Problem Description
When you log in to a Windows instance through a remote desktop connection, the following error message may appear:
- An authentication error occurred. Invalid flags were provided to the feature.
- An authentication error occurred. The requested feature is not supported.
Issue Analysis
Microsoft released a security update in March 2018 to address a remote code execution vulnerability in CredSSP by correcting the protocol and the way requests are validated during authentication. Both the client and the server must install this update; otherwise, the issue can occur.
The following three scenarios cause remote connection failure:
- Scenario 1: Client not patched, server updated, policy set to Force updated clients.
- Scenario 2: Server not patched, client updated, policy set to Force updated clients.
- Scenario 3: Server not patched, client updated, policy set to Mitigate.
If you only want to upgrade the client locally, please refer to Solution 1: Install security updates (recommended).
Logging in to the CVM via VNC
- Log in to the CVM console.
- On the instance management page, find the target CVM instance and click Log In.
- In the pop-up Log in to Windows Instance window, select Other methods (VNC) and click Log in now.
- In the login window that pops up, select Send Remote Command in the upper left corner and click Ctrl-Alt-Delete to enter the system log-in interface.
Solution 1: Install Security Updates (Recommended)
Install security updates to update unpatched clients or servers.
- Windows Server 2012: Control Panel > System and Security > Windows Update
- Windows Server 2008: Start > Control Panel > System and Security > Windows Update
- Windows 10:
> Settings > Update & Security - Windows 7:
> Control Panel > System and Security > Windows Update
Steps:
- Click
and select Settings. - In the Settings window, select Update & Security.
- In Windows Update, click Check for updates.
- Follow the interface instructions and click Start Installation.
- After installation, restart the instance.
Solution 2: Modifying the Policy
On machines with the security update installed, set the Encryption Oracle Remediation policy to Vulnerable.
Windows 10 Home does not have Group Policy Editor; use Solution 3 to modify the registry.
Steps:
- Press Win+R, enter gpedit.msc, and press Enter to open the Local Group Policy Editor.
- Navigate:
Computer Configuration > Administrative Templates > System > Credentials Delegation - Double-click Encryption Oracle Remediation, select Enabled, and set Protection Level to Vulnerable.
- Click OK and restart the instance.
Solution 3: Modifying the Registry
- Press Win+R, enter regedit, and press Enter to open the Registry Editor.
- Navigate or create the path:
Computer > HKEY_LOCAL_MACHINE > SOFTWARE > Microsoft > Windows > CurrentVersion > Policies > System > CredSSP > Parameters - Right-click Parameters, select New > DWORD (32-bit) Value, and name it
AllowEncryptionOracle. - Double-click
AllowEncryptionOracle, set Value data to2, and click OK. - Restart the instance.
> Settings > Update & Security
> Control Panel > System and Security > Windows Update