Remote Credential Guard protects Remote Desktop credentials in Windows 10

All scheme administrators users convey 1 rattling genuine trouble organisation – securing credentials over a Remote Desktop connection. This is because malware tin uncovering their agency to whatever other reckoner over the desktop connexion in addition to pose a potential threat to your data. That is why Windows OS flashes a alert “Make certain yous trust this PC, connecting to a untrusted reckoner mightiness terms your PC” when yous endeavour to connect to a remote desktop. In this post, nosotros volition meet how the Remote Credential Guard feature, which has been introduced in Windows 10 v1607, tin assist protect remote desktop credentials inwards Windows 10 Enterprise in addition to Windows Server 2016.

Remote Credential Guard inwards Windows 10

The characteristic is designed to eliminate threats earlier it develops into a serious situation. It helps yous protect your credentials over a Remote Desktop connexion yesteryear redirecting the Kerberos requests dorsum to the device that’s requesting the connection. It besides provides unmarried sign-on experiences for Remote Desktop sessions.

In the resultant of whatever misfortune where the target device is compromised, credentials of the user are non exposed because both credential in addition to credential derivatives are never sent to the target device.

The modus operandi of Remote Credential Guard is rattling like to the protection offered yesteryear Credential Guard on a local motorcar except for Credential Guard besides protects stored domain credentials via the Credential Manager.

An private tin utilization Remote Credential Guard inwards the next ways-

1. Since Administrator credentials are highly privileged, they must live on protected. By using Remote Credential Guard, yous tin live on assured that your credentials are protected every bit it does non let credentials to overstep over the network to the target device.
2. Helpdesk employees inwards your organisation must connect to domain-joined devices that could live on compromised. With Remote Credential Guard, the helpdesk employee tin utilization RDP to connect to the target device without compromising their credentials to malware.

Hardware in addition to software requirements

To enable smoothen performance of the Remote Credential Guard, ensure the next requirements of Remote Desktop customer in addition to server are met.

1. The Remote Desktop Client in addition to server must live on joined to an Active Directory domain
2. Both devices must either joined to the same domain, or the Remote Desktop server must live on joined to a domain alongside a trust human relationship to the customer device’s domain.
3. The Kerberos authentication should convey been enabled.
4. The Remote Desktop customer must live on running at to the lowest degree Windows 10, version 1607 or Windows Server 2016.
5. The Remote Desktop Universal Windows Platform app doesn’t back upwards Remote Credential Guard so, utilization Remote Desktop classic Windows app.

Enable Remote Credential Guard via Registry

To enable Remote Credential Guard on the target device, opened upwards Registry Editor in addition to become to the next key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa

Add a novel DWORD value named DisableRestrictedAdmin. Set the value of this registry setting to 0 to plough on Remote Credential Guard.

Close the Registry Editor.

You tin enable Remote Credential Guard yesteryear running the next ascendence from an elevated CMD:

reg add together HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /d 0 /t REG_DWORD

Turn on Remote Credential Guard yesteryear using Group Policy

It is possible to utilization Remote Credential Guard on the customer device yesteryear setting a Group Policy or yesteryear using a parameter alongside Remote Desktop Connection.

From the Group Policy Management Console, navigate to Computer Configuration > Administrative Templates > System > Credentials Delegation.

Now, double-click Restrict delegation of credentials to remote servers to opened upwards its Properties box.

Now inwards the Use the next restricted mode box, choose Require Remote Credential Guard. The other choice Restricted Admin mode is besides present. Its significance is that when Remote Credential Guard cannot live on used, it volition utilization Restricted Admin mode.

In whatever case, neither Remote Credential Guard nor Restricted Admin agency volition ship credentials inwards clear text to the Remote Desktop server.

Allow Remote Credential Guard, yesteryear choosing ‘Prefer Remote Credential Guard’ option.

Click OK in addition to instruct out the Group Policy Management Console.

Now, from a ascendence prompt, run gpupdate.exe /force to ensure that the Group Policy object is applied.

Use Remote Credential Guard alongside a parameter to Remote Desktop Connection

If yous don’t utilization Group Policy inwards your organization, yous tin add together the remoteGuard parameter when yous source Remote Desktop Connection to plough on Remote Credential Guard for that connection.

mstsc.exe /remoteGuard

Things yous should perish along inwards take away heed when using Remote Credential Guard

1. Remote Credential Guard cannot live on used to connect to a device that is joined to Azure Active Directory.
2. Remote Desktop Credential Guard alone industrial plant alongside the RDP protocol.
3. Remote Credential Guard does non include device claims. For example, if you’re trying to access a file server from the remote in addition to the file server requires device claim, access volition live on denied.
4. The server in addition to customer must authenticate using Kerberos.
5. The domains must convey a trust relationship, or both the customer in addition to the server must live on joined to the same domain.
6. Remote Desktop Gateway is non compatible alongside Remote Credential Guard.
7. No credentials are leaked to the target device . However, the target device withal acquires the Kerberos Service Tickets on its own.
8. Lastly, yous must utilization the credentials of the user who is logged into the device. Using saved credentials or credentials that are dissimilar than yours are non permitted.

You tin read to a greater extent than on this at Technet.

Source: https://www.thewindowsclub.com/

Share This :