{"id":770,"date":"2026-09-19T23:40:08","date_gmt":"2026-09-19T23:40:08","guid":{"rendered":"https:\/\/windows-vps.org\/blog\/?p=770"},"modified":"2026-09-19T23:40:08","modified_gmt":"2026-09-19T23:40:08","slug":"rdp-connection-failures-credssp-nla-certificate-event-ids","status":"publish","type":"post","link":"https:\/\/windows-vps.org\/blog\/rdp-connection-failures-credssp-nla-certificate-event-ids\/","title":{"rendered":"RDP Connection Failures: Diagnosing CredSSP, NLA, and Certificate Errors by Event ID"},"content":{"rendered":"\n

Most RDP failures arrive with one of five on-screen messages, and each one narrows the cause to a handful of components. Rather than guessing at firewall rules or reinstalling the Remote Desktop Services role, map the message to a Windows event and work backward. The logs that matter are on the server, not the client.<\/p>\n\n\n\n

Error Message to Event ID Map<\/h2>\n\n\n\n
Client message<\/th>Where to look<\/th>Root cause class<\/th><\/tr><\/thead>
"An authentication error has occurred. The function requested is not supported"<\/td>Client: Event 36871 in System log<\/td>CredSSP encryption oracle remediation mismatch<\/td><\/tr>
"The remote computer requires Network Level Authentication"<\/td>Server: Event 4625 in Security log<\/td>NLA enabled server, client cannot pre-auth<\/td><\/tr>
"Your credentials did not work" after a correct password<\/td>Server: 4625 with status 0xC000006D<\/td>Account lockout, NLA, or restricted logon type<\/td><\/tr>
"An internal error has occurred"<\/td>Server: TermDD Event 56, or 1058<\/td>Certificate or licensing service fault<\/td><\/tr>
Connection hangs at "Securing remote connection"<\/td>Both: TLS handshake, then 36888<\/td>Certificate\/TLS version negotiation failure<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Enable the client-side operational log before you reproduce the failure, or you will be diagnosing from memory: eventvwr.msc<\/code> → Applications and Services Logs → Microsoft → Windows → TerminalServices-ClientActiveXCore. On the server use RemoteDesktopServices-RdpCoreTS and RemoteConnectionManager.<\/p>\n\n\n\n

Fix 1: CredSSP Encryption Oracle Remediation<\/h2>\n\n\n\n

This is the most common failure after a Windows Update cycle. The server enforces Mitigated<\/code> or Force Updated Clients<\/code> while the client is on an older build that still proposes the vulnerable version. Client Event 36871 names the exact mismatch. The fix belongs on the client<\/em> side wherever possible — patching is always better than relaxing the server. Only if you cannot patch an embedded or legacy endpoint should you adjust the server policy, and then to Mitigated<\/code>, never Vulnerable<\/code>:<\/p>\n\n\n\n

reg add "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\CredSSP\\Parameters" \/v EncryptionOracleRemediation \/t REG_DWORD \/d 2 \/f<\/code><\/pre>\n\n\n\n
Reboot is not required, but the client must reconnect. Set the same value on CredSSP\\Client<\/code> if you are relaxing a client temporarily during migration, and remove the exception once the patch lands.<\/p>\n\n\n\n
Fix 2: NLA Enabled but Client Cannot Pre-Authenticate<\/h2>\n\n\n\n
NLA forces authentication before a session is allocated, which is a genuine security gain and should stay enabled. When it breaks, the cause is usually one of three things: the user is not permitted the Remote Desktop Users<\/code> membership that NLA requires, the account is a local account on a machine whose NLA path expects domain credentials, or CredSSP itself is failing. Confirm the requirement before loosening anything:<\/p>\n\n\n\n
Get-ItemProperty "HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp" `\n  -Name UserAuthentication<\/code><\/pre>\n\n\n\n
A value of 1 means NLA is required. Turning it off to make a client work is a downgrade that exposes the logon screen to pre-auth; fix the credential path instead when the endpoint is internet-facing.<\/p>\n\n\n\n
Fix 3: Certificate and "Internal Error" Failures<\/h2>\n\n\n\n