How to Configure Remote Credential Guard for RDP in Windows 11 Using PowerShell

Remote Desktop Protocol (RDP) is a standard administrative tool in Windows networks, but traditional RDP sessions introduce substantial security risks. When an administrator logs into a remote workstation or server over RDP, their plaintext credentials, Kerberos tickets, and NTLM hashes are transmitted to and cached in the memory of the remote host. If that target server is compromised, attackers can dump LSASS memory and execute Pass-the-Hash or Golden Ticket attacks. Windows Remote Credential Guard protects administrative identities by ensuring credentials never leave the client machine.

How Remote Credential Guard Protects Identities

Remote Credential Guard fundamentally alters the RDP authentication architecture:

• Client-Side Kerberos Broker: The connecting client acts as the Kerberos ticket broker. When the remote server requires Kerberos authentication to access network shares or databases, it routes authentication requests back to the local client machine over the RDP tunnel.
• Zero In-Memory Credential Caching: No plaintext passwords, NTLM hashes, or reusable Kerberos Ticket Granting Tickets (TGTs) are stored in the memory of the remote target server.
• Containment of Lateral Movement: Even if a threat actor possesses local administrator rights on the remote machine, they cannot harvest the connecting administrator’s domain credentials.

Prerequisites for Enabling Remote Credential Guard

To deploy Remote Credential Guard across Windows 11 endpoints:

• The connecting client and target host must run Windows 10/11 Enterprise or Windows Server 2016 or newer.
• Both systems must belong to the same Active Directory domain or domains with established Kerberos trust.
• Authentication must utilize Kerberos (NTLM fallback is automatically disabled when Remote Credential Guard is active).

Configuring Remote Credential Guard via Group Policy or Registry

To enable the target computer to accept Remote Credential Guard connections:

1. Right-click the Start button on Windows 11 and select Terminal (Admin) or PowerShell (Admin).
2. Configure the local security policy registry key to allow Remote Credential Guard:

   # Enable Remote Credential Guard on the target server:
   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "DisableRestrictedAdmin" -Value 0 -Type DWord

3. To enforce this fleet-wide via Local Group Policy Editor (gpedit.msc):
   • Navigate to: Computer Configuration > Administrative Templates > System > Credentials Delegation.
   • Double-click Restrict delegation of credentials to remote servers.
   • Select Enabled, and set the dropdown to Require Remote Credential Guard.
   • Click Apply and OK.

Connecting via RDP with Remote Credential Guard in PowerShell

To launch a Remote Desktop session protected by Remote Credential Guard:

# Launch Remote Desktop with Remote Credential Guard flag:
mstsc.exe /remoteGuard /v:server01.domain.com

Alternatively, configure your saved RDP connection file (.rdp) by opening it in Notepad and adding:

remoteGuard:i:1

Verifying Protection Inside the Remote Session

To confirm that Remote Credential Guard is actively protecting your credentials within the active RDP session:

1. Inside the remote desktop session, open PowerShell.
2. Execute klist to inspect cached Kerberos tickets:

   klist

3. Observe that no Ticket Granting Ticket (TGT) is present in the remote session’s ticket cache. The target machine processes authentication requests dynamically via the client, keeping administrative credentials securely isolated on your local endpoint.

Deploying Remote Credential Guard on Windows 11 neutralizes one of the most prolific lateral movement techniques in enterprise networks, ensuring secure remote administration.