Quick answer: This Remote Desktop error usually means your PC and the remote computer disagree on a security update to CredSSP, the protocol that passes your sign-in to the remote side. The real fix is to install updates on the remote computer. If you can’t reach it any other way, you can let your own PC fall back temporarily, connect, update the remote computer and then undo the change. On Windows 11 24H2 and later, the same dialog can also point at blocked NTLM sign-in, which needs a different fix.
In this guide
Read the whole message first
The dialog starts with An authentication error has occurred. The function requested is not supported. The lines underneath tell you which path to follow:
- This could be due to CredSSP encryption oracle remediation: start with Cause 1.
- This could be due to NTLM authentication being blocked on the remote computer: newer Windows 11 builds show this line too, sometimes with the CredSSP line. If the remote computer is fully updated, go to Cause 2.
- If the person on the remote side sees The token supplied to the function is invalid, it’s the same mismatch seen from an older, unpatched client.
On your PC you can confirm the CredSSP case in Event Viewer: open Windows Logs > System and look for Event ID 6041 from LsaSrv saying a CredSSP authentication failed to negotiate a common protocol version.
Cause 1: CredSSP update mismatch
In 2018 Microsoft fixed a CredSSP flaw, CVE-2018-0886, that could let an attacker relay your credentials and run code on the remote machine. Since the May 2018 updates, Windows defaults to a setting called Mitigated: an updated PC refuses to connect to a remote computer that never got the fix. Today that usually means an old server, a virtual machine built from an old image, or a PC that hasn’t updated in years. The fix itself has been part of every cumulative update since then.
Fix 1: Update the remote computer
Microsoft’s recommended fix is to update and restart every affected system. Ways to reach the remote computer without Remote Desktop:
- Sit at it, or ask someone on site to run Settings > Windows Update and install everything. If updates stall, see how to force Windows Update.
- For a cloud virtual machine, use the provider’s console or run-command feature to install updates.
- If you can reach it with PowerShell remoting or another remote tool, install updates from the command line; see Windows Update from the command line.
To check the remote computer’s newest installed update in PowerShell, run:
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5If nothing recent shows up, the remote machine is the problem. Once it’s updated and restarted, connect again with your normal settings.
Fix 2: Temporary client workaround
When updating the remote computer requires connecting to it first, Microsoft documents a stopgap: set your own PC’s Encryption Oracle Remediation level to Vulnerable. Microsoft warns that this exposes remote servers to attack, so use it only long enough to connect and install updates.
On Windows Pro, Enterprise or Education: press Win + R, run gpedit.msc, open Computer Configuration > Administrative Templates > System > Credentials Delegation, double-click Encryption Oracle Remediation, choose Enabled, set Protection Level to Vulnerable and select OK.
On any edition, including Home: open Command Prompt as administrator and run:
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" /v AllowEncryptionOracle /t REG_DWORD /d 2 /fRestart your PC, connect, update the remote computer and restart it. Then undo the change on your PC: set the policy back to Not Configured or Mitigated, or run the command again with /d 1, and restart. Microsoft’s values are 0 for Force Updated Clients, 1 for Mitigated and 2 for Vulnerable.
Microsoft also lists turning off Network Level Authentication on the remote host as a workaround that reduces security. It needs access to the host’s settings anyway, at which point updating it is the better use of that access.
Cause 2: NTLM blocked, no Kerberos path
Microsoft is phasing out the older NTLM sign-in method in favour of Kerberos, and many organizations already restrict it. Users on Microsoft Q&A report that when NTLM is denied by the Network security: Restrict NTLM policies, or after some upgrades to Windows 11 24H2, fully updated PCs show this exact dialog. Microsoft hasn’t published a fix specific to it, so treat these as reported workarounds:
- Connect using the computer’s full name, such as
pc01.corp.example.com, not its IP address. Kerberos usually needs a name it can match to the computer, and an IP address falls back to NTLM. - Make sure your PC can reach a domain controller, for example by connecting the VPN before you open Remote Desktop.
- Try signing in as
DOMAIN\usernameinstead ofusername@domain, which some users found fixed it after the 24H2 upgrade. - If you manage the network, check whether a Group Policy denies NTLM on the client (outgoing) or the server (incoming), and add an exception for that server rather than allowing NTLM everywhere.
Non-domain PCs, such as a home PC reaching a work laptop by IP, have no Kerberos path at all, so they rely on NTLM. If that’s your setup and the error started after an update, check the remote PC’s sign-in rights too; see “To sign in remotely, you need the right to sign in”.
Cause 3: Remote Credential Guard or Restricted Admin
If you start Remote Desktop with mstsc /remoteGuard or mstsc /RestrictedAdmin, or a policy under Credentials Delegation > Restrict delegation of credentials to remote servers requires them, the connection has stricter rules. According to Microsoft Learn, Remote Credential Guard needs Kerberos with no NTLM fallback, a direct connection without a Remote Desktop Gateway or Connection Broker, and an Active Directory-joined target. Restricted Admin also requires your account to be an administrator on the remote computer. Microsoft doesn’t map these to this exact message, but if your setup breaks one of the rules, try a normal mstsc connection to rule it out.
Fixes to avoid
- Uninstalling updates: older guides name 2018 updates to remove. Every cumulative update since includes the CredSSP fix, and removing current updates leaves your PC exposed.
- Leaving the policy on Vulnerable: it was meant as a short bridge. Set it back once the remote computer is updated.
- Turning off the firewall or Network Level Authentication for good: neither fixes CredSSP, and both weaken the remote computer.
Different messages need different fixes: the April 2026 Caution: Unknown remote connection prompt is a warning about .rdp files, and The Local Security Authority cannot be contacted is a separate error. Admins managing these policies across PCs can use the Group Policy Management Console.
Related guides
- “To sign in remotely, you need the right to sign in through Remote Desktop Services”: fix
- Windows Update from the Command Line: CMD and PowerShell Commands
- How to force Windows Update to check and install updates
- Group Policy Management Console on Windows 11: how to install and open it
Leave a Reply