If you attempt to connect to a Remote Desktop Connection (RDP) that is not a domain joined computer you may get the following error:
Your credentials did not work Windows Defender Credential Guard does not allow using saved credentials
To resolve the issue you must follow these steps:
- Find the Saved Credentials
- Delete the Saved Credentials
- Recreate the Credentials with Generic Type
Find the Saved Credentials
To list all RDP Saved Credentials run the following command:
cmdkey /list:TERMSRV/*
Currently stored credentials for TERMSRV/*:
Target: TERMSRV/print.domain.internal Type: Domain Password User: dom\john.doe Local machine persistence Target: TERMSRV/dc1.domain.internal Type: Domain Password User: dom\john.doe Local machine persistence
Or run this command to find the saved credentials for a specific server name or IP address:
cmdkey /list:TERMSRV/<targetNameOrIp>
Examples:
cmdkey /list:TERMSRV/server.domain.com
cmdkey /list:TERMSRV/127.0.0.1
Delete the Saved Credential
Remove the saved credentials that are causing the issue. You can do this by using the following command in Command Prompt or PowerShell:
cmdkey /delete:TERMSRV/<targetNameOrIp>
Replace <targetNameOrIp> with the appropriate target name or IP address for your Remote Desktop Connection (RDP).
Recreate the Credentials with Generic Type
Recreate the credentials using the cmdkey command with the /generic flag. This ensures that the credentials are compatible with Credential Guard:
cmdkey /generic:TERMSRV/<targetNameOrIp> /user:<username> /pass
Replace <targetNameOrIp>, <username> with the correct values for your RDP connection. Note that passwords saved through the RDP UI end up as “Domain” type credentials and aren’t compatible with Credential Guard. However, passwords saved through cmdkey /generic end up as "Generic" type and work with Credential Guard enabled. </code<username>>
References:
Comments
0 comments
Please sign in to leave a comment.