Allow delegating saved credentials
This computer policy determines the servers to which applications using the Credential Security Support Provider (CredSSP), such as Remote Desktop Connection, may delegate a user's saved credentials.
since 0.9.8.11
Purpose
Show registry keys (3)
HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation\AllowSavedCredentialsHKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation\ConcatenateDefaults_AllowSavedHKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation\AllowSavedCredentials\<nummerierter Wertname>
This computer policy determines the servers to which applications using the Credential Security Support Provider (CredSSP), such as Remote Desktop Connection, may delegate a user's saved credentials. Saved credentials are credentials that the user chose to store through Windows Credential Manager.
The policy applies to connections for which the target server was authenticated through Kerberos or a trusted X.509 certificate. Delegation when the server is authenticated only through NTLM is controlled by the separate “Allow delegating saved credentials with NTLM-only server authentication” policy.
AllowSavedCredentials is a REG_DWORD value that controls the policy state: 1 enables the policy, while 0 prevents saved credentials from being delegated. If the value is absent, the policy is not configured. In that state, Windows permits delegation to Remote Desktop Session Hosts matching the TERMSRV/* service principal name pattern after proper mutual authentication.
When the policy is enabled, the HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation\AllowSavedCredentials subkey contains the permitted targets. The data of its numbered REG_SZ values consists of service principal names (SPNs), such as TERMSRV/server.example.com. A single wildcard is supported, so an entry such as TERMSRV/* covers all correspondingly authenticated Remote Desktop Session Hosts.
The ConcatenateDefaults_AllowSaved REG_DWORD value determines whether Windows includes its predefined targets in addition to the supplied SPN list. A value of 1 combines the operating-system defaults—including TERMSRV/* for this policy—with the custom list. A value of 0 uses only the explicitly listed targets.
Notes
Security
CredSSP passes the user's full credentials to the authenticated target server. This is not constrained delegation. A compromised or malicious server covered by an allowed SPN pattern can therefore steal the delegated credentials or misuse them in the user's security context.
Broad patterns such as TERMSRV/* increase the number of servers trusted with saved credentials. If ConcatenateDefaults_AllowSaved is 1, this operating-system pattern remains effective in addition to a potentially narrower custom list.
The policy does not grant the user administrative privileges or additional access rights on the target server. Successful sign-in and resource access still depend on the delegated account and the permissions enforced by the destination system.
Possible side effects
If delegation is disabled or the target server does not match an allowed SPN, CredSSP-based applications cannot use saved credentials for that connection. Depending on the application, the user may be prompted for credentials again or authentication may fail.
Notes
The “Deny delegating saved credentials” policy can exclude targets that would otherwise be covered by this allow list or by a wildcard pattern.
When Windows Defender Credential Guard is enabled, CredSSP cannot use saved or single sign-on credentials. Policies governing saved and default credentials are also ignored when smart-card sign-in is used with Remote Desktop Services.
Microsoft documentation
Microsoft Learn: Policy CSP – ADMX_CredSsp
Microsoft Learn: Credential Security Support Provider
Microsoft Learn: Considerations and known issues when using Credential Guard