Allow delegating saved credentials with NTLM-only server authentication
This computer policy controls the target servers to which applications using the Credential Security Support Provider (CredSSP), such as Remote Desktop Connection, may delegate saved user credentials when the server was authenticated through NTLM.
since 0.9.8.11
Purpose
Show registry keys (3)
HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation\AllowSavedCredentialsWhenNTLMOnlyHKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation\ConcatenateDefaults_AllowSavedNTLMOnlyHKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation\AllowSavedCredentialsWhenNTLMOnly
list values under the key
This computer policy controls the target servers to which applications using the Credential Security Support Provider (CredSSP), such as Remote Desktop Connection, may delegate saved user credentials when the server was authenticated through NTLM. In this context, saved credentials are credentials retained in Windows Credential Manager.
AllowSavedCredentialsWhenNTLMOnly enables or disables the policy. When the policy is enabled, the string values below the subkey of the same name identify permitted targets by their service principal names (SPNs). An SPN identifies both a service class and its target server. For example, TERMSRV/server.example.com identifies the Remote Desktop Session Host on that server. A single wildcard character is supported, so TERMSRV/* covers all Remote Desktop Session Hosts.
When the policy is enabled, ConcatenateDefaults_AllowSavedNTLMOnly determines whether the explicitly supplied SPNs are combined with any operating-system default targets. This value only extends the effective target list; it does not enable credential delegation by itself.
If the policy is disabled, saved credentials cannot be delegated to any server through this policy branch. If it is not configured, Windows permits delegation after appropriate mutual authentication to TERMSRV/* by default when the client is not domain-joined. On a domain-joined client, saved-credential delegation is not permitted to any target by default.
Notes
Security
CredSSP passes the user's full credentials to an allowed target server. It is not a constrained-delegation mechanism. A compromised target can therefore misuse credentials delegated to it. Encryption in transit does not protect the credentials from a target system that is already compromised or untrusted.
Broad SPN patterns increase the number of servers eligible to receive saved credentials. In particular, a wildcard such as TERMSRV/* includes every matching server and increases the potential impact of a compromised target.
This policy does not enable NTLM or CredSSP, authenticate a user, or grant access to the target server. It permits delegation only when a participating application uses CredSSP, server authentication has already been completed through NTLM, and the target SPN matches the effective list. Other logon, access-control, and application policies continue to apply.
Possible side effects
If the policy is disabled or the target does not match an effective SPN, applications cannot use saved credentials for the affected CredSSP connection. Depending on the application, the user may be prompted for credentials again or authentication may fail.
Notes
This policy applies only to the NTLM authentication case. Delegation of saved credentials after server authentication with Kerberos or a trusted X.509 certificate is controlled by the separate “Allow delegating saved credentials” policy.
A corresponding deny policy can exclude particular servers that would otherwise be allowed by a wildcard entry.
When Credential Guard is enabled, CredSSP cannot use saved or single sign-on credentials. In particular, Windows credentials saved by the Remote Desktop client cannot be sent to a remote host. This policy does not override that restriction.
Microsoft documentation
Microsoft Learn: ADMX_CredSsp Policy CSP — AllowSavedCredentialsWhenNTLMOnly
Microsoft Learn: Credential Security Support Provider
Microsoft Learn: Considerations and known issues when using Credential Guard