RDP without exposing credentials: RCG and Restricted Admin

A normal Remote Desktop connection sends your credentials to the server so that it can sign you in and act as you. That is what makes single sign-on to file shares work from inside the session. It also means an administrator who connects to a compromised server leaves reusable credentials in that server's LSASS: an NTLM hash, Kerberos tickets and keys. For an attacker who already has local admin on a member server, waiting for a privileged RDP logon is one of the most reliable ways to escalate.

Two features change that. Restricted Admin mode signs you in without sending reusable credentials at all. Remote Credential Guard keeps the credentials on your client and redirects Kerberos requests back to it. This guide shows how to enable them on both ends, force their use, and check that they are actually in effect. For the transport side of RDP (NLA, TLS, who may connect, port exposure), see RDP hardening.

How the modes compare

Remote Credential Guard is the better default for administrators. Restricted Admin is the fallback when Kerberos is not available or the client and server are not in trusting domains.

Both features are a good complement to Credential Guard on the server. Credential Guard makes secrets harder to extract from LSASS; these modes mean the secrets are never there in the first place.

Step 1: allow the modes on the servers

Both modes are disabled on the target by default. The relevant value is:

Key:   HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Value: DisableRestrictedAdmin  (REG_DWORD) = 0

Setting it to 0 allows incoming Restricted Admin and Remote Credential Guard connections. Via Group Policy, use Computer Configuration > Policies > Administrative Templates > System > Credentials Delegation > Remote host allows delegation of non-exportable credentials set to Enabled on every server and admin target. This writes AllowProtectedCreds = 1 under HKLM\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation and has the same effect for incoming connections.

Deploy it with the same GPO you use for member server hardening, and include jump hosts. There is no downside on the server: a client that does not request these modes still connects normally.

Step 2: require the modes on admin clients

Allowing is not enough; the client decides which mode to request. On privileged access workstations and admin jump hosts, set Computer Configuration > Policies > Administrative Templates > System > Credentials Delegation > Restrict delegation of credentials to remote servers to Enabled and choose a mode:

The policy writes RestrictedRemoteAdministration = 1 and a RestrictedRemoteAdministrationType value under HKLM\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation. Restrict Credential Delegation is the practical choice during rollout: admins are never sent in default mode, and servers that only support Restricted Admin still work. Once every server supports Remote Credential Guard, move to Require Remote Credential Guard.

In Intune, search the settings catalog for Credentials Delegation; both the client and server settings are exposed there as ADMX-backed policies.

Individual admins can also request a mode per connection, which is useful for testing:

mstsc.exe /remoteGuard /v:srv-app01.corp.example
mstsc.exe /restrictedAdmin /v:srv-app01.corp.example

Step 3: check the prerequisites for Remote Credential Guard

Remote Credential Guard fails in ways that look like generic RDP errors. The usual causes:

• The client cannot reach a domain controller. Kerberos requests are redirected back to the client, which then needs line of sight to a DC. Admins on a VPN that does not route to DCs will fail.
• The target is addressed by IP. Kerberos needs a service principal name; connect by DNS name.
• Saved credentials. Remote Credential Guard accepts the signed-in credentials or credentials typed at the prompt, but not credentials saved in Credential Manager. Signing in to the PAW with the admin account for that tier is still the cleaner tiering design.
• Trust. Client and server must be in the same domain or in domains with a trust.
• Target join type and path. The target must be joined to Active Directory; Remote Credential Guard cannot be used to Microsoft Entra joined targets (an Entra joined client can connect to an AD-joined host if it can get Kerberos tickets). It only works for direct connections, not through Remote Desktop Connection Broker or Remote Desktop Gateway.
• Client app. It needs the Remote Desktop Windows client (mstsc.exe); the Remote Desktop UWP app does not support it.

Step 4: reduce the Restricted Admin risk

Restricted Admin has a known trade-off: it logs on with a network-style authentication, so an administrator's NTLM hash is enough to open an RDP session to a server that allows it. That is the "pass-the-hash over RDP" technique. Mitigate it with controls you should already have:

• Put human admin accounts in Protected Users, which refuses NTLM for them. See admin tiering and Protected Users.
• Use the tiering Deny log on through Remote Desktop Services rights so each admin account can only reach its own tier.
• Prefer Require Remote Credential Guard once your servers support it, since it requires Kerberos.

Step 5: remove the other credential delegation paths

The Credentials Delegation policy node also controls CredSSP, which by design delegates reusable credentials. Review these settings on clients:

• Allow delegating default credentials, Allow delegating saved credentials and Allow delegating fresh credentials: leave them not configured unless a specific service needs them, and when it does, scope the server list tightly (for example TERMSRV/rds-farm.corp.example, never TERMSRV/* or *).
• Encryption Oracle Remediation: keep it at Force Updated Clients so unpatched CredSSP endpoints are refused.

Also enable Do not allow passwords to be saved under Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Connection Client, so admins do not keep RDP passwords in Credential Manager. The cached logons and WDigest guide covers the wider stored-credential settings.

What breaks

• Double-hop access under Restricted Admin. File shares, SQL and other resources are reached as the server's computer account. Scripts that expect to run as the admin fail or, worse, succeed with the server's permissions.
• Saved RDP credentials, and connections through RD Gateway or Connection Broker, under Require Remote Credential Guard.
• Connections by IP address or over VPNs without DC access under Remote Credential Guard.
• Non-admin RDP users under Restricted Admin, since the mode requires local admin on the target.
• Some third-party RDP clients and connection managers that do not implement these modes. Test your tools, including browser-based gateways.

Verify it

1. On the server. Security event 4624 with Logon Type 10 (RemoteInteractive) includes a Restricted Admin Mode field and, on current builds, a Remote Credential Guard field. For privileged accounts, one of them should read Yes.
2. Inside the session. Run klist. Under Remote Credential Guard you still get service tickets for network resources as yourself; under Restricted Admin, network access happens as the computer account.
3. Configuration drift. Check DisableRestrictedAdmin on servers and RestrictedRemoteAdministrationType on admin clients through a compliance script.

Get-WinEvent -FilterHashtable @{LogName="Security"; Id=4624} -MaxEvents 200 |
  Where-Object { $_.Properties[8].Value -eq 10 } |
  Select-Object TimeCreated, @{n="User";e={$_.Properties[5].Value}}, Message -First 20

Look for privileged accounts with Restricted Admin Mode: No and Remote Credential Guard: No. Those are the connections that left credentials behind.

Checklist

• DisableRestrictedAdmin = 0 (or "Remote host allows delegation of non-exportable credentials") on all servers
• PAWs and jump hosts set to Restrict Credential Delegation, then Require Remote Credential Guard
• Admins sign in to the PAW with the tier admin account and connect by DNS name
• Admin accounts in Protected Users to close pass-the-hash over Restricted Admin
• CredSSP default and saved credential delegation not configured or tightly scoped
• RDP client not allowed to save passwords
• Event 4624 type 10 reviewed for privileged logons without either mode

This is one of the cheapest ways to stop an attacker on a Tier 1 server harvesting admin credentials. It belongs in the Credential Protection series next to Remote Credential Guard in the glossary.