Force Remote Desktop to Prompt for Password in Regedit

This article explains how to configure Windows to require credentials every time a Remote Desktop (RDP) connection is initiated using the Registry Editor (Regedit). By enforcing this setting, Windows prevents the use of cached or saved login credentials on the host machine, significantly enhancing security by ensuring that users must authenticate manually on every remote session.

Steps to Require Credentials for Remote Desktop Connections

To force Windows to prompt for a password on every incoming Remote Desktop connection, follow these steps:

Step 1: Open the Registry Editor

  1. Press Windows Key + R to open the Run dialog box.
  2. Type regedit and press Enter (or click OK).
  3. If prompted by User Account Control (UAC), click Yes to grant administrative permissions.

Step 2: Navigate to the Terminal Services Key

In the Registry Editor, navigate to the following path using the left sidebar:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services

Note: If the Terminal Services key does not exist under Windows NT, right-click on Windows NT, select New > Key, and name it Terminal Services.

Step 3: Create or Modify the fPromptForPassword Value

  1. With the Terminal Services key selected, look at the right-hand pane.
  2. If a DWORD named fPromptForPassword already exists, double-click it.
  3. If it does not exist:
    • Right-click anywhere in the empty space of the right pane.
    • Select New > DWORD (32-bit) Value.
    • Name the new value fPromptForPassword and press Enter.

Step 4: Set the Value Data

  1. Double-click the fPromptForPassword value.
  2. In the Value data field, change the value from 0 to 1.
  3. Ensure the Base is set to Hexadecimal.
  4. Click OK to save the changes.

Step 5: Apply the Changes

Close the Registry Editor. To ensure the new policy takes immediate effect, open Command Prompt as an administrator and run:

gpupdate /force

Alternatively, restart the computer. Moving forward, any Remote Desktop client connecting to this machine will be required to enter their password manually, even if credentials were saved locally on the client machine.