Ok so I'm trying to remove a number of my systems from our Nessus scan from having this medium vulnerability.
Microsoft Windows Remote Desktop Protocol Server Man-in-the-Middle Weakness
I set the following GPO setting:
Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Require Use of Specific Security Layer for Remote (RDP) Connections: SSL (TLS 1.0)
Once I do this my Windows 7 clients no longer have the Nessus problem however RDP no longer works from Linux or Windows clients. I get the following errors:
From clients:
Linux:
[ryan@gobo ~]$ rdesktop -0 win7
Autoselected keyboard map en-us
ERROR: recv: Connection reset by peer
Windows:
"the connection cannot proceed becuase authentication is not enabled
One the server system (Windows 7 box running RDP):
Log Name: System
Source: TermDD
Date: 4/9/2012 4:28:58 PM
Event ID: 50
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: gobo-vm
Description:
The RDP protocol component X.224 detected an error in the
protocol stream and has disconnected the client.
and this one:
Log Name: System
Source: Schannel
Date: 4/9/2012 4:07:54 PM
Event ID: 36870
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: gobo-vm
Description:
A fatal error occurred when attempting to access the SSL server
credential private key. The error code returned from the
cryptographic module is 0x8009030d. The internal error state is
10001.
I've seen solutions on this being a permission problem with the cert, as in the Network Service account doesn't have permission to access it but I can't find where the cert is on the filesystem to check it.
Other than that I'm out of ideas/options. I look for the wise here.