Remote host allows delegation of non-exportable credentials
This computer policy setting determines whether a remote host supports Restricted Admin mode and Remote Credential Guard for Remote Desktop connections.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation\AllowProtectedCreds
This computer policy setting determines whether a remote host supports Restricted Admin mode and Remote Credential Guard for Remote Desktop connections. Both modes avoid sending reusable user credentials to the remote host.
If the setting is disabled or not configured, the host doesn't support these protected connection modes. Users must instead provide their credentials to the host through standard credential delegation.
This setting doesn't enable or enforce either protected mode on the client, and it doesn't grant permission to sign in through Remote Desktop.
Notes
Additional effects
With Remote Credential Guard, Kerberos requests from the Remote Desktop session are redirected to the client device. This provides single sign-on to other resources from within the session without placing the user's credentials on the remote host.
Restricted Admin mode also avoids transmitting reusable user credentials to the host. Outbound access from the session uses the remote host's identity rather than the signed-in user's identity.
Security
Supporting these modes reduces the risk that a compromised remote host can capture passwords, hashes, or other reusable credentials from a Remote Desktop session and misuse them after the session ends.
The policy doesn't provide this protection by itself. The client must actually establish the connection by using Remote Credential Guard or Restricted Admin mode. With Remote Credential Guard, a compromised host can also initiate authentication requests as the user through the redirected channel while the session remains active.
Possible side effects
Restricted Admin mode doesn't make the user's credentials available for access to other systems. Applications or administrative workflows that need to reach network resources as the user from within the Remote Desktop session might therefore behave differently from those in a standard RDP session.
If a client requires one of the protected modes but the remote host doesn't support it, the Remote Desktop connection can't be established in that mode.
Notes
Remote Credential Guard requires Kerberos authentication and works only with RDP. The remote host must be joined to an Active Directory domain. Direct connections are supported; connections through a Remote Desktop Gateway or Remote Desktop Connection Broker aren't supported.
Restricted Admin mode requires an account with administrator rights on the remote host. Remote Credential Guard still requires only the access rights normally needed to sign in through RDP.
Microsoft documentation
Microsoft Learn: Policy CSP – CredentialsDelegation
Microsoft Learn: Remote Credential Guard