When I disable SHA in registry HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA
, I am unable into Windows Server 2012 R2 without turning off CredSSP.
This is the confusing part. SHA is disabled as part of my server hardening, and CredSSP is a security protocol, so it should not be affected. Can anyone shed some light on the relation between CredSSP and SHA?
Context
CredSSP (Credential Security Support Provider) protocol is a Security Support Provider that is implemented by using the Security Support Provider Interface. CredSSP lets an application delegate the user's credentials from the client to the target server for remote authentication. CredSSP provides an encrypted TLS Protocol channel.
To turn off CredSSP, either use a RDP app, or add these two lines into the RDP connection file:
enablecredsspsupport:i:0
authentication level:i:0
Update
I just found out that my RDP connection's signature hash algorithm is sha1. This is the only relation I have found out so far. Happy to have more insights from people with experience in this.