Terminal Services Encryption Level is not FIPS-140 Compliant

Tenable plugin 30218 is a configuration/compliance check on Windows Terminal Services / Remote Desktop Services, not a software flaw with a vendor patch. It fires when the host's RDP configuration is not set to FIPS-compliant mode—typically when MinEncryptionLevel is not 4 and the system FIPS policy is not enabled. In practice, that can apply to a broad range of Windows client and server builds wherever RDP is enabled, because the condition is about how RDP is configured, not about a vulnerable version range.

For most enterprises, Tenable's LOW is still generous; the real operational severity is IGNORE in a patch-priority queue unless you are in a formal FIPS boundary. The missing setting does not by itself give an attacker code execution, authentication bypass, or session decryption. Microsoft also recommends avoiding native RDP encryption in favor of SSL/TLS, and current DISA guidance for mainstream Windows hardening emphasizes High encryption for RDP sessions rather than blindly forcing FIPS everywhere.

Why this verdict

• Requires the wrong problem statement: an attacker does not win by discovering MinEncryptionLevel != 4; they still need a separate RDP weakness, credential path, or MITM position.
• Reachable population is narrower than the plugin implies: the condition is not reliably externally observable when TLS/Negotiate is used, so internet-wide exploit scaling is weak.
• Modern controls dominate the risk: NLA, TLS, MFA on jump hosts, segmentation, and exposure management are what materially change breach probability here—not the FIPS flag.

Why not higher?

There is no public evidence that this setting alone yields remote code execution, auth bypass, or deterministic session compromise. The attack chain needs additional prerequisites that are both environment-specific and usually more important than this finding itself.

Why not lower?

It is still worth recording because some regulated environments genuinely require FIPS-validated operation, and the finding can represent a real audit gap there. Also, if a host is using weak or legacy RDP security settings more broadly, this plugin can be a hint that the RDP baseline deserves review.

1. Enforce TLS and NLA for RDP — Prioritize the controls that change breach likelihood: require TLS-backed RDP where supported, require NLA, and keep RDP behind managed access paths. For an IGNORE verdict there is no vulnerability SLA action, so handle this as baseline hardening rather than emergency remediation.
2. Restrict RDP exposure — Limit 3389 to jump hosts, VPN, bastions, or administrative subnets and remove unnecessary direct exposure. This addresses the real attack surface immediately, whereas FIPS-only tuning mostly addresses audit language.
3. Route FIPS-only gaps to the compliance owner — If the asset is in a formal FIPS boundary, track this under your configuration-compliance program and validate the exact approved mode required by the platform's security policy. That keeps patch governance focused on exploitable defects while still closing audit findings.

Run this on the target Windows host or through your normal remote administration channel, for example: powershell -ExecutionPolicy Bypass -File .\check-rdp-fips.ps1. Standard local read access to the registry is usually enough; administrator rights are only needed if your environment restricts those keys.

# check-rdp-fips.ps1

# Verifies the condition behind Tenable plugin 30218.

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'

function Get-RegDword {
    param(
        [string]$Path,
        [string]$Name
    )
    try {
        $item = Get-ItemProperty -Path $Path -Name $Name -ErrorAction Stop
        return [int]$item.$Name
    }
    catch {
        return $null
    }
}

$policyTsPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
$liveTsPath   = 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp'
$fipsPath     = 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy'
$rdpCorePath  = 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server'

# Prefer policy values when present because they override local settings.

$policyMin = Get-RegDword -Path $policyTsPath -Name 'MinEncryptionLevel'
$liveMin   = Get-RegDword -Path $liveTsPath   -Name 'MinEncryptionLevel'
$effMin    = if ($null -ne $policyMin) { $policyMin } else { $liveMin }

$policySec = Get-RegDword -Path $policyTsPath -Name 'SecurityLayer'
$liveSec   = Get-RegDword -Path $liveTsPath   -Name 'SecurityLayer'
$effSec    = if ($null -ne $policySec) { $policySec } else { $liveSec }

$fipsEnabled    = Get-RegDword -Path $fipsPath    -Name 'Enabled'
$denyTsConn     = Get-RegDword -Path $rdpCorePath -Name 'fDenyTSConnections'

# Helpful labels

$secLabel = switch ($effSec) {
    0 { 'RDP' }
    1 { 'Negotiate' }
    2 { 'SSL/TLS' }
    default { 'Unknown/Unset' }
}

Write-Host ('Effective SecurityLayer    : {0} ({1})' -f $effSec, $secLabel)
Write-Host ('Effective MinEncryptionLevel: {0}' -f $effMin)
Write-Host ('System FIPS policy enabled  : {0}' -f $fipsEnabled)
Write-Host ('RDP connections disabled    : {0}' -f $denyTsConn)

# If RDP is disabled, the plugin condition is not operationally relevant.

if ($denyTsConn -eq 1) {
    Write-Host 'UNKNOWN - RDP is disabled on this host; plugin applicability is operationally moot.'
    exit 2
}

# Tenable-style pass condition: FIPS policy enabled or MinEncryptionLevel explicitly set to 4.

if (($fipsEnabled -eq 1) -or ($effMin -eq 4)) {
    Write-Host 'PATCHED - Host is configured for FIPS-compliant RDP operation.'
    exit 0
}

# If TLS is enforced and encryption is High or better, the plugin may still fail,

# but the practical risk is compliance-only rather than exploitability.

if (($effSec -eq 2) -and ($effMin -ge 3)) {
    Write-Host 'UNKNOWN - TLS/High RDP is configured; not FIPS-compliant by this check, but practical security risk is not demonstrated.'
    exit 2
}

Write-Host 'VULNERABLE - Host is not configured for FIPS-compliant RDP encryption per plugin 30218.'
exit 1

Sources

1. Tenable Nessus Plugin 30218
2. Microsoft Learn - RemoteDesktopServices Policy CSP
3. Microsoft Learn - Troubleshoot establishing Terminal Services session
4. Microsoft Learn - System cryptography: Use FIPS compliant algorithms
5. Microsoft Learn - Windows FIPS 140 validation
6. Microsoft Learn - Remote Assistance connection with FIPS encryption issue
7. STIG Viewer - Remote Desktop Services encryption level finding
8. NIST CSRC - Cryptographic Module Validation Program