Fix RDP Authentication Error: The Function Requested Is Not Supported | Windows OS Hub (2024)

March 11, 2024 Windows 10Windows Server 2019

The following error may occur when you use the built-in RDP client (mstsc.exe) to connect to the desktop of a remote computer:

Remote Desktop ConnectionAn authentication error has occurred.The function requested is not supported.Remote computer: computer_name

This bug is caused by the fact that Windows by default blocks RDP connections to remote computers that are running a vulnerable version of the CredSSP protocol (CVE-2018-0886). The Credential Security Support Provider (CredSSP) protocol is used to pre-authenticate users when the Network Level Authentication (NLA) protocol is enabled for RDP. Microsoft released an update for the CredSSP vulnerability in 2018, but for some reason, the update hasn’t been installed on the remote host you’re trying to connect to (https://support.microsoft.com/en-us/topic/credssp-updates-for-cve-2018-0886-5cbf9e5f-dc6d-744f-9e97-7ba400d6d3ea).

How to Fix RDP Authentication Error on Windows

1. (Recommended way) The correct solution is to install the latest Windows cumulative security updates on the remote computer you are connecting to via RDP. It is most likely that this computer has recently been deployed from an out-of-date image, or that Windows Update has been disabled on it. You can use the PSWindowsUpdate module or the following command to check the latest installation date of Windows updates:
   gwmi win32_quickfixengineering |sort installedon -desc
   
   You can get updates automatically from Windows Update, or you download and install Windows updates manually. Any cumulative update released after 2019 for your version of Windows will need to be installed;
2. Workaround 1 (not recommended). You can temporarily allow your computer (the client) to connect to the RDP host with an insecure version of the CredSSP. To do this, you need to change the AllowEncryptionOracle registry parameter using the command: REG ADD
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters /v AllowEncryptionOracle /t REG_DWORD /d 2). Or you can change the local Group Policy ‘Encryption Oracle Remediation‘ option by setting its value to Vulnerable. (See the detailed description in the post RDP error: CredSSP Encryption Oracle Remediation).

   This will allow you to connect to a remote server via RDP and install the latest security updates (method 1). After upgrading the remote server, disable the policy or change the AllowEncryptionOracle key value on your computer (client) to 0: (REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters /v AllowEncryptionOracle /t REG_DWORD /d 0.

3. Workaround 2 (not recommended). You can turn off Network Level Authentication (NLA) on the side of the RDP server (as described below).

Disable Network Level Authentication (NLA) for Remote Desktop on Windows

If NLA is enabled on the side of the RDP server you are connecting to, the CredSPP protocol is used to pre-authenticate RDP users.

You can disable Network Level Authentication in System Properties (SystemPropertiesRemote.exe), on the Remote tab, by unchecking the “Allow connection only from computers running Remote Desktop with Network Level Authentication (recommended)” option.

This option is called differently in Windows 7 and Windows Server 2008 R2. On the Remote tab, select ‘Allow connections from computers running any version of Remote Desktop (less secure)‘.

It is also possible to disable Network Level Authentication (NLA) by using the local Group Policy Editor (gpedit.msc).

Go to Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Security, find the policy ‘Require user authentication for remote connections using network level authentication‘ and disable it.

You must also set the RDP security layer in the ‘Require the use of a specific security layer for remote (RDP) connections‘ policy settings

To apply new RDP settings, you need to update the Group Policies on a local computer (gpupdate /force) or reboot your desktop. You should then be able to successfully connect to the Remote Desktop.

Leave a Comment