Skip to content
/

Remote Desktop Client doesn’t use stored credentials

, , ,

The problem

When I’ve to connect to the same development machine over and over again using RDP I store the credentials.

First logon attempt

But when I later connect again I’ve to still provide a password.

Second logon attempt

After entering my password 1387 times in the last year I started searching for the reason why it doesn’t use my stored credentials. As it turns out this is because of a local policy.

The solution

  1. Start GPEdit.msc and navigate to Computer Configuration\Administrative Templates\System\Credentials Delegation
  2. Open the policy Allow Saved Credentials with NTLM-only Server Authentication (or Allow Delegating Saved Credentials with NTLM-only Server Authentication for Windows 7)
  3. Select Enabled and click on Show
  4. Enter the server where you want to connect to with the stored credentials. You’re allowed to use wildcards, so I choose TERMSRV/*.int (my development machines are always in a domain ending with .int)
  5. Close the screens and run gpupdate

Now it’s possible to connect to the server without providing the same password over and over again.

Allow delegating saved credentials

Related posts:

  1. Configure people picker over a one-way trust using PowerShell
  2. Access Denied when crawling mysite / people on localhost with a different hostname
  3. Using the people picker over a one-way trust
  4. Filtering on a tinyint with Entity Framework
  5. Translating URLs using Alternate Access Mappings from code
Filed under Windows
Last update:

26 Comments

  1. /

    Thanks. Worked on Windows 8 Enterprise box to a Windows 7 Pro box.

    Reply
  2. /

    Thanks for this post. Unfortunately it is not working for me. I followed your steps, and then I put in the server name. Which is "furman". So I put it in just like that, do I need anything else in there? I even tried the IP address. I noticed you had a /* in there. What is that for?

    Reply
    • /

      Hi James. The "/*" is there to match "any" computer name we'd like to connect to. In your case, i believe "TERMSRV/furman" should be enough, if you REALLY only want to skip the password for just that particular server. The usual "lazy" value for this is "termsrv/*", which matches connecting anywhere, but a more secure variant is like Michaël used: "termsrv/*.". My hunch is that the TermSrv prefix specifies that the credential policy you're editing should be applied to all requests by "Terminal Services" (Remote Desktop).

      Reply
      • /

        Hi C,

        I place my post under James´s post, because I am in same category(aint working for me). I´ve followed described steps, no error meggages occured - all seems correct. But still, once I try log with no matter what user Windows Security pops out and asks me for credentials.
        I am using Win 8 Pro, server is 2008R2.
        I´ve been trying value:
        TERMSRV/*
        TERMSRV/*.ip address
        TERMSRV/*.server name
        (updated GP with each attempt ..)

        I belive it must be something else that is breaking me or I have set up, but still dont know what it is.

        Thanks!

        Hoo.
        L1 tech support

        Reply
  3. /

    Many thanks for this. This causing quite a bit of frustration.

    Reply
  4. /

    thanks mate, worked nicely for me. just adding that this should be done on the client, the machine that is initiating connection. seems obvious but like a dummy i did it on the server first.

    Reply
  5. /

    We had this problem despite above and determined the terminal server session host manager ssl certificate that was selected automatically was not the correct certificate. Selecting the certificate manually resolved the problem.

    Reply
    • /

      Hi Kevin,
      Can you explain how, where and which SSL certificate we need to select. We are having the issue even after implementing the proposed fixe. Thanks.

      Reply
  6. /

    This can be set on the server side, but it would need to be in a GPO for a container of the client computers that you want to do it from. I used TERMSRV/*.mydomainname.com as the setting and then when the GPO is next refreshed the client machines will receive the setting.

    Reply
  7. /

    Thanks for this solution. It saved my lot of time.
    Even this help me keep the password hidden but my team member can access server in my absence.
    I don't need to provide the password anyone.

    Reply
  8. /

    Many thanks for this - setting TERMSRV/hostname and then gpupdate worked perfectly for me.

    Reply
  9. /

    Many thanks to you man, this issue bothering me several weeks!
    It's do help~~

    Thanks again.

    Reply
  10. /

    Many thanks wonderful solution - works on win10pro 64bit + WServer, will save me a X-times to repeat the PWD 😉

    Reply
  11. /

    I wish I'd seen this years ago.

    Reply
  12. /

    This is great! thank you for posting this (even if it was many years ago). Works on Windows 10.

    Reply
  13. /

    It worked for me. Windows 7 Client Machine

    Reply
  14. /

    Thanks, it worked well with TERMSRV/* Thanks!

    Reply
  15. /

    Thanks!!! Working on Windows 10 Pro

    Reply
  16. /

    Thanks! Worked on Win 7 Pro to Win Server 2012

    Reply
  17. /

    To allow all servers, just enter a single *

    Thanks for the info.

    Reply
  18. /

    After nine years I finally googled this! Why not earlier!?
    I also put * which allows all servers.

    Reply
  19. /

    Worked perfectly. Awesomeness!

    Reply
  20. /

    This can also be done via registry - example reg file contents below to allow all servers. You can add additional items to the list by incrementing the quoted number if you want to allow specific domains/machines. Format should be (in theory) "TERMSRV/hostname.domain.suffix" such as "TERMSRV/*.contoso.local". I work on hundreds of client domains so I use "TERMSRV/*"

    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation]
    "AllowSavedCredentialsWhenNTLMOnly"=dword:00000001
    "ConcatenateDefaults_AllowSavedNTLMOnly"=dword:00000001

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowSavedCredentialsWhenNTLMOnly]
    "1"="TERMSRV/*"

    Reply
  21. /

    Thanks. Worked well on Win10 EE and solved a nasty issue

    Reply
  22. /

    Worked perfect on windows 10 pro in AD, thank you 🙂

    Reply

Trackbacks and Pingbacks

  1. RDP session message “your administrator does not allow the use of saved credentials” | Gerrit Lokhorst

Leave a comment