🎯 Purpose
✅ Require Remote Credential Guard for Remote Desktop connections, meeting Essential Eight – Restrict Administrative Privileges (Maturity Level 3).
➡️ Credentials are never sent to the remote computer, so a compromised server cannot capture an administrator's password or hashes.
👥 Who is affected
✅ Devices: All Windows 10 / 11 devices (the RDP client side)
🚫 Exclusions: None
☁️ What is protected
✅ Credentials used for outbound Remote Desktop sessions
✅ Type: Settings catalog › Credentials Delegation
🔐 How Remote Credential Guard is enforced
Setting | Value |
Restrict delegation of credentials to remote servers | Enabled – Require Remote Credential Guard |
➡️ RDP sessions use Kerberos redirection back to the client instead of sending credentials to the host.
⚠️ Impact: RDP connections to hosts that do not support Remote Credential Guard will fail. The remote host must be Windows 10 1607 / Server 2016 or later and joined to the same or a trusted domain (or Entra ID‑joined with supported configuration).
⚙️ What this policy does NOT enforce
🚫 Credential Guard on the local device
🚫 Restricted Admin mode on remote hosts
🚫 Which users may use RDP
🟢 Policy status
✅ Enabled
✅ Assigned to all devices
📘 Essential Eight Alignment
✅ Remote Credential Guard functionality is enabled (ISM‑1897)
ℹ️ Applies to Maturity Level 3
📘 Practical Interpretation (Executive‑Friendly)
This policy ensures that:
✅ When an administrator connects to a server with Remote Desktop
✅ Their credentials stay on their own device
This stops attackers on a compromised server from stealing admin credentials and moving through the network.