Fix CredSSP Encryption Oracle Remediation Error in Remote Desktop

CredSSP is the part of Windows that securely hands your login credentials to a remote computer during a Remote Desktop session. When your PC shows the “CredSSP encryption oracle remediation” error, it is refusing to connect because the remote computer’s security is out of date. Here is what CredSSP is, why the error appears, and how to fix it properly.

What is CredSSP

Credential Security Support Provider, or CredSSP, is an authentication protocol that Windows uses to delegate your username and password to a remote host, mainly in Remote Desktop (RDP) connections. In 2018, researchers found a serious flaw in it, CVE-2018-0886, an “encryption oracle” vulnerability that could let an attacker on the network relay your credentials to another server. Microsoft patched the flaw and then tightened the rules: an updated Windows PC now refuses RDP connections to computers that never received the patch. That refusal is the error you are seeing.

Why the error appears

Almost always, it is a mismatch: your PC is patched and the remote computer is not. The remote side might be an old server, a PC that has not updated in years, or a machine with updates paused. Less often, a group policy on your PC is set to “Force Updated Clients,” which blocks even partially patched hosts.

The Encryption Oracle Remediation policy has three levels:

Level	Registry value	What it does
Force Updated Clients	0	Most secure. Blocks connections to and from unpatched computers.
Mitigated	1	The default. Blocks outbound connections to unpatched hosts.
Vulnerable	2	Allows connections to unpatched hosts. A temporary workaround only.

How to fix the CredSSP error

Method 1: Install Windows updates on both computers (the real fix)

• On your PC, open Settings, go to Windows Update, and install everything pending. Restart when asked.
• On the remote computer, do the same. If you cannot reach it through Remote Desktop, use the physical console, your hosting provider’s web console, or ask whoever manages it.
• Try the Remote Desktop connection again.

This is the only fix Microsoft recommends as permanent. Everything below is a temporary bridge for when you cannot update the remote side right away.

Method 2: Temporarily lower the protection in Group Policy

Warning: this lowers your security. Use it only to reach a computer you cannot update yet, and reverse it as soon as you patch that computer.

• Press Win + R, type gpedit.msc, and press Enter.
• Go to Computer Configuration, then Administrative Templates, then System, then Credentials Delegation.
• Double-click Encryption Oracle Remediation, set it to Enabled, and set the Protection level to Vulnerable.
• Click OK. Open Command Prompt and run gpupdate /force.
• Connect with Remote Desktop.

Note: gpedit.msc is not included in Windows Home editions. On Home, use Method 3 instead.

Method 3: Temporarily lower it with a registry command

Open Command Prompt as an administrator and run:

REG ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters /v AllowEncryptionOracle /t REG_DWORD /d 2

Then connect with Remote Desktop. The value 2 selects the Vulnerable level, the same as Method 2.

Method 4: Undo the workaround after you patch

Never leave the setting on Vulnerable. Once the remote computer is updated, set it back to the secure level with this command in an administrator Command Prompt:

REG ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters /v AllowEncryptionOracle /t REG_DWORD /d 0

Or remove the override entirely:

reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" /v AllowEncryptionOracle /f

If the value does not exist, there is nothing to remove and your policy is already back to normal.

Our verdict

Patching both sides is the fix; the Vulnerable setting is a temporary bridge, not a solution. The error exists to protect your credentials, so treat the workaround like a borrowed ladder: use it to get in, patch the server, then put the ladder away. If your Remote Desktop trouble looks different, see how to fix RDP when it cannot connect to the remote computer or how to fix the network level authentication error.