CredSSP is the part of Windows that securely hands your login credentials to a remote computer during a Remote Desktop session. When your PC shows the “CredSSP encryption oracle remediation” error, it is refusing to connect because the remote computer’s security is out of date. Here is what CredSSP is, why the error appears, and how to fix it properly.
What is CredSSP
Credential Security Support Provider, or CredSSP, is an authentication protocol that Windows uses to delegate your username and password to a remote host, mainly in Remote Desktop (RDP) connections. In 2018, researchers found a serious flaw in it, CVE-2018-0886, an “encryption oracle” vulnerability that could let an attacker on the network relay your credentials to another server. Microsoft patched the flaw and then tightened the rules: an updated Windows PC now refuses RDP connections to computers that never received the patch. That refusal is the error you are seeing.
Why the error appears
Almost always, it is a mismatch: your PC is patched and the remote computer is not. The remote side might be an old server, a PC that has not updated in years, or a machine with updates paused. Less often, a group policy on your PC is set to “Force Updated Clients,” which blocks connections to or from any computer that never received the patch.
The Encryption Oracle Remediation policy has three levels:
| Level | Registry value | What it does |
|---|---|---|
| Force Updated Clients | 0 | Most secure. Blocks outbound connections to unpatched hosts and refuses inbound connections from unpatched clients. |
| Mitigated | 1 | The default. Blocks outbound connections to unpatched hosts, but still accepts connections from unpatched clients. |
| Vulnerable | 2 | Allows connections to unpatched hosts. A temporary workaround only. |
First, confirm it is actually CredSSP. The error reads: “An authentication error has occurred. The function requested is not supported. This could be due to CredSSP encryption oracle remediation.” To be sure, open Event Viewer on your PC, look in the System log for Event ID 6041 from LsaSrv, and check that it appears when the connection fails. If there is no such event, the problem is something else, and the workaround below will not help.
Not this error? Two 2026 breakages look similar but need different fixes. If Remote Desktop started hanging or failing right after the September 2026 security updates, install the out-of-band fix from 14 September 2026 (KB5129195 for Windows 11 24H2 and 25H2, KB5129194 for 26H1), or simply the latest cumulative update. If a non-admin user gets error 0xC000000D (“The token that was passed to the function is invalid”) on a host with Administrator Protection switched on, that is a separate known issue, fixed by the 28 October 2026 preview update KB5127936 or the 10 November 2026 update KB5132061. Neither of those is fixed by lowering the CredSSP protection below.
How to fix the CredSSP error
Method 1: Install Windows updates on both computers (the real fix)
- On your PC, open Settings, go to Windows Update, and install everything pending. Restart when asked.
- On the remote computer, do the same. If you cannot reach it through Remote Desktop, use the physical console, your hosting provider’s web console, or ask whoever manages it.
- Try the Remote Desktop connection again.
This is the only fix Microsoft recommends as permanent. Everything below is a temporary bridge for when you cannot update the remote side right away. CredSSP had a second, separate flaw patched in July 2025 (CVE-2025-47987), which is another reason both sides need current updates. If the remote computer runs Windows 10, note that Windows 10 stopped receiving updates in October 2025, so patching it may no longer be possible; that machine needs an upgrade, not a permanent Vulnerable setting.
Method 2: Temporarily lower the protection in Group Policy
Warning: this lowers your security. Use it only to reach a computer you cannot update yet, and reverse it as soon as you patch that computer.
- Press Win + R, type gpedit.msc, and press Enter.
- Go to Computer Configuration, then Administrative Templates, then System, then Credentials Delegation.
- Double-click Encryption Oracle Remediation, set it to Enabled, and set the Protection level to Vulnerable.
- Click OK. Open Command Prompt and run gpupdate /force, then restart your PC: the change only takes effect after a reboot, not from gpupdate alone.
- Connect with Remote Desktop.
Note: gpedit.msc is not included in Windows Home editions. On Home, use Method 3 instead. If the PC is joined to a domain, a domain policy can override this local change, and the setting may belong on the server rather than on your PC.
Method 3: Temporarily lower it with a registry command
Open Command Prompt as an administrator and run:
REG ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters /v AllowEncryptionOracle /t REG_DWORD /d 2 /fThen restart your PC and connect with Remote Desktop. The value 2 selects the Vulnerable level, the same as Method 2.
Method 4: Undo the workaround after you patch
Never leave the setting on Vulnerable. Once the remote computer is updated, remove the override entirely, which returns the policy to Microsoft’s default level, Mitigated (the delete command is below). If you would rather set the strictest level instead, use this command in an administrator Command Prompt, keeping in mind that level 0 can also block unpatched clients from connecting to this machine if it serves Remote Desktop itself:
REG ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters /v AllowEncryptionOracle /t REG_DWORD /d 0 /fOr remove the override entirely:
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" /v AllowEncryptionOracle /fIf the value does not exist, there is nothing to remove and your policy is already back to normal.
Our verdict
Patching both sides is the fix; the Vulnerable setting is a temporary bridge, not a solution. The error exists to protect your credentials, so treat the workaround like a borrowed ladder: use it to get in, patch the server, then put the ladder away. If your Remote Desktop trouble looks different, see how to fix RDP when it cannot connect to the remote computer or how to fix the network level authentication error.
- How to Fix Laptop Keyboard Backlight Not Working in Windows 11 - November 14, 2026
- How to Turn Off Require Sign-In After Sleep in Windows 11 - November 13, 2026
- How to Turn Off Clipboard History in Windows 11 - November 12, 2026