Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In order to make compliance with our PCI-DSS requirements, I was required to disable TLS 1.0 (apparently it has a flaw that was corrected in TLS 1.1 and higher). However, after doing so, remote desktop fails to connect to that server. Is there a way to connect to remote desktop servers without TLS? Perhaps configure remote desktop for a newer version of TLS?

share|improve this question
    
The workaround is documented here. –  David Schwartz Dec 27 '12 at 20:33
    
It's already configured as described in the link and does not work. Throws a "Because of an error in data encryption, this session will end." error. –  Brian Knoblauch Dec 27 '12 at 20:42

2 Answers 2

up vote 2 down vote accepted

Did you got that solved? If not try the following:

  1. run the IIS Crypto from Nartac on the affected server (or do all the stuff the tool made by hand, thats also possible e.g. via regestry)
  2. leave TLS 1.0 enabled
  3. change the cipher in the list and disable all CBC cipher (the ones with CBC in it)
  4. restart the server.

That should do the trick, as currently only the CBC cipher are affected by the breast attack.

share|improve this answer

Disable Large Send Offload for IPv4 on your NIC. If that fixes it, contact your server/NIC vendor for a fix.

share|improve this answer
    
+1. Seen that myself with 2008 when it was frash - DRAP DUMN STUPID DRIVERS. A version later it was fixed - somehow they had mised that in their quality testing. Calculated wrong checksums. REALLY hard to get - i mean, that happened like every minute. I really wonder they still are around (those crappy drivers). –  TomTom Dec 27 '12 at 21:08
1  
Well, that's not it unfortunately. Nice try, thanks for playing. Who's up next? :-) –  Brian Knoblauch Dec 28 '12 at 12:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.