Skip to content

CredSSP Error on outgoing RDP (Post Level-1 Member Server Hardening) #65

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kacummings opened this issue Apr 8, 2025 · 0 comments
Open
Labels
question Further information is requested

Comments

@kacummings
Copy link

kacummings commented Apr 8, 2025

Question
I am running the following against a single Windows Server 2022 system with all the latest updates.

ansible-playbook -i ../inventory.yml site.yml --tags level1-memberserver

This runs successfully against any server, which is great, but afterwards the server can no longer make outgoing RDP connections to other (new and patched) Windows Server 2022 systems. These remote systems are at the same patch level, and they can RDP to the hardened system. It's only outgoing attempts from the hardened system.

I get the following error:
Remote Desktop Connection
An authentication error has occurred. The function is not supported.
Remote Computer: [ip address]
This could be due to CredSSP encryption oracle remediation.

Everything points me to the following group policy object to fix the issue, but it doesn't work.
Admin Templates > System > Credentials Delegation > Encyption Oracle Remediation (set to Vulnerable, or 2 in registry)

For the life of me I can't figure this one out. It has to be related to another change being made with Level-1, but there are too many to revert one at a time.

The level-2 member server option does NOT cause this issue. Anyone else experience this?

Environment (please complete the following information):

  • Ansible Version: ansible [core 2.16.3]
@kacummings kacummings added the question Further information is requested label Apr 8, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
question Further information is requested
Projects
None yet
Development

No branches or pull requests

1 participant