lkakclever.blogg.se

If the client can't connect to a domain controller, then RDP attempts to fall back to NTLM. Must use Kerberos authentication to connect to the remote host.The Remote Desktop Universal Windows Platform (UWP) application doesn't support Remote Credential Guard Must be running the Remote Desktop Windows application.Must allow delegation of nonexportable credentials to the client device.Must allow the user to access via Remote Desktop connections.To use Remote Credential Guard, the remote host and the client must meet the following requirements. Membership of Administrators group on remote host Membership of Remote Desktop Users group on remote host Prevent use of credentials after disconnectionĬredentials supported from the remote desktop client device Prevent use of user's identity during connection Single sign-on (SSO) to other systems as signed in user

Use the following table to compare different Remote Desktop connection security options: Feature An attacker can't act on behalf of the user and any attack is local to the server.The Remote Desktop session connects to other resources as the remote host's identity.The security benefits of Restricted Admin mode include: An attacker can act on behalf of the user only when the session is ongoing.During the remote session you can connect to other systems using SSO.Credentials aren't sent to the remote host.The security benefits of Remote Credential Guard include: Attacker can use credentials after disconnection.Credentials aren't protected from attackers on the remote host.Credentials are sent to and stored on the remote host.Using a Remote Desktop session without Remote Credential Guard has the following security implications: Compare Remote Credential Guard with other connection options For information on Remote Desktop connection scenarios involving helpdesk support, see Remote Desktop connections and helpdesk support scenarios in this article.