix-windows-update-stuck-or-failing.md)
>
> Fix updates that won't install.

> [card] [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md)
>
> Reach your VPS without RDP.

***

> [!NOTE]
>
> **Checked against [Microsoft Support: CredSSP updates for CVE-2018-0886](https://support.microsoft.com/en-us/servicing/os/windows-server/2019/09/credssp-updates-for-cve-2018-0886) and [Microsoft Learn: CredSSP encryption oracle remediation error](https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/windows/credssp-encryption-oracle-remediation)** on 4 November 2026. Steps were not tested on a live Windows server for this page; menu names can differ slightly between Windows versions.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.