{"id":1509,"date":"2019-11-29T10:58:28","date_gmt":"2019-11-29T10:58:28","guid":{"rendered":"https:\/\/www.liainfraservices.com\/blog\/?p=1509"},"modified":"2021-02-04T11:06:32","modified_gmt":"2021-02-04T11:06:32","slug":"failed-to-rdp-the-target-vm-instance-on-azure","status":"publish","type":"post","link":"https:\/\/www.liainfraservices.com\/blog\/failed-to-rdp-the-target-vm-instance-on-azure\/","title":{"rendered":"Failed to RDP the target VM\/instance on Azure\/AWS post-migration."},"content":{"rendered":"<\/span> 3<\/span> min read<\/span><\/span>
<\/span> 4,539<\/span><\/div>\n

Failed to RDP the target VM\/instance on Azure post migration?<\/p>\n\n\n\n

You have received an error message “RDP to the target VM fail” Post-migration of windows server from on-premises to the cloud. However, the RDP to the target VM<\/a> was failing with an error message.<\/p>\n\n\n\n

An authentication error has occurred. The function requested is not supported. Remote computer: <computer name or IP>. This could be due to CredSSP encryption oracle remediation. For more information, see <\/em>https:\/\/go.microsoft.com\/fwlink\/?linkid=866660<\/em><\/a>.<\/em>

<\/p><\/blockquote>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Most Importantly, the Credential Security Support Provider protocol (CredSSP) is an authentication provider that processes authentication requests for other applications.<\/p>\n\n\n\n

Especially, when one tries to establish an insecure RDP connection, the above error comes up. Therefore, to protect any attack to the server, that insecure RDP connection gets blocked by an Encryption Oracle Remediation policy setting on the server.<\/p>\n\n\n\n

Meanwhile, we have to understand the above error is not only because the target VM or the server is blocking the RDP connection. But it also can be possible that the client machine itself is not updated with the latest update for CredSSP.
<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

There are two scenarios possible:<\/h4>\n\n\n\n

Scenario 1: Updated clients cannot communicate with non-updated servers<\/strong>
<\/h3>\n\n\n\n

The client has CredSSP update installed, and the Encryption Oracle Remediation policy setting does not allow an insecure RDP connection to a server that does not have the CredSSP update installed.<\/p>\n\n\n\n

Nevertheless, to work around this issue follow these steps:<\/p>\n\n\n\n

  1. On the client has the CredSSP update installed, run gpedit.msc<\/strong>, and then browse to Computer Configuration > Administrative Templates > System > Credentials Delegation in the navigation pane<\/strong>. <\/li>
  2. Change the Encryption Oracle Remediation policy to Enabled<\/li>
  3. Change Protection Level to Vulnerable.<\/li><\/ol>\n\n\n\n

    In fact, The same operations are performed with the registry tool.<\/p>\n\n\n\n

    1. Open a Command Prompt window as Administrator.<\/li>
    2. Run the following command to add a registry value:
      REG ADD HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\CredSSP\\Parameters\\ \/v AllowEncryptionOracle \/t REG_DWORD \/d 2<\/li><\/ol>\n\n\n\n

      Scenario 2: Non-updated clients cannot communicate with patched servers<\/strong><\/h3>\n\n\n\n

      Initially, when the target VM(Server) has this update installed, it restricted from receiving non-updated clients, <\/p>\n\n\n\n

      Following steps change the <\/strong>Encryption Oracle Remediation policy<\/strong><\/em> setting:<\/strong><\/p>\n\n\n\n

      1. On any Windows computer that has PowerShell installed, add the IP of the VM to the “trusted” list in the host file:
        Set-item wsman:\\localhost\\Client\\TrustedHosts -value <IP><\/li>
      2. For AWS or Azure, ensure the NSG \/ the Security Group to PowerShell ports 5985 and 5986.<\/li>
      3. On the Windows computer, connect to the VM by using PowerShell:
        For HTTP:<\/strong>
        $Skip = New-PSSessionOption -SkipCACheck -SkipCNCheck Enter-PSSession -ComputerName “<<Public IP>>” -port “5985” -Credential (Get-Credential) -SessionOption $Skip

        For HTTPS:<\/strong>
        $Skip = New-PSSessionOption -SkipCACheck -SkipCNCheck Enter-PSSession -ComputerName “<<Public IP>>” -port “5986” -Credential (Get-Credential) -useSSL -SessionOption $Skip<\/li>
      4. Run the following command to change the Encryption Oracle Remediation policy setting by using the registry:
        Set-ItemProperty -Path ‘HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\CredSSP\\Parameters’ -name “AllowEncryptionOracle” 2 -Type DWord<\/li><\/ol>\n\n\n\n
        More details:<\/strong><\/h5>\n\n\n\n

        Why are we getting this: Microsoft came up with an update KB4103727<\/em><\/strong> as a security update to prevent any insecure RDP connection.<\/p>\n\n\n\n

        As a result, the same windows update need to be there on both the client machine & on the target or server machine.
        <\/p>\n\n\n\n

        There are multiple workarounds for this issue:<\/strong><\/h4>\n\n\n\n

        Choice 1:<\/strong> <\/p>\n\n\n\n

        For instance, the update is installed by the client and not on the server (Eg: EC2 instance)<\/p>\n\n\n\n