0X80090350

Fix SEC_E_DOWNGRADE_DETECTED (0x80090350) in 3 steps

Cybersecurity & Malware Intermediate 👁 0 views 📅 Jul 18, 2026

This error means Windows blocked a connection because it thinks someone's trying to make it use older, unsafe encryption. Fix it in 3 steps, from easy to advanced.

What's this error about?

SEC_E_DOWNGRADE_DETECTED (0x80090350) shows up when you try to connect to a remote computer, usually via Remote Desktop (RDP), and Windows throws a fit. It says the system detected a possible attempt to compromise security. Translation: Windows thinks someone's trying to trick it into using old, weak encryption (like TLS 1.0) instead of the modern stuff (TLS 1.2 or 1.3). This often happens after a Windows update, especially around CredSSP changes.

I know this error is infuriating. It usually appears right when you need to fix something remotely. Let's get you back in.

Quick fix (30 seconds): Check your Remote Desktop client version

This is the first thing to try. Sometimes the remote computer is fine, but your local RDP client is outdated. Windows 10 version 1903 and older RDP 8.0 clients really struggle here.

On your local Windows PC:

  1. Open Settings (Win + I).
  2. Go to System > About.
  3. Check your Windows version. If it's 1903 or older, update Windows.
  4. When updating, go to Settings > Update & Security > Windows Update and click Check for updates.

Also update the Remote Desktop Connection app from the Microsoft Store. Sometimes that's all it needs. If the error disappears, you're done. If not, move to the next step.

Moderate fix (5 minutes): Adjust Local Group Policy on the remote computer

Most of the time, this error is because the remote computer's Group Policy is set to reject older encryption. But you're connecting from a modern Windows PC, which should be fine. The trick: you need to tell the remote computer to accept connections that use updated CredSSP.

On the remote computer (or via a different admin method):

  1. Press Win + R, type gpedit.msc, and hit Enter.
  2. Go to Computer Configuration > Administrative Templates > System > Credentials Delegation.
  3. Double-click Encryption Oracle Remediation.
  4. Set it to Enabled.
  5. In the Protection Level drop-down, choose Mitigated. This tells Windows to block connections from old clients but allow modern ones.
  6. Click OK and close Group Policy.
  7. Open Command Prompt as admin and run gpupdate /force.

Now try your RDP connection again. If it still fails, go harder.

Advanced fix (15+ minutes): Registry edit on the remote computer

If Group Policy didn't help, someone (maybe IT) set a registry key that locks things down tighter. You can override it. Warning: editing the registry is risky. Back it up first.

On the remote computer (or use PsExec or an offline registry editor if you can't RDP):

  1. Press Win + R, type regedit, and hit Enter.
  2. Go to:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters
  3. If CredSSP or Parameters keys don't exist, create them. Right-click the parent key, choose New > Key, and name it.
  4. In the Parameters key, look for a DWORD called AllowEncryptionOracle.
  5. If it's there, double-click it and set the value to 2. If it's not there, right-click the right pane, choose New > DWORD (32-bit), name it AllowEncryptionOracle, and set value to 2.
  6. Close Registry Editor.
  7. Restart the remote computer.

What does value 2 mean? It means Mitigated. It lets modern RDP clients connect even if the remote machine is paranoid. Don't set it to 0 (Force updated clients) or 1 (Vulnerable) — those cause the same error or leave you open to attacks.

Real-world scenario: When does this happen most?

I've seen this error pop up most often after installing the KB4480960 update from January 2019 on Windows Server 2019 or Windows 10 1809. That update tightened CredSSP defaults. If you're running an older RDP client on a newer server, boom — you get 0x80090350.

Still stuck?

If none of these fixes work, check the remote computer's firewall. Sometimes a security suite blocks RDP after detecting the 'downgrade attempt'. Temporarily disable it to test. Also, make sure both PCs have the same TLS version enabled. On the remote computer, run gpedit.msc > Computer Configuration > Administrative Templates > Network > SSL Configuration Settings — ensure TLS 1.2 is enabled.

This error is a pain, but you've got this. Start with the quick fix and work your way down.

Was this solution helpful?

SEC_E_DOWNGRADE_DETECTED 0x80090350 TLS downgrade attack Windows security error credential guard error Remote Desktop connection failed RDP security error Schannel error 0x80090350 fix TLS downgrade Windows 10 fix TLS downgrade Windows 11 CredSSP update Group Policy TLS setting registry fix 0x80090350