RDP error “The function requested is not supported” after enabling NLA

ntlmrdpwindows-server-2012-r2

I'm trying to RDP into one of my servers, which as Network Level Authentication Enabled as well as NTLMv2 being forced. This worked fine until the server had to reboot for updates. Now, I cannot RDP into my server anymore. I get this error trying to connect via RDP:

An authentication error has occurred – The function requested is not supported
enter image description here

This translates to:
An authentication error has occurred.
The function requested is not supported

I tried several things I found by googling, for example adding extra SecurityPackages values to the registry as described here: http://funeasytech.com/rdp-connection-error-of-the-requested-security-package-does-not-exist/ but that didn't work. Neither did changing the Group Policy on the client solve my issue, as described here: https://stackoverflow.com/questions/17371311/the-function-requested-is-not-supported-exception-when-using-smtpclient-in-azu

The problem is that I don't have physical access to this box, only via RDP.
The server is running Windows Server 2012 R2 Standard, the client is running Windows 10 Pro.

How can I regain access to my server?

1:

Best Answer

I had the same issue. I found the issue has to do with a Windows Update patch that was pushed out to my work station in last nights Windows Updates. There was a critical CVE (CVE-2018-0886) for RDP which required a patch to fix.

If your workstation is patched, but your server isn't, your workstation will fail to connect.

Quoting from the following blog website with information about the issue, you've got three options:

  • Patch your target computer for CVE-2018-0886 (Recommended)
  • Enforce the Vulnerable parameter on the source computer (Not recommended)
  • Disable NLA on your target computer (Not recommended)

I didn't have alternative access to the server(remote access only), so I had to chose Option 2 so I could go do the updates on the server.

I opened the start menu on my work station, searched for "group policy", clicked Edit Group Policy. Then following Microsoft spec, Go to "Computer Configuration -> Administrative Templates -> System -> Credentials Delegation", then :

  • Setting Encryption Oracle Remedation set to "Enabled"
  • In Options below, set "Protection Level: to Vulnerable
Related Topic