Windows 11 22H2 - Can't use saved credential

Question

After upgrade Windows 11 22H2 I Can't use saved credential (Windows Defender Credential Guard does not allow using saved credentials).
Before it works.

Answer 1

So it seems this 'feature' which should be enabled on Windows 11 enterprise has actually been enabled on Win 11 pro as well. - Excellent, great start

The new 'feature' disables a long standing and widely used feature of an essential administrative tool, making it harder and less productive to work - Really loving this update so far!

The only way to disable it is with policy updates or registry settings as the new 'feature' can't be disabled through settings - Nice, I'm sure that won't lead to any errors or problems.

As far as I can see, not a single person has commented online about how helpful this feature is - Did anybody actually want it?

Many people are now removing this and potentially disabling more than needed, thus actually making systems less secure. - Awesome

So basically a feature it seems no one wanted, has lowered productivity, lowered user satisfaction and resulted in less secure systems that are more likely to be compromised. Bravo MS, an absolute triumph!

Answer 2

I have found a simple working solution that does not involve manually editing Windows Registry keys and other boring actions. The only thing you need is to use the built-in cmdkey tool and problem solved.

---

Solution (TL;DR)

Here is the only step you need to perform at Windows Command Prompt:

cmdkey /generic:TERMSRV/<targetname> /user:<username> /pass:<password>

That's it.

After that you can connect to your target machine using Windows Remote Desktop client and no password will be asked. I now again enjoy the comfort of immediate Remote Desktop connections without annoying credential prompts 😃.

Example

You want to connect to a machine at IP address 10.10.10.10 with the username Donald and the password qwerty. So add the following generic TERMSRV credentials:

cmdkey /generic:TERMSRV/10.10.10.10 /user:Donald /pass:qwerty

~

---

Additional info

It is important to add specifically GENERIC credentials. I have noticed that after using the related checkbox in Remote Desktop Connection tool ("Allow me to save credentials"), it actually works and saves the provided credentials, BUT it saves them with the type "Domain Password" and this does not work (you will see "Windows Defender Credential Guard does not allow using saved credentials" etc).

You can check the type of your saved TERMSRV credentials it by executing the following command (using asterisk * to list everything):

cmdkey /list:TERMSRV/*

But when you add a GENERIC credentials - it works and Windows Defender has no objections about that ))
And now, after adding the generic credentials, when you execute cmdkey /list:TERMSRV/* command you will see this:

Notice how the Type is now Generic.

BTW if you wish you can delete the previously added credentials, e.g.:

cmdkey /delete:TERMSRV/10.10.10.10

~

---

Technical documentation

• The official Microsoft documentation for cmdkey tool: cmdkey
• Microsoft Win32 API documentation for wincred.h C header file, where you can see different types of credentials: CREDENTIALA structure (wincred.h)

Answer 3

As much as I hate "throw the baby out with the bathwater" solutions (examples being disabling the Windows Firewall whenever there's a firewall issue instead of taking the time to find the right ports and allow them through it), right now that's about all we have until we have a better understanding of Credential Guard and whether exceptions or a whitelist can be made for certain applications (like RDP).

So for now the "throw the baby out with the bathwater" workaround is to turn off Credential Guard altogether.

You can turn it off with registry changes, a GPO, Intune, or whatever you're using to manage your systems (if anything).

https://learn.microsoft.com/en-us/answers/questions/1021785/windows-11-22h2-can39t-use-saved-credential.html

Easiest way is via the registry:

Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard.

Add a new DWORD value named EnableVirtualizationBasedSecurity and set its value to 0.
Add another new DWORD value named RequirePlatformSecurityFeatures and set that to 0.

Now go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.

Add a new DWORD value named LsaCfgFlags and set it to 0.

Restart your computer.

Again, I don't like solutions/workarounds like this, as Credential Guard is a great idea, but when new features break things, the first thing people are going to reach for is the "Off" switch for it.

Once we get a proper whitelist to make exemptions for Credential Guard (or perhaps to make Credential Manager and RDP compatible with Credential Guard), then I'll no longer recommend turning the feature off.

Answer 4

I've started using the Remote Desktop app from the Microsoft Store.
The credentials appear to save correctly using this.

Answer 5

The solution by informatik01 on the first page works great. No need to disable anything, just add the credentials using the method in his post.