Terminal Services Encryption Level is Medium or Low

Tenable plugin 57690 flags Windows Terminal Services / Remote Desktop Services when the host is configured with MinEncryptionLevel 1 (*Low*) or 2 (*Client Compatible / Medium*). In Microsoft’s own definitions, Low encrypts only client-to-server traffic with 56-bit strength, while Client Compatible encrypts both directions at whatever the client supports; High is 3 and FIPS is 4. Practically, the affected population is any Windows RDP listener using native RDP encryption with that setting, not a specific patched/unpatched software version.

Tenable’s MEDIUM is defensible in a vacuum, but too generous for enterprise prioritization. This weakness does not give an unauthenticated remote attacker code execution or host takeover; it mainly helps an attacker who is already on-path or already inside the network observe session data more easily. Microsoft also notes this policy applies only to native RDP encryption and is not the control for SSL/TLS-protected RDP, which means many modern RDP deployments have meaningful real-world friction before this matters.

Why this verdict

• Downgrade for attacker position: exploitation value requires an on-path adversary, not a clean unauthenticated remote shot from the internet.
• Downgrade for deployment narrowing: Microsoft states this encryption-level policy applies to native RDP encryption and not SSL/TLS encryption, so modern RDP stacks often blunt the issue before it matters.
• Keep it non-zero: Low can leave server-to-client data effectively exposed under native RDP, which is bad for privileged admin sessions and sensitive screen content.

Why not higher?

There is no direct code execution, no authentication bypass, and no host takeover path here. An attacker must first reach the service and then gain a useful interception position, which is a major compounding friction point that pushes this well below a true medium-priority break-in issue.

Why not lower?

This is still a real confidentiality weakness, especially when administrators use RDP from flat internal networks, branch links, or poorly controlled jump paths. If you still have raw RDP exposure or legacy native-RDP security settings, the downside is not theoretical.

1. Set RDP encryption to High — Push Set client connection encryption level to High (3) by GPO/MDM so native RDP sessions cannot fall back to Low or Client Compatible. Because this is a LOW verdict, there is no SLA; treat it as backlog hygiene and land it in the next Windows baseline cycle.
2. Force TLS-backed RDP — Use the SecurityLayer setting to prefer or require TLS/SSL-backed RDP rather than native RDP security, which is the mode this finding actually cares about. For a LOW verdict, fold this into your normal hardening program unless the host is unusually exposed.
3. Require NLA — Enable Network Level Authentication so only modern RDP clients can connect and unauthenticated session setup is reduced. This does not directly 'fix' plugin 57690, but it materially improves the surrounding RDP posture and should be included in the same baseline change.
4. Move admin RDP behind a gateway — Run administrative RDP through RD Gateway, VPN, or a managed jump tier so the reachable population and interception surface both shrink. Since this finding is LOW, schedule it through architecture hygiene unless the service is directly internet-facing.

Run this on the Windows target host from an elevated PowerShell session. Example: powershell -ExecutionPolicy Bypass -File .\check-rdp-encryption.ps1; local Administrator is recommended because the script queries root\cimv2\terminalservices and related policy/registry state.

# check-rdp-encryption.ps1

# Verifies whether the local RDP listener is configured with a weak encryption level

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'Stop'

function Out-Result {
    param(
        [string]$Status,
        [int]$Code,
        [string]$Message
    )
    Write-Output "$Status - $Message"
    exit $Code
}

try {
    $ts = Get-CimInstance -Namespace 'root/cimv2/terminalservices' -ClassName 'Win32_TSGeneralSetting' -Filter "TerminalName='RDP-tcp'"
    if (-not $ts) {
        Out-Result 'UNKNOWN' 2 'RDP-Tcp listener not found in Win32_TSGeneralSetting.'
    }

    $encMap = @{ 1='Low'; 2='ClientCompatible'; 3='High'; 4='FIPS' }
    $secMap = @{ 1='RDP'; 2='Negotiate'; 3='SSL'; 4='Other' }
    $nlaMap = @{ 0='Disabled'; 1='Enabled' }

    $enc = [int]$ts.MinEncryptionLevel
    $sec = [int]$ts.SecurityLayer
    $nla = [int]$ts.UserAuthenticationRequired

    $encName = $encMap[$enc]
    if (-not $encName) { $encName = "Unknown($enc)" }
    $secName = $secMap[$sec]
    if (-not $secName) { $secName = "Unknown($sec)" }
    $nlaName = $nlaMap[$nla]
    if (-not $nlaName) { $nlaName = "Unknown($nla)" }

    $policyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
    $rdpTcpPath  = 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp'

    $gpMin = $null
    $gpSec = $null
    if (Test-Path $policyPath) {
        $p = Get-ItemProperty -Path $policyPath -ErrorAction SilentlyContinue
        if ($null -ne $p.MinEncryptionLevel) { $gpMin = [int]$p.MinEncryptionLevel }
        if ($null -ne $p.SecurityLayer) { $gpSec = [int]$p.SecurityLayer }
    }

    $regMin = $null
    $regSec = $null
    if (Test-Path $rdpTcpPath) {
        $r = Get-ItemProperty -Path $rdpTcpPath -ErrorAction SilentlyContinue
        if ($null -ne $r.MinEncryptionLevel) { $regMin = [int]$r.MinEncryptionLevel }
        if ($null -ne $r.SecurityLayer) { $regSec = [int]$r.SecurityLayer }
    }

    $details = @(
        "MinEncryptionLevel=$encName($enc)",
        "SecurityLayer=$secName($sec)",
        "NLA=$nlaName($nla)",
        "PolicyMinEncryptionLevel=" + ($(if ($null -ne $gpMin) { $gpMin } else { 'unset' })),
        "PolicySecurityLayer=" + ($(if ($null -ne $gpSec) { $gpSec } else { 'unset' })),
        "RegistryMinEncryptionLevel=" + ($(if ($null -ne $regMin) { $regMin } else { 'unset' })),
        "RegistrySecurityLayer=" + ($(if ($null -ne $regSec) { $regSec } else { 'unset' }))
    ) -join '; '

    if ($enc -eq 1 -or $enc -eq 2) {
        Out-Result 'VULNERABLE' 1 $details
    }
    elseif ($enc -eq 3 -or $enc -eq 4) {
        Out-Result 'PATCHED' 0 $details
    }
    else {
        Out-Result 'UNKNOWN' 2 $details
    }
}
catch {
    Out-Result 'UNKNOWN' 2 $_.Exception.Message
}

Sources

1. Tenable Nessus Plugin 57690
2. Microsoft Learn - RemoteDesktopServices Policy CSP
3. Microsoft Learn - Win32_TSGeneralSetting class
4. Microsoft Security Blog - Security guidance for remote desktop adoption
5. GreyNoise - RDP scanning concentration report
6. Nmap NSE - rdp-enum-encryption
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS FAQ