Glossary
Remote Credential Guard
An RDP mode that redirects Kerberos requests back to the client, so the user's credentials are never sent to or stored on the remote host.
Remote Credential Guard protects credentials used over Remote Desktop. In a normal RDP session with Network Level Authentication, the client delegates the user's credentials to the server so single sign-on works inside the session, which leaves reusable secrets on the remote machine. With Remote Credential Guard, the server never receives them: Kerberos requests made inside the session are redirected back to the client device, which performs them. The user still gets single sign-on to network resources, but a compromised server cannot dump the password or long-term keys. It relies on Kerberos, so it does not work when a connection falls back to NTLM or targets an IP address, and it is started with mstsc /remoteGuard or enforced by policy.
It differs from Restricted Admin mode, which logs on with the server's own identity and gives no network SSO. On target hosts, allow both modes by setting DisableRestrictedAdmin to 0 under the LSA registry key, and on admin workstations use the "Restrict delegation of credentials to remote servers" policy to require one of them.
See RDP without exposing credentials and Hardening Remote Desktop.