Ok so I'm trying to remove a number of my systems from our Nessus scan from having this medium vulnerability.
I set the following GPO setting:
Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Require Use of Specific Security Layer for Remote (RDP) Connections: SSL (TLS 1.0)
Once I do this my Windows 7 clients no longer have the Nessus problem however RDP no longer works from Linux or Windows clients. I get the following errors:
[ryan@gobo ~]$ rdesktop -0 win7 Autoselected keyboard map en-us ERROR: recv: Connection reset by peer
"the connection cannot proceed becuase authentication is not enabled
One the server system (Windows 7 box running RDP):
Log Name: System Source: TermDD Date: 4/9/2012 4:28:58 PM Event ID: 50 Task Category: None Level: Error Keywords: Classic User: N/A Computer: gobo-vm Description: The RDP protocol component X.224 detected an error in the protocol stream and has disconnected the client.
and this one:
Log Name: System Source: Schannel Date: 4/9/2012 4:07:54 PM Event ID: 36870 Task Category: None Level: Error Keywords: User: SYSTEM Computer: gobo-vm Description: A fatal error occurred when attempting to access the SSL server credential private key. The error code returned from the cryptographic module is 0x8009030d. The internal error state is 10001.
I've seen solutions on this being a permission problem with the cert, as in the Network Service account doesn't have permission to access it but I can't find where the cert is on the filesystem to check it.
Other than that I'm out of ideas/options. I look for the wise here.