Microsoft at it again!

[Liam]

Run into an error with Remote Desktop today!

 

Anyone else having difficulty with credssp following a recent update?

https://www.experts-exchange.com/questions/29098796/CredSSP-encryption-oracle-remediation.html

 

Worth a read if you have !

[Steven_Cleaver]

Thanks for this had our Deputy Head report an issue this evening so am going to have a look at her Laptop tomorrow.

[keyboards]

Yeah, two machines yesterday, one today, we've just restored the PC's to a day earlier to fix it well for the minute, can't wait for people screaming and shout today about it, our SIMS is hosted and uses RDP, so that's SIMS out the window, brilliant.

 

This affecting all Windows 7 machines or just the odd few?

Edited May 10, 2018 by keyboards

[Liam]

Any that have patched with this months update. Al servers need to be patched to avoid the error. You can get the standalone update online

[timbo343]

Yup,and found this is a fix

 

https://www.experts-exchange.com/questions/29098796/CredSSP-encryption-oracle-remediation.html

 

Just remember to remove the entry once the servers have been updated.

Edited May 10, 2018 by timbo343

[Liam]

Yup,and found this is a fix

 

https://www.experts-exchange.com/questions/29098796/CredSSP-encryption-oracle-remediation.html

 

That’s only client side though as a temporary measure

 

All servers need to be patched too. I’m going through one by one now.

 

I have made the change in gpo for Internal clients

[keyboards]

Not sure I want to registry deploy Group Policy fixes rather they just release an update ASAP that sorts it

[Liam]

Not sure I want to registry deploy Group Policy fixes rather they just release an update ASAP that sorts it

 

I believe there is. It doesn’t help with those that connect using their own computers otherswise

[ShellfishClive]

Yeah changing the reg key locally did it for me. Worked a charm!

[Liam]

Yeah changing the reg key locally did it for me. Worked a charm!

 

It does work but doesn’t help with all your remote users

[timbo343]

It does work but doesn’t help with all your remote users

 

Package up a .reg file, host it on your site and direct users to it.

 

- - - Updated - - -

 

Yup,and found this is a fix

 

https://www.experts-exchange.com/questions/29098796/CredSSP-encryption-oracle-remediation.html

 

Just got into work after not been able to connect - applied to my work machine and it can now connect.

 

Reg key is here for clients:

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters] "AllowEncryptionOracle"=dword:00000002

Edited May 10, 2018 by timbo343

[ShellfishClive]

It does work but doesn’t help with all your remote users

 

We only have two machines that applied the update so should be alright for now.

[Liam]

https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2018-0886

[timbo343]

There is another way through Group Policy if anyone needs it:

 

Computer Configuration -> Administrative Templates -> System -> Credentials Delegation--Encryption Oracle Remediation

 

enable and set to 'vulnerable'

 

here is a screenshot:

 

https://redirect.viglink.com/?format=go&jsonp=vglnk_152593931237414&key=c7e3cc67cf9c9844a05ec4b1326edddd&libId=jh08s7l001011sl2000DAaxu1kt6t&loc=https%3A%2F%2Fwww.experts-exchange.com%2Fquestions%2F29098796%2FCredSSP-encryption-oracle-remediation.html&v=1&out=https%3A%2F%2Ffiledb.experts-exchange.com%2Fincoming%2F2018%2F05_w19%2F1311779%2Frz1ibzh1wcxq9ss97lyyrvczrk8.png&ref=http%3A%2F%2Fwww.edugeek.net%2Fforums%2Fgeneral-chat%2F195939-microsoft-again.html&title=CredSSP%20encryption%20oracle%20remediation&txt=

[Liam]

this is what i did to get my clients up and running but the link above had the standalone patches to install as remote users still had the issue

[timbo343]

Just to up date this too.. It took out our papercut server too on Server2016. Adding in the reg entry means i am able to browse papercut via the browser.

[atechguy]

This worked for me when i got the error this morning. Added entry to my workstation and it let me in via RDP

CredSSP Fix.rar

[speckytecky]

Any sign of Microsoft withdrawing the offending updates and reissuing fixes I wonder/

[Liam]

This explains it well enough

 

https://blog.workinghardinit.work/

[free780]

This is why you have a pilot/test/guinea pig groups of PCs.

[keyboards]

This is why you have a pilot/test/guinea pig groups of PCs.

 

In a perfect world yes but I'm sure we've already all got tons to do, if we had more staff then yeah definitely would have a test environment etc

[Liam]

I it hasn’t hit my internal clients just remote users that I have no control over. I’m just patching servers now and it’s sorted it

[speckytecky]

This explains it well enough

 

https://blog.workinghardinit.work/

 

I must admit that the article leaves me a tad confused. Is that saying that KB4103725 (Windows 8/10) KB4103727 (Server 2016/2012) KB4103718 (Windows 7) are actually okay now then?

[free780]

If you have Windows Update for Business configured or co-management you can delay quality updates.

[fiza]

I must admit that the article leaves me a tad confused. Is that saying that KB4103725 (Windows 8/10) KB4103727 (Server 2016/2012) KB4103718 (Windows 7) are actually okay now then?

I felt the same. What do I need to do to get RDP working again for remote users who connect through our RD Gateway?