Time to Say Goodbye: Microsoft Phases Out PPTP and L2TP VPN Protocols in Windows Server

PPTP and L2TP VPN protocols have long been lauded for their excellent compatibility, supported by most operating systems and even routers over the years.

However, due to their age, the security of these protocols has been a concern. Consequently, Microsoft recently announced the deprecation of PPTP and L2TP protocols in the Windows Server operating system.

The PPTP protocol is vulnerable to offline brute force attacks by capturing authentication hashes, while the L2TP protocol lacks encryption unless used in conjunction with protocols like IPSec, making it inherently insecure.

Microsoft advises users, including enterprises, to transition to newer protocols such as Secure Socket Tunneling Protocol (SSTP) and Internet Key Exchange version 2 (IKEv2), which offer improved performance and security.

In an official announcement, Microsoft stated:

This change is part of Microsoft's strategy to enhance security and performance by transitioning users to more robust protocols. These modern protocols offer superior encryption, faster connection speeds, and better reliability, making them more suitable for today's complex network environments.

Microsoft also highlighted the advantages of each protocol:

SSTP Protocol Benefits:

• Strong Encryption: Uses SSL/TLS for secure communication channels.
• Firewall Compatibility: Easily penetrates most firewalls and proxy servers, ensuring seamless connections.
• Ease of Use: With native support in Windows, SSTP is easy to configure and deploy.

IKEv2 Protocol Benefits:

• High Security: Employs strong encryption algorithms and robust authentication techniques.
• Mobility and Multihoming: Especially effective for mobile users, maintaining VPN connections despite network changes.
• Improved Performance: Establishes faster tunnels and lower latency compared to traditional protocols.

Deprecation Doesn't Mean Immediate Removal:

Deprecation indicates that Microsoft will cease further development of these products or features but will not immediately remove support from affected products.

PPTP and L2TP protocols will still be usable in Windows Server, but Microsoft advises against their continued use and plans to eventually remove support for these protocols entirely.

Furthermore, as part of the deprecation, future Windows RRAS (VPN) servers will no longer accept incoming PPTP and L2TP protocols, though outgoing connections will still be possible.

Lastly:

While Windows 10/11 and other non-server versions haven't deprecated these protocols, considering Windows Server's move, it's conceivable that Microsoft might eventually eliminate them from Windows 10/11 as well.