Prevent Credential Delegation Using Regedit

Credential delegation in Windows allows clients to pass authentication tokens to remote servers using CredSSP (Credential Security Support Provider), which can expose administrative passwords to interception or credential dumping attacks. This article provides a direct guide on how to configure the Windows Registry Editor (Regedit) to block default and saved credential delegation to remote hosts, thereby hardening your Remote Desktop infrastructure.

Step 1: Open the Registry Editor

  1. Press Windows Key + R to open the Run dialog.
  2. Type regedit and press Enter.
  3. Confirm the User Account Control (UAC) prompt by selecting Yes.

Step 2: Navigate to the Credentials Delegation Policy Key

In the Registry Editor address bar, navigate to the following path:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation

Note: If the CredentialsDelegation key does not exist under Windows, right-click on Windows, select New > Key, and name it CredentialsDelegation.

Step 3: Configure Deny Delegation Settings

To explicitly block delegation of default and saved credentials to all remote hosts, create or configure the following values:

  1. Deny Default Credentials:
    • Right-click inside the CredentialsDelegation folder, select New > DWORD (32-bit) Value, and name it DenyDefaultCredentials.
    • Double-click DenyDefaultCredentials and set its Value data to 1.
    • Inside CredentialsDelegation, create a subkey named DenyDefaultCredentials.
    • Inside the new subkey, create a String Value (REG_SZ) named 1 and set its value to TERMSRV/* (to block delegation to all RDP targets).
  2. Deny Saved Credentials:
    • Return to CredentialsDelegation, create a DWORD (32-bit) Value named DenySavedCredentials, and set its Value data to 1.
    • Create a subkey named DenySavedCredentials.
    • Inside that subkey, create a String Value (REG_SZ) named 1 and set its value to TERMSRV/*.

Step 4: Disable Allowed Delegation Values

Ensure that no existing policies override the deny rule:

  1. Look for AllowDefaultCredentials or AllowSavedCredentials DWORD values in the CredentialsDelegation key.
  2. If present, double-click each value and change the Value data to 0, or delete the subkeys defining target hosts.

Step 5: Enforce Restricted Admin Mode (Optional Server-Side Setting)

To prevent remote hosts from receiving credentials when acting as an RDP host, enable Restricted Admin Mode:

  1. Navigate to: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
  2. Right-click in the right pane, select New > DWORD (32-bit) Value, and name it DisableRestrictedAdmin.
  3. Set the Value data to 0.

Step 6: Apply the Changes

Close the Registry Editor. Open Command Prompt as Administrator and run gpupdate /force, or restart the computer to apply the updated delegation policies immediately.