Windows Remote Credential Guard Registry Path

This guide details the specific Windows Registry paths and values required to configure, enable, or disable Windows Remote Credential Guard for Remote Desktop connections.

Target Server Configuration

To allow incoming Remote Desktop connections using Remote Credential Guard, the target host must have Restricted Administration mode enabled.

Registry Path: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa

• Value Name: DisableRestrictedAdmin
• Type: REG_DWORD
• Value Data:
  • 0 = Remote Credential Guard / Restricted Admin is Enabled (allowed)
  • 1 = Remote Credential Guard / Restricted Admin is Disabled (blocked)

If the DisableRestrictedAdmin value does not exist, creating it as a DWORD (32-bit) Value and setting it to 0 enables the feature.

Client-Side Policy Configuration

When configuring credential delegation restrictions via Group Policy on client machines, Windows writes settings to the following policy-related registry path.

Registry Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation

• Value Name: AllowProtectedCreds
• Type: REG_DWORD
• Value Data:
  • 1 = Enforces the use of Remote Credential Guard for delegated credentials
  • 0 = Disables the enforcement policy

Applying the Changes

1. Open the Registry Editor by pressing Win + R, typing regedit, and pressing Enter.
2. Navigate to the desired path above.
3. Add or modify the corresponding DWORD (32-bit) value.
4. Restart the system or restart the Remote Desktop Services (TermService) for the configuration to take effect.