Windows 11 22H2 - Can't use saved credential

Andrzej S Ciesiński 101

After upgrade Windows 11 22H2 I Can't use saved credential (Windows Defender Credential Guard does not allow using saved credentials).
Before it works.

David Nelson 106 Reputation points

2022-10-06T00:35:11.013+00:00

I have the same issue. My windows 11 22H2 is up to date.
KTC_Church 16 Reputation points

2024-05-10T22:34:35.07+00:00

this fixed it! thanks.

30 answers

Peter Lapornik 16 Reputation points

2022-10-06T14:44:13.867+00:00

A word of warning - you probably shouldn't disable virtualisation-based security completely as some of these features are helpful. All you need to do is disable Credential Guard. A good source of information for this is the following: https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage
Please sign in to rate this answer.

2 people found this answer helpful.
Paweł Mikołajczyk 1 Reputation point

2022-10-06T15:21:16.03+00:00

So what is best solution to off credential Guard?

Martin Smulian 1 Reputation point

2022-10-06T16:19:39.993+00:00

I don't think that the suggested work-around does disable everything.

After setting
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard.
new DWORD value named EnableVirtualizationBasedSecurity and set its value to 0.
new DWORD value named RequirePlatformSecurityFeatures and set that to 0.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.
new DWORD value named LsaCfgFlags and set it to 0

and reboot then when I run msinfo32.exe I see

Virtualisation-based security: Running
Virtualisation-based security required security properties:
Virtualisation-based security available security properties: Base Virtualisation Support, Secure Boot, DMA Protection, Secure Memory Overwrite, UEFI Code Readonly, Mode Based Execution Control
Virtualisation-based security services configured: Hypervisor enforced Code Integrity
Virtualisation-based security services running: Hypervisor enforced Code Integrity
Windows Defender Application Control policy: Enforced
Windows Defender Application Control user mode policy: Off

Peter Lapornik 16 Reputation points

2022-10-07T10:04:18.213+00:00

The important thing is not to see Credential Guard under the Virtualisation-based security services configured and Virtualisation-based security services running rows in msinfo32.exe.

We partially solved it via group policy as per the following example:

Note: In your environment you may want to enable the code integrity and stack protection settings.

You may also need to disable Credential Guard EFI variables (via bcdedit)

The following is a reference for the above:
https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage

David Ching 21 Reputation points

2023-01-08T18:19:01.187+00:00

Thank you for noting that MSINFO shows the status of Credential Guard. The following subset of your steps fixed the problem for me:

Add the LSA registry value (only this one, not the others)

Use gpedit to set "Credential Guard Configuration" to Disabled (didn't disable "Secure Launch Configuration")

I had to delete and re-save the login credentials (the old ones were not valid).

This worked for one laptop. On another computer, in addition I also had to follow these directions to remove the credential guard enabling from the UEFI firmware.

mountvol X: /s
copy %WINDIR%\System32\SecConfig.efi X:\EFI\Microsoft\Boot\SecConfig.efi /Y
bcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d "DebugTool" /application osloader
bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} path "\EFI\Microsoft\Boot\SecConfig.efi"
bcdedit /set {bootmgr} bootsequence {0cb3b571-2f2e-4343-a879-d86a476d7215}
bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO
bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X:
mountvol X: /d

Daniel Montero 0 Reputation points

2023-02-15T22:15:31.2466667+00:00

I tried this guide, but my rdp is still unable to login "Windows Defender Credential Guard does not allow using saved credentials"
Sign in to comment
Phil C 6 Reputation points

2022-10-07T10:08:19.147+00:00

I have the same issue with 11 22H2 family. Since the last upgrade of 21H2 and 22H2 I am no able to connect to any of other NAS/Computer in my workgroup. Microsoft MAYDAY MAYDAY

SOLVED

In my case the issue was in the name registered by windows. Instead ov 192.168.1.1 I registered, Windows created a name for my NAS and as I registered the user, evrything went correctly.
Please sign in to rate this answer.

1 person found this answer helpful.
Stano SK 1 Reputation point

2022-10-09T15:43:49.793+00:00

I confirm, I changed the name of my NAS and everything is working ok.
Sign in to comment
Taiki Bessho 5 Reputation points

2023-02-02T11:50:59.69+00:00

The store app version of the remote desktop client keeps my passwords correctly and does not require me to type the passwords every time.

Maybe Microsoft wants to make us shift to the store app. version.
Please sign in to rate this answer.

1 person found this answer helpful.
Topogigio 16 Reputation points

2023-02-02T11:54:23.4733333+00:00

maybe.

But I need to run something as mRemoteNG to manage and share e lot of connections, and I cannot switch to the other client :(

Dawid Johansson 16 Reputation points

2023-02-02T12:18:56.3666667+00:00

Works for me too but it is worse than the old one in the way I use it. So it's not an option for me
Sign in to comment
T. Kujala 8,706 Reputation points

2022-09-25T05:24:15.3+00:00

Hi @Andrzej S Ciesiński ,

You could try to enable this feature by following the next guide.

https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage
Please sign in to rate this answer.
Aren Cambre 6 Reputation points

2023-01-11T15:34:50.2933333+00:00

That page isn't helpful. The words saved, password, or remember do not appear, yet credential appears 118 times.

Nah, I'm turning off this feature until it stops breaking Remote Desktop Connection.
Sign in to comment
Andrzej S Ciesiński 101 Reputation points

2022-09-25T09:43:10.74+00:00

I don't want to disable it completely, just allow the use of saved credentials for remote connections.
"GPEDIT: If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*)."
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Share via

Windows 11 22H2 - Can't use saved credential

30 answers