Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Windows 7 clients connecting to the RDS running on Win server 2008 R2 very frequently get the error message "Because of an error in the data encryption, this session will end...".

This occurs if the Windows 7 clients are connected via WiFi, then use a VPN connection to get inside the firewall (this issue is on both PPTP VPN run by the Microsoft Routing and Remote Access and the IPSEC VPN run by the Cisco ASA 5510), this happens on every Win 7 client connecting (providing they are connected via WiFi), if they are connected to the internal WiFi this issue does not occur.

What is odd is that an XP client connecting exactly the same way (WiFi -> VPN -> RDC) does not experience this issue and connects fine every time.

I have done the following:

  • Tried both IPSEC and PPTP VPNs
  • All the MTU values are set to 1500 both ends,
  • the large send offload (called LSO & Jumbo Packets in the Advanced tab) on the 2k8 server has been disabled in the NIC (have also disabled the TCP Chimney Offload),
  • Disabled all checksum offloading in the NIC advanced settings
  • tried multiple versions of the NIC drivers on the 2k8 server,
  • tried multiple WiFi connections and the same happens everywhere,
  • tried multiple VPN clients (not just the Cisco VPN Client)
  • tried various combinations of the pre-fragmentation settings on the ASA
  • tried changing the encryption in the RDS connector
  • Deleted and resetup the RDS connector
  • Tried multiple different windows 7 clients with different Wireless NICs.
  • Tried removing all connections items from the LAN connector on the server (was only running with IPv4, File and Print Sharing, Client for Microsoft Networks).
  • Setup an wireless connection external to the network with an outside IP and reproduced the issue but when i moved that wireless point inside the network the issue went away as the VPN connection was no longer needed.

The server is an HP Proliant ML350 G6 (which uses the broadcom NetXtreme Gigabit Server Card), firewall is an ASA 5510.

Any one got any ideas? Im beginning to run dry.

Thanks for any help.

share|improve this question
add comment

3 Answers

The fact that XP stations are not seeing this but Win7 is, suggests to me that the fault lay within Network Level Authentication somewhere. This uses the CredSSP protocol. I don't think there is a way for the client to say to not attempt that, nor is there one on the server that I'm aware of.

share|improve this answer
1  
The client could try adding the enablecredsspsupport:0 switch to a custom RDP file. technet.microsoft.com/en-us/library/ff393716%28v=ws.10%29.aspx –  Greg Askew Mar 15 '12 at 18:00
add comment

May want to try the following:

"My Fix: Simply uninstall the Link-Layer Topology (Mapper I/O Driver and Responder) protocols, as well as the QoS Packet Scheduler service (you can add them back again afterwards) in the Local Area Connection of the client machine (not the server/target). You must uninstall, not simply remove the checkmark next to the protocol or service."

Taken from: http://social.technet.microsoft.com/Forums/windowsserver/en-US/1fe7892c-36c3-479a-8e51-cd7f94ea2e87/because-of-an-error-in-data-encryption-this-session-will-end

share|improve this answer
add comment

In my case, I had to uninstall (not uncheck, but uninstall) the component "Citrix DNE LightWeight Filter Driver" - also got rid of the following TightVNC error message: "pseudo encoding is not supported"

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.