Relation between CredSSP and SHA

Question

When I disable SHA in registry HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA, I am unable into Windows Server 2012 R2 without turning off CredSSP.

This is the confusing part. SHA is disabled as part of my server hardening, and CredSSP is a security protocol, so it should not be affected. Can anyone shed some light on the relation between CredSSP and SHA?

Context

CredSSP (Credential Security Support Provider) protocol is a Security Support Provider that is implemented by using the Security Support Provider Interface. CredSSP lets an application delegate the user's credentials from the client to the target server for remote authentication. CredSSP provides an encrypted TLS Protocol channel.

To turn off CredSSP, either use a RDP app, or add these two lines into the RDP connection file:

enablecredsspsupport:i:0
authentication level:i:0

Update

I just found out that my RDP connection's signature hash algorithm is sha1. This is the only relation I have found out so far. Happy to have more insights from people with experience in this.

Answer 1

The "SHA" module in Windows Server is the module that identifies, compares and processes SHA signatures, just as much as the connection you're using.

RDP uses the SHA module to identify and compare showed and received files to ensure integrity, as example.

Without the SHA module, RDP indeed doesn't work, since it depends on it being there.