How to use Remote Desktop to access Windows Server 2012 from Windows 7 with TLS 1.0 Disabled

After securing a Windows Server 2012 box with TLS 1.0 disabled per PCI-DSS 3.1 requirements, I found that I could only connect to it through Remote Desktop (RDP) from a Windows 8.1 or Windows 10 client.

The problem was this: all attempts to connect through the LAN via Remote Desktop from Windows 7 were met with "This computer can't connect to the remote computer. Try connecting again...etc."

The Server 2012 Standard (not R2) computer is running the most simple Remote Desktop mode accessed through Computer/Remote Settings as shown below.

I went through rabbit trails with firewall settings, Remote Desktop Services (which I did not install) turning on and off the 'Allow connections only from computers running Remote Desktop with Network Level Authentication', using Select Users - none of them worked.

During extensive searching I ran across a some discussions of TLS and RDP on Windows 7. I found that we had RDP 7.1 on the Windows 7 sp1 computer and RDP 8.0 was an optional download through Windows update. RDP 8 apparently has support for later TLS versions beyond the disabled  TLS 1.0. RDP 8 for Windows 7 is discussed here: https://support.microsoft.com/en-us/kb/2592687.

Solution: After installing the KB2592687 update (an optional update in Windows update), rebooting and installing even more updates triggered by that update, RDP 8.0 client was installed and connected normally to the Windows 2012 server.

There is also an RDP 8.1 client only update KB2830477 that I may install later but for now I can Remote Desktop in to the Server 2012 box from Windows 7 without any apparent problems.

More info on RDP 8.1 for Windows 7 including prerequisites: http://blogs.msdn.com/b/rds/archive/2013/11/12/remote-desktop-protocol-8-1-update-for-windows-7-sp1-released-to-web.aspx

How to install Wireshark on Windows 8

The title of this could also be "How to install WinPcap on Windows 8" or "How to install NetScanTools Pro on Windows 8". WinPcap is the packet capture driver used in both Wireshark and NetScanTools Pro (and LE). If you try to run the Wireshark installer, everything appears to install OK until you get to the WinPcap installer that it launches separately. The WinPcap installer refuses to run and shows an error about an unsupported operating system.

The solution is to run your installer in compability mode. Here's how:

1. from within Windows 8 (32 or 64 bit) get to the desktop and launch Windows Explorer.

2. locate your installer file, example: wireshark-win32-1.6.2.exe and right click on it to bring up the menu.

3. select "Troubleshoot compatibility" and wait a few seconds for it to do it's thing. Then click on "Try recommended settings". It will most likely show Windows Compatibility Mode of Windows XP (service pack 3).

4. Click on "Test the program..." the installer will start - follow the installer directions as you normally would. When you get to actually running the WinPcap installer you may see a message "This program has compatibility issues" - select "Run the program without getting help". WinPcap should now install.

5. When it's all done, click on Cancel instead of Next back on the Program Compatibility Troubleshooter window.

The problem is not Wireshark or NetScanTools Pro. Those installers both launch the WinPcap installer. It is the WinPcap installer that needs to be updated.

The good part about this is that now Wireshark now properly captures packets and NetScanTools Pro can both send and receive packets using WinPcap.

Update Oct 10, 2012: winpcap.org still shows version 4.1.2. With the public release of Windows 8 only a couple weeks away, we still are waiting on an updated WinPcap installer.