9

I just installed the latest Windows update (NSA vulnerability patch tuesday) and now I cannot connect to remote desktop.

  • The server is remotely hosted. I don't have physical access. Server 2012 R1.
  • Fortunately all web sites are running ok after reboot.
  • I have not yet tried a second reboot because I'm a little scared to.
  • When I try to connect I immediately get this message:
  • "Remote Desktop Connection : An internal error has occured"

enter image description here

  • Have tried from multiple clients. They all fail - including an iOS app which in addition gives me a 0x00000904 error.
  • If I run telnet servername 3389 then it does initiate a connection, so I know the port is open.
  • I can connect just fine to other servers from my Win 10 (unpatched) machine.
  • I cannot connect from my second laptop either, which is Win 10 Creators edition.
  • Cannot find anything useful in Event Viewer.
  • I've even tried wireshark which didn't show me anything useful.
  • The best I have to diagnose is the ability to upload an ASPX page and run it.

I understand that the recent 'NSA edition' patch roundup had some RDP fixes - but I can't find anyone else who suddenly had issues hit week.

I want to have an idea what the problem is before I contact the hosting company, which is why I'm posting here.

Update:

While I still don't have physical server access I remembered I have a Windows 7 VM hosted on the server itself. I was able to get into this and open the server certificates snap-in by connecting to the 10.0.0.1 local IP.

This is showing that the RDP certificate is indeed expired - although I get no errors when connecting that suggest as such. I certainly have been connecting daily and since it expired 2 months ago my guess is that some kind of security update removed whatever other certificate was in the Remote Desktop store and it did not renew itself.

So trying to figure out a way to install a different cert here now.

Update 2

Finally found this in the event log under 'Administrative Events' (by connecting remotely via the VM) :

"The Terminal Server has failed to create a new self signed certificate to be used for Terminal Server authentication on SSL connections. The relevant status code was Object already exists."

This seems helpful, albeit a slightly different error. Can't reboot tonight though so will have to check again tomorrow.

https://blogs.technet.microsoft.com/the_9z_by_chris_davis/2014/02/20/event-id-1057-the-terminal-server-has-failed-to-create-a-new-self-signed-certificate/

enter image description here

Simon
  • 1,301
  • 2
  • 15
  • 19
  • 2
    It would be good if you told us exactly which update or updates you installed instead of referring to it as the `NSA vulnerability patch tuesday`. Not everyone cares to play "Mystery Update Theater 3000". – joeqwerty Apr 17 '17 at 01:09
  • I would love to tell you - but I just ran windows update and then it rebooted - and now I can't get in. 'Latest updates' that win 2k wanted to update is unfortunately all I can reveal of the mystery. I've been playing Theater 3000 all day trying to think of a strategy. Chances are if I get the hosting company to reboot it will be fine, but that feels like I locked myself out of my home and I'm sending a locksmith while I won't even be there. Thank God I have remote access for SQL server / FTP and all websites are running ok. If there's a command to run to see the updates I can try that – Simon Apr 17 '17 at 01:12
  • 1
    You might try looking at the Windows Update History and uninstalling updates one at a time (if they support uninstallation) until the problem resolves itself. Make note of which updates you're uninstalling so that you'll be able to identify which update is the suspect update. – joeqwerty Apr 17 '17 at 01:24
  • but I don't have access to the desktop to do that. that's the problem. I only have access to the command line via running a command through an ASPNET webpage. I'm trying to run systeminfo.exe to get the output now – Simon Apr 17 '17 at 01:25
  • Right. Forgot about that. My bad. Apologies. – joeqwerty Apr 17 '17 at 01:27
  • @joeqwerty no worries ;-) I'm just trying to be overly cautious and make sure there isn't some known issue. I'd much rather be able to tell the hosting company 'hey this is the problem' rather than whining to them that 'I can' connect'. My instinct tells me I've got about a 25% chance of a reboot just fixing it but not counting on it! – Simon Apr 17 '17 at 01:58

4 Answers4

9

The solution is basically here

https://blogs.technet.microsoft.com/askpfeplat/2017/02/01/removing-self-signed-rdp-certificates/

This helped too:

https://social.technet.microsoft.com/Forums/ie/en-US/a9c734c1-4e68-4f45-be46-8cae44c95257/unable-to-remote-desktop-to-windows-server-2012-due-to-failed-to-create-self-signed-certificate?forum=winserverTS

Assuming you have already verified that the certificate listed under Certificates > Remote Desktop > Certificates isn't valid ...

enter image description here

Note: I took this screenshot after I fixed everything - so this expiration date is the newly created cert that it did all by itself.

You basically then need to rename or delete this file - and then it will recreate it:

"C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_a54b3870-f13c-44bb-98c7-d0511f3e1757"

This is a well-known filename beginning in f686aace. Then restart the Remote Desktop Configuration service and it should recreate it. (Note: it may actually not be necessary to restart the service - just wait to see if it is recreated with the same filename for a minute).

It may take some messing around with permissions and you may need to take ownership of the file and then in addition apply permissions. Note: Ownership doesn't imply permissions. You must add permissions after taking ownership.

As I said I don't have physical access to the server - if you do then the above should suffice.

I was fortunate to be able to connect remotely via another machine on the same local networkand change the registry.

I wanted to DISABLE authentication so I could connect and gain access remotely. The registry entries to do this are HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

Set the existing keys SecurityLayer and UserAuthentication to 0

Create an RDP file (open mstsc and click Save after entering the servername) and in notepad add the line enablecredsspsupport:i:0 somewhere. This disables the expectation of security.

When you then run the RDP file it should allow you to UNSECURELY connect and gain access to your server.

As soon as you connect change these two registry entries back and then go ahead and delete the f686... file...

Simon
  • 1,301
  • 2
  • 15
  • 19
  • I am using the self-signed cert and never actually explicitly created an RDP cert. If you find this same issue then the solution may be slightly different if you created a cert youself. – Simon Apr 17 '17 at 10:57
  • Appears to be coincidental to the latest patches - and I had a few months worth anyway! – Simon Apr 17 '17 at 10:57
  • PS. excuse my disorganized answer - this just wasted a whole weekend. OK I'm done – Simon Apr 17 '17 at 12:14
  • Weird suddenly getting upvotes on this. Is a new update causing this again? – Simon Nov 16 '18 at 19:36
  • The first link does not seem to exist anymore. I get redirected to https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/bg-p/CoreInfrastructureandSecurityBlog – Tobi o' Bobi Sep 16 '20 at 09:19
3

These settings fixed my issue:

1.In Control Panel, click Administrative Tools, and then double-click Local Security Policy.

2.In Local Security Settings, expand Local Policies, and then click Security Options.

3.Under Policy in the right pane, double-click System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing, and then click Enabled. In my case it was disabled. So I just enabled it and issued the under listed command.

  1. Run gpupdate /force

Another option which will solve this problem:

The protocols were not enabled on the server. I used IIScrypto and enabled TLS1.2 and everything started working

Azhar Ali Buttar
  • 31
  • 4
0

None of these worked for me. I right clicked on the Windows symbol > Apps and Features > in search box type Remote Desktop Picked Remote Desktop > Advanced Options

Scrolled down to Reset, and Reset the application

Worked fine after that.

Odysseus Ithaca
  • 101
  • 2
-1

Hello everyone in my environment this was caused when a new self signed certificate was generated TLS 1.0 is either disabled in the registry or does not exist in the registry and the new self signed cert was not in the trusted root certification authorities store.

You can prove this two ways before editing the registry. download IIS Crypto and see what is enabled and disabled in Protocols, Ciphers, Hashes, and Key Exchanges.

Sometimes though IIS Crypto will show that TLS is enabled even though it is not enabled in the registry just an FYI.

Your next option is to turn on FIPS in Local group policy this forces TLS 1.0, 1.1, and 1.2 to be turned on and used. Turn on FIPS and then try to RDP into your machine it will work this time even if TLS is disabled in the registry. You don't want to use FIPS permanently though this is just for troubleshooting so disable it on the server and head to the registry.

Head to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL and under Protocols add three new keys title them TLS 1.0, TLS 1.1, and TLS 1.2 then create two sub keys under each TLS entry Title them Client and Server.

Inside the Client and Server keys create two 32bit DWORD entries one titled DisabledByDefault with the Value set to 0 and Enabled with the value set to 1.

Once you do this and your self signed cert is not expired and in the correct stores you will be able to RDP into your server again.

Daniele Santi
  • 2,479
  • 1
  • 25
  • 22
aaron johnson
  • 1
  • 1