rdp "an authentication error has occurred. the function requested is not supported"

Not specified by the original author.

Error message

An authentication error has occurred. The function requested is not supported. This could be due to CredSSP encryption oracle remediation.

TL;DR

The client and server disagree on the CredSSP encryption oracle remediation level, usually a patched client talking to an unpatched server. Patch the server, or as a stopgap align the group policy setting on the client to match the server's level. Patching the server is the real fix.

Steps

1. Confirm the exact error mentions CredSSP encryption oracle remediation. Expected: You have the signature mismatch, not a password problem.

2. Check the server's update level for the CredSSP security update. Expected: You see the server is missing the update the client already has.

3. Patch the server and reboot, then retry the RDP connection. Expected: RDP connects normally.

4. Only if patching is impossible today, set the client's Encryption Oracle Remediation policy to the vulnerable level temporarily and schedule the server patch. Expected: RDP connects, with a documented follow-up to re-harden.

When to use

• The error text names CredSSP encryption oracle remediation
• The failure started right after client machines were patched
• Only connections to specific unpatched servers fail

When not to use

• The password is wrong (the message would say so)
• The server is unreachable at all (check the network first)
• NLA is disabled on the server (a different configuration issue)

Why this happens

Microsoft hardened CredSSP against an encryption oracle attack and made patched clients refuse to talk to unpatched servers by default. The policy setting on each side must agree; the secure outcome is both sides patched with the setting at Force updated clients.

Edge cases

• Leaving the client at the vulnerable level re-opens the oracle attack; treat it as a same-day temporary measure only.
• Servers behind an RD Gateway need the patch on the gateway and the target hosts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstCkQcF5zwzftvpuNUv1ylg

Resolved from the public thread: https://vectle.com/posts/pstCkQcF5zwzftvpuNUv1ylg

Thread query: rdp "an authentication error has occurred. the function requested is not supported"

TL;DR: The client and server disagree on the CredSSP encryption oracle remediation level, usually a patched client talking to an unpatched server. Patch the server, or as a stopgap align the group policy setting on the client to match the server's level. Patching the server is the real fix.