Windows Credential Manager Roaming Registry Key

Managing Windows Credential Manager roaming policies through the Windows Registry allows system administrators to control how user credentials, certificates, and keys synchronize across domain-joined machines. This guide outlines the exact registry paths and values responsible for enabling and configuring Credential Roaming behavior in Windows environments.

The primary registry key that manages Credential Roaming policy settings is located in the Cryptography Policies path:

• User Configuration Path:
  HKEY_CURRENT_USER\Software\Policies\Microsoft\Cryptography
• Computer Configuration Path:
  HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography

Key Registry Values for Credential Roaming

Inside the Cryptography key, several DWORD and String values define roaming behavior:

• EnableCredentialRoaming (REG_DWORD):
  • 1 = Enables Credential Roaming. When enabled, DPAPI master keys, private keys, and user certificates synchronize with Active Directory.
    
  • 0 = Disables Credential Roaming.
• RoamingInterval (REG_DWORD):
  Defines the polling interval (in minutes) at which the local system checks Active Directory for updated credentials.
• MaximumRoamingTokenSize (REG_DWORD):
  Specifies the maximum size limit (in bytes) for roamed credential objects to prevent excessive network bandwidth or storage usage.

Related Credential Manager Registry Keys

For broader Credential Manager behavior and persistence across sessions, the Local Security Authority (LSA) registry path also applies:

• Registry Path:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
• DisableDomainCreds (REG_DWORD):
  • 0 = Default behavior; allows domain credentials and tokens to be saved and used for authentication.
    
  • 1 = Disables the caching and roaming of domain credentials across networked machines.

These registry values are typically deployed via the Group Policy editor under User Configuration > Administrative Templates > System > Credential Roaming. Editing the registry keys directly applies the identical policies locally or through script-based deployments.