Windows 10: Windows Defender Credential Guard does not allow using saved credentials when using remote...

Hi all,


I have a Microsoft Surface Pro 4 tablet. I completely reinstalled the tablet using the latest available recovery image with Windows 10 Version 1703. I set up a remote desktop connection to my desktop computer and the saved credentials were used so I don't have to type them each time I connect.


After updating to Windows 10 version 1903 I got the error below and have to enter the password manually each time I want to access my desktop. The problem persisted when further updating to version 1909 and 2004.


Before using the recovery image, I had tried all kind of solutions which I found on the web by changing settings in gpedit.msc and by editing the registry but none of them worked.

I never changed any default settings after installing the Surface recovery image. I also have an old Acer tablet with the same Windows version 2004 insider build 20206. On that tablet the saved passwords are used in remote desktop, so no issue occurs.


I am not sure if Windows Defender Credential Guard is even enabled at all. Does anyone have a solution to this?





:)

 

Credential Guard lab companion

Source: Credential Guard lab companion Datacenter and Private Cloud Security Blog


See also:

• Enable or Disable Credential Guard in Windows 10 Windows 10 Security System Tutorials
• Verify if Credential Guard is Enabled or Disabled in Windows 10 Windows 10 Security System Tutorials

 

Credential Guard

When will Credential Guard be supported on the same Windows 10 Enterprise device as Barkly and VMWare Workstation Pro.

It would be nice to be able to run these products without sacrificing Credential Guard.

Moved from Insider

 

Remote Desktop won't accept login credentials

Hi Robert,



Thank you for writing to Microsoft Community forum.

• Are you using a Microsoft account to login?
  
• Was the user name changed at any point of time?
  

Meanwhile, you may try the steps listed below and check if it works:

• Open Command prompt as an administrator on your local machine and type:
  gpedit.msc
  
• Navigate to the following location:
  
  Local Computer Policy\Computer Configuration\Administrative Templates\System\Credentials Delegation
  
• Click on ‘Allow Delegating Saved Credentials with NTLM-only Server Authentication’
  
• Enable the policy and click on ‘Show’ button in the options window below and enter the value
  ‘TERMSRV/*’ (without quotes) into the list. Apply the changes.
  
• Do the same thing for the following policies:
  
  Allow Delegating Saved Credentials
  
  Allow Delegating Default Credentials with NTLM-only Server Authentication
  
  Allow Delegating Default Credentials
  
• Make sure that ‘Deny Delegating Saved Credentials’ is not enabled or does not contain ‘TERMSRV/*’ in the list
  
• Close all windows, open a command prompt, and use
  ‘gpupdate /force’ command to apply the policy directly.
  

Once the update is complete, reboot the machine and see if you can remote login.



Regards,