Understanding the CredSSP Vulnerability
The Client Server Runtime Subsystem (CSRSS) uses the Credential Security Support Provider (CredSSP) protocol to handle user authentication for remote sessions. Microsoft introduced a critical security update (MS16-072) in mid-2016 to address a vulnerability where an attacker could potentially inject code into the session if the client authenticated before verifying the server's identity. By default, modern versions of Windows are configured to enforce "Pre-authentication," meaning the client will not send credentials until it is certain the remote machine is legitimate.
Windows 11 (23H2) ships with these strict security defaults enabled. When you attempt to connect to a Windows 10 (22H2) machine that has not been patched with the specific updates required to support this newer encryption standard, or when the Group Policy on the client side is too restrictive, the handshake fails. The system throws an error indicating that the remote computer requires network level authentication, but the local policy forbids sending unencrypted credentials. This is not necessarily a sign of malicious intent, but rather a version mismatch in security protocols between the two operating systems.
Solving the Issue via Group Policy
The most reliable method to fix this connectivity issue without compromising overall system security excessively is to adjust the Encryption Oracle Remediation setting on the Windows 11 client. This policy controls how strictly the client validates the encryption standards of the remote server. You can modify this setting using the Local Group Policy Editor, which is available on Windows 11 Pro, Enterprise, and Education editions.
Step-by-Step Configuration
- Open Group Policy Editor: Press
Win + R, typegpedit.msc, and press Enter. If you are using Windows 11 Home, you may need to use the Registry Editor instead, as described in the FAQ section below. - Navigate to the Policy Path: Expand Computer Configuration, then Administrative Templates, then System, and finally Credentials Delegation.
- Select Encryption Oracle Remediation: In the right-hand pane, locate the policy named Encryption Oracle Remediation. Double-click it to open the settings window.
- Enable the Policy: Change the option from "Not Configured" to Enabled. This action allows you to configure the protection level.
- Set Protection Level: In the dropdown menu labeled Protection Level, select Protected. This setting ensures that the client still performs some verification but relaxes the strictness enough to allow connections to servers that do not meet the highest encryption criteria.
- Apply Changes: Click OK to save the changes. You may need to run
gpupdate /forcein Command Prompt to apply the policy immediately, though a restart is often more effective.
After applying these changes, attempt to reconnect to your Windows 10 machine via Remote Desktop. The connection should now succeed because the Windows 11 client is permitted to negotiate the authentication process in a way that the Windows 10 server can accept.
Alternative: Registry Modification for Home Users
If you cannot access the Group Policy Editor due to using Windows 11 Home, you can achieve the same result by modifying the Windows Registry. This method directly alters the key that the Group Policy manages.
- Press
Win + R, typeregedit, and press Enter. - Navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters. If theParameterskey does not exist, create it. - Create a new DWORD (32-bit) Value named
AllowEncryptionOracle. - Set the value data to
2. This corresponds to the "Protected" level mentioned in the Group Policy method. - Restart your computer to ensure the registry change takes effect.
This registry tweak effectively tells the CredSSP provider to bypass the strictest encryption checks while maintaining a baseline level of security. It is a targeted fix for the compatibility issue between Windows 11 clients and older Windows 10 servers.
Verifying Server-Side Settings
While the primary fix is on the client side, it is worth ensuring that the Windows 10 target machine is configured correctly. Open the System Properties on the Windows 10 machine, go to the Remote tab, and verify that Allow remote connections to this computer is checked. Additionally, ensure that Network Level Authentication (NLA) is enabled. Although NLA is generally recommended for security, the CredSSP policy adjustment on the client handles the negotiation even when NLA is active, provided the encryption oracle setting is corrected.
For users experiencing other Remote Desktop issues, such as mouselag or random disconnections, it is important to distinguish between authentication errors and performance or stability problems. If you find that your connection drops frequently after establishing the link, you might benefit from optimizing your session settings.
Frequently Asked Questions
What does Error Code 0x4 mean in Remote Desktop?
Error code 0x4 typically indicates a general failure to establish a connection, often due to network issues or incorrect credentials. Unlike the CredSSP error which is specific to authentication protocol mismatches, this code suggests the client cannot reach the server or the server rejected the initial handshake entirely. Check your firewall rules and ensure the Remote Desktop service is running on the target machine.
Can I disable Network Level Authentication (NLA) to fix this?
Disabling NLA on the Windows 10 server is possible but strongly discouraged due to significant security risks. NLA requires users to authenticate before a full remote desktop session is established, protecting against man-in-the-middle attacks. Instead of disabling NLA, adjusting the Encryption Oracle Remediation on the Windows 11 client is the safer and more appropriate solution.
Why does this happen only when connecting from Windows 11?
Windows 11 enforces stricter default security policies regarding CredSSP than previous versions of Windows. Older clients like Windows 10 or 8.1 might have looser defaults or different patch levels that allowed them to connect to various servers without triggering this specific validation error. The upgrade to Windows 11 introduced these tighter constraints to mitigate known vulnerabilities.
How do I check if my Windows 10 machine is fully updated?
To ensure your Windows 10 machine supports the necessary authentication standards, go to Settings > Update & Security > Windows Update and click Check for updates. Install all pending optional and critical updates, particularly those related to security. A fully patched Windows 10 system is less likely to encounter compatibility issues with modern Windows 11 clients.
Is there a risk in setting the Encryption Oracle to Protected?
Setting the policy to "Protected" maintains a reasonable level of security while allowing compatibility with slightly older servers. It prevents the most dangerous forms of credential interception but allows the connection to proceed where strict pre-authentication would fail. It is considered a safe compromise for internal network environments where trust levels are managed locally.