-
제목
Windows 11 RDP failures following Microsoft update KB5064081 and KB5065426 -
설명
Following a Windows update, the RDP sessions using Safeguard fail. RDP sessions that bypass Safeguard are successful.
August 29, 2025—KB5064081 (OS Build 26100.5074) Preview August 29, 2025—KB5064081 (OS Build 26100.5074) Preview - Microsoft Support
September 9, 2025 - KB5065426 (OS Build 26100.6584) September 9, 2025—KB5065426 (OS Build 26100.6584) - Microsoft SupportThis is causing RDP Sessions to fail on One Identity Safeguard for Privileged Sessions, Safeguard for Privileged Sessions On Demand and PAM Essentials.
-
원인
The log related error in an SPS Support Bundle is shown as follows:
CSSP Packet contains NTSTATUS error code; error_code='80090308'
CSSP Packet; version='6', tokens='0'
CSSP errorCode; value='0x80090308'
Failed to mangle SPNEGO message; status='5', last_msg='NULL'
Failed to mangle CredSSP packet;
Error parsing incoming data;
-
해결 방안
RESOLUTION - One Identity Safeguard for Privileged Sessions
A Hotfix is available to resolve this issue in the following versions and is available for download now.
This hotfix can be applied in the WebUI using the following steps. After you have downloaded the Hotfix it needs to be unzipped first.
- Navigate to Basic Settings > System > Firmwares
- Under the Upload new hotfix: section, click Choose File and select the hotfix file you want to upload.
- Click Upload
- If installation is successful, SPS will list information about the hotfix under Installed hotfixes:, such as Name, Version and Description.
NOTE:
This will need to be applied to each node in the environment.
Once the hotfix is applied the service handling RDP traffic will be automatically restarted.
This means all current RDP connections will be terminated and will need to be reestablished.IMPORTANT - The hotfix should NOT be installed on a Search Master node as RDP traffic should not be routed through a Search Master. The RDP service is not running. If the hotfix is installed on a Search Master a reboot should be scheduled.
As an emergency, you can run the following command until a restart can be scheduled.#systemctl stop zorp@scb_rdp.service
Upload will fail in the following cases:- The hotfix file version does not pass the version check.
- The hotfix file package is not properly signed by our Support Team.
- The file you want to upload is not an appropriate .deb package or the file is corrupted.
If upload fails, SPS will revert to its previous state automatically.
RESOLUTION - Safeguard for Privileged Sessions On Demand
HotFixes will be applied to environments as soon as possible.
RESOLUTION - PAM ESSENTIALS
This issue has been fixed within the product.