DocsICP FilingConsole
官方文档
首页

Resolve the "An authentication error has occurred. The function requested is not supported" error

更新时间：
复制 MD 格式
产品详情
我的收藏

This article describes the symptoms, causes, and solutions for the error "An authentication error has occurred. The function requested is not supported", which may occur when you use Remote Desktop Connection to connect to a Windows-based Simple Application Server.

Symptoms

When you use Remote Desktop Connection on an on-premises device to connect to a Windows-based Simple Application Server, you receive the following error message: "An authentication error has occurred. The function requested is not supported."

Cause

In May 2018, Microsoft released updates for the Credential Security Support Provider protocol (CredSSP) that changed the authentication request process. Connection failures can occur if this update is not applied consistently on both the on-premises device and the Simple Application Server.

This connection error occurs in one of the following scenarios:

  • Scenario 1: The update is not installed on the on-premises device, but it is installed on the Simple Application Server, and the server's Encryption Oracle Remediation policy is set to Force Updated Clients.

    To resolve this error, see Solution 1: Allow remote desktop connections.

  • Scenario 2: The update is installed on the on-premises device with its Encryption Oracle Remediation policy set to Force Updated Clients, but the update is not installed on the Simple Application Server.

    To resolve this error, see Solution 2: Install the update or Solution 3: Modify the registry.

  • Scenario 3: The update is installed on the on-premises device with its Encryption Oracle Remediation policy set to Mitigated, but the update is not installed on the Simple Application Server.

    To resolve this error, see Solution 2: Install the update or Solution 3: Modify the registry.

Note

  • Not installed: Refers to a system that has not installed any of the CredSSP-related updates released since May 2018.

  • Installed: Refers to a system that has installed one or more of the CredSSP-related updates released since May 2018.

  • For more information about the Encryption Oracle Remediation policy settings, see CredSSP updates for CVE-2018-0886.

Solutions

You can resolve this issue by allowing Remote Desktop connections to the server, installing the required update, or modifying the registry. The following sections provide detailed instructions.

Solution 1: Allow remote desktop connections

The steps may vary slightly across different Windows versions. This section provides instructions for Windows Server 2008 R2, Windows Server 2012 R2, and Windows Server 2016 Datacenter Edition.

Windows Server 2008 R2

  1. Connect to the Simple Application Server using Virtual Network Console (VNC).

    For instructions, see Connect to a server by using Virtual Network Console (VNC).

  2. Click Start, right-click Computer, and then select Properties.

  3. In the Control Panel Home area, click Remote settings.

  4. In the System Properties dialog box, select Allow connections from computers running any version of Remote Desktop (less secure), and then click OK.

Windows Server 2012 R2

  1. Connect to the Simple Application Server using Virtual Network Console (VNC).

    For instructions, see Connect to a server by using Virtual Network Console (VNC).

  2. Click the win2012开始图标 Start icon, right-click This PC, and then select Properties.

  3. On the Control Panel Home page, click Remote settings.

  4. On the Remote tab, clear the checkbox for Allow connections only from computers running Remote Desktop with Network Level Authentication (recommended), and then click OK.

Windows Server 2016 Datacenter Edition

  1. Connect to the Simple Application Server using Virtual Network Console (VNC).

    For instructions, see Connect to a server by using Virtual Network Console (VNC).

  2. Click the Dingtalk_20210510142550.jpg Start icon, and then click Windows System.

  3. Right-click This PC, and then select More > Properties.

  4. On the Control Panel Home page, click Remote settings.

  5. On the Remote tab, clear the checkbox for Allow connections only from computers running Remote Desktop with Network Level Authentication (recommended), and then click OK.

Solution 2: Install the update

This example uses Windows Server 2016. The steps are similar for other Windows versions.

  1. Connect to the Simple Application Server using Virtual Network Console (VNC).

    For instructions, see Connect to a server by using Virtual Network Console (VNC).

  2. Click the Dingtalk_20210510142550.jpg Start icon, and then click Settings.

  3. On the Windows Settings page, click Update & Security.

  4. On the Update Status page, click Check for updates. Wait for the update to download and install.

    Note

    To manually install the security update package for CredSSP, go to the Microsoft Update Catalog and download the appropriate package for your system.

  5. On the Simple Application Server, select the Dingtalk_20210510142550.jpg Start icon > the 电源管理 Power icon > Restart to restart the server and apply the changes.

Solution 3: Modify the registry

This solution is for when your on-premises device is updated but the Simple Application Server is not. The following example uses Windows Server 2016, but the steps are similar for other versions. Choose one of the following methods to modify the server's registry.

Warning

Modifying the registry incorrectly can cause serious problems with your Windows operating system. You assume all risks associated with this action. Before you begin, we strongly recommend that you back up your server by creating a snapshot. For instructions on how to create a snapshot, see Create a snapshot.

(Recommended) Modify the registry using a script

  1. Connect to the Simple Application Server using Virtual Network Console (VNC).

    For instructions, see Connect to a server by using Virtual Network Console (VNC).

  2. Open Command Prompt.

    1. Right-click the Dingtalk_20210510142550.jpg Start icon and select Run.

    2. In the Run dialog box, enter cmd.

    3. Click OK.

      The Command Prompt window opens.

      Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.

C:\Users\Administrator>

  3. Run the following command to enter PowerShell: 

    powershell

  4. Run the following PowerShell script to modify the registry: 

    New-Item -Path HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name CredSSP -Force
New-Item -Path HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP -Name Parameters -Force
Get-Item -Path HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters | New-ItemProperty -Name AllowEncryptionOracle -Value 2 -PropertyType DWORD -Force

  5. On the Simple Application Server, select the Dingtalk_20210510142550.jpg Start icon > the 电源管理 Power icon > Restart to restart the server and apply the changes.

    Note

    If you use this method and later install the security updates on both your on-premises device and the Simple Application Server, we recommend setting the Value data of AllowEncryptionOracle to 0 or 1 for higher security. For details about the Value data of AllowEncryptionOracle, see CredSSP updates for CVE-2018-0886.

Manually modify the registry

  1. Connect to the Simple Application Server using Virtual Network Console (VNC).

    For instructions, see Connect to a server by using Virtual Network Console (VNC).

  2. Open Registry Editor.

    1. Right-click the Dingtalk_20210510142550.jpg Start icon and select Run.

    2. In the Run dialog box, enter regedit.

    3. Click OK.

      The Registry Editor window opens.

  3. In Registry Editor, navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters. Set the Value data for the AllowEncryptionOracle entry to 2.

    Note

    For details about the Value data of the AllowEncryptionOracle entry, see CredSSP updates for CVE-2018-0886.

    If the CredSSP or Parameters keys do not exist, create them. Then, create a new REG_DWORD value named AllowEncryptionOracle. If both the CredSSP and Parameters keys are missing, follow these steps:

    1. Create the CredSSP key under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.

      1. Right-click an empty area in the right pane, and select New > Key.

      2. Name the new key CredSSP and press Enter.

    2. Create the Parameters key under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP.

    3. Under the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters key, create a new DWORD (32-bit) Value named AllowEncryptionOracle.

    4. Modify the Value data of the AllowEncryptionOracle entry.

      1. Right-click the AllowEncryptionOracle entry and select Modify....

      2. In the dialog box, set the Value data to 2 and then click OK.

  4. On the Simple Application Server, select the Dingtalk_20210510142550.jpg Start icon > the 电源管理 Power icon > Restart to restart the server and apply the changes.

References

CVE-2018-0886 | CredSSP Remote Code Execution Vulnerability

Previous：Error when accessing a website built with Pagoda Panel: 'Your request did not find a corresponding site on the web server'Next：What do I do if I fail to log on to a Linux simple application server and the "login: Module is unknown" error is reported?