How to Create Intune Encryption Oracle Remediation Policy

Here, this post will help you in the creation of the Intune Encryption Oracle Remediation Policy. We’ll make use of Intune’s Settings Catalog to install this policy. We are making use of Configuration Profiles of Intune in the creation of this policy.

The Encryption Oracle Remediation policy setting applies to applications utilizing the CredSSP component, such as Remote Desktop Connection. Certain versions of the CredSSP protocol may be susceptible to an encryption Oracle attack on the client.

This policy governs the compatibility between vulnerable clients and servers, allowing you to specify the desired level of protection against the encryption oracle vulnerability. Enabling this policy setting provides options for CredSSP version support:

1. Force Updated Clients: Client applications using CredSSP will be restricted from reverting to insecure versions, and services employing CredSSP will reject unpatched clients. Note: Deployment of this setting should be deferred until all remote hosts support the latest version.
2. Mitigated: Client applications using CredSSP won’t be able to revert to insecure versions, but services utilizing CredSSP will still accept unpatched clients. Refer to the provided link for crucial information on the risks associated with retaining unpatched clients.
3. Vulnerable: Client applications using CredSSP may expose remote servers to attacks by allowing fallback to insecure versions, and services utilizing CredSSP will accept unpatched clients.

Windows CSP Details AllowEncryptionOracle

We will see Windows CSP Details for this Policy setting AllowEncryptionOracle. Applications utilizing CredSSP on the client side will be prevented from reverting to insecure versions, and services employing CredSSP will reject unpatched clients when this setting is enabled.

It is advisable not to deploy this setting until all remote hosts have adopted the latest version. Achieving this involves ensuring that all Microsoft security updates, at least through May 2018, are installed.

CSP URI – ./Device/Vendor/MSFT/Policy/Config/ADMX_CredSsp/AllowEncryptionOracle

• Intune Audit Security Group Management Policy
• Easy Way to Create Intune Audit User Account Management Policy

Intune Encryption Oracle Remediation Policy

To create an Encryption Oracle Remediation Policy, follow the steps stated below:

• Sign in to the Intune Admin Center portal https://intune.microsoft.com/.
• Select Devices > Windows > Configuration profiles > Create a profile.

In Create Profile, I select Windows 10 and later in Platform, I choose the Profile Type as Settings catalog. Click on the Create button.

On the Basics tab pane, I named the policy “Encryption Oracle Remediation Policy.” Optionally, if you want, you can enter a policy description and proceed by selecting “Next“.

Now, in Configuration Settings, Click Add Settings to browse or search the catalog for the settings I want to configure.

In the Settings Picker windows. I searched for the keyword Credentials Delegation. I found the category Administrative Templates\System\Credentials Delegation and selected this.

• I see the sub-category Encryption Oracle Remediation. After selecting that, click the cross mark at the right-hand corner, as shown below.

Here in Administrative Templates, after Enabling the Encryption Oracle Remediation, we get three options for Protection Level: (Device) as mentioned below:

• Force Updated Clients
• Mitigated
• Vulnerable

As recommended and discussed above in the post, I am choosing Force Updated Clients.

Using Scope tags, you can assign a tag to filter the profile to specific IT groups. One can add scope tags (if required). More details on Intune Scope Tags Implementation Guide.

• Click Next to continue.

Now in Assignments, in Included Groups, you need to click on Add Groups and choose Select Groups to include one or more groups. Click Next to continue.

In the Review + Create tab, I review settings. After clicking on Create, changes are saved, and the profile is assigned.

After successfully creating the policy, a notification will appear in the top right-hand corner confirming the action. You can also verify the policy’s existence by navigating to the Configuration Profiles list, where it will be prominently displayed.

Your groups will receive your profile settings when the devices check in with the Intune service. The Policy applies to the device.

Intune Report for Encryption Oracle Remediation Policy

From the Intune Portal, you can view the Intune settings catalog profile report, which provides an overview of device configuration policies and deployment status.

To track the assignment of the policy, you need to select the relevant policy from the Configuration Profiles list, which is the Encryption Oracle Remediation Policy. Then, you can review the device and user check-in status to determine whether the policy has been successfully applied.

• If you require more detailed information, you can click on “View Report” to access additional insights.

Intune MDM Event Log – Encryption Oracle Remediation Policy

To verify the successful implementation of String or integer policies for the Encryption Oracle Remediation Policy on Windows 10 or 11 devices through Intune, you can leverage event IDs 813 and 814.

These event IDs provide valuable insights into the Encryption Oracle Remediation Policy‘s application status and the specific value assigned to the policy on those devices. In the case of this particular policy, the value is String and is linked to the event ID 814.

By analyzing these event IDs, you can clearly understand the policy’s application status and the corresponding value associated with it on the devices in question.

To confirm this, you can check the Event log path – Applications and Services Logs – Microsoft – Windows – Devicemanagement-Enterprise-Diagnostics-Provider – Admin.

MDM PolicyManager: Set policy string, Policy: (AllowEncryptionOracle), Area: (ADMX_CredSsp), EnrollmentID requesting merge: (5B88AEF1-09E8-43BB-B144-7254ACBBDF3E), Current User: (Device), String: (<enabled/><data id=”AllowEncryptionOracleDrop” value=”0″/>), Enrollment Type: (0x6), Scope: (0x0).

When I opened the above Event log, I found that the Encryption Oracle Remediation Policy I applied to the device was successfully implemented.

• By reviewing the log entry shown in the above image, the Event Viewer, I came across essential information, including the Area and Enrollment ID.

These details play a significant role in identifying the corresponding registry path. To locate the specific information, please consult the table provided below:

Area	Policy	String	Scoped	Event ID
ADMX_CredSsp	AllowEncryptionOracle	Enabled	Device	814

The details presented in the table above for the How to Create Intune Encryption Oracle Remediation Policy can be employed to access the registry settings that hold the group policy configurations on a specific computer. To accomplish this, you can execute “REGEDIT.exe” on the target computer and navigate to the precise registry path where these settings are stored.

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\providers\5B88AEF1-09E8-43BB-B144-7254ACBBDF3E\default\Device\ADMX_CredSsp

When you navigate the above path in the Registry Editor, you will find the registry key named AllowEncryptionOracle. Also, when I navigated to the above path, I saw that the Registry Key was created successfully.

Registry Name	Data
AllowEncryptionOracle	Enabled

We are on WhatsApp. To get the latest step-by-step guides and news updates, Join our Channel. Click here –HTMD WhatsApp.

Author

Abhinav Rana is working as an SCCM and Intune Admin with several years of experience. He loves to help