How to Fix Credential Guard Blocking Saved Passwords and Credentials on Windows
Credential Guard blocking saved passwords? Cannot use saved RDP credentials? NTLM authentication failing due to Credential Guard? Domain credentials rejected? Saved passwords not working after Credential Guard enabled? Fix Credential Guard credential issues.
📖
Main Troubleshooting Guide
How to Fix No Internet Connection →Complete symptoms, causes, and step-by-step solutions
Symptoms
You might be experiencing this problem if you notice:
- •Remote Desktop cannot use saved credentials after enabling Credential Guard
- •NTLM pass-through authentication failing
- •Saved network share passwords no longer accepted
- •Domain credentials rejected for mapped drives
- •RDP always prompts for credentials despite saving them
- •Credential Manager entries exist but are not used
Common Causes
- ⚠Credential Guard blocks NTLM credential delegation by design
- ⚠Saved credentials incompatible with virtualization-based security
- ⚠Kerberos constrained delegation not configured for RDP
- ⚠Remote Credential Guard not enabled as alternative
- ⚠Group Policy enforcing Credential Guard without delegation exceptions
- ⚠Legacy applications relying on NTLM blocked by security policy
Solutions
Solution 1: Enable Remote Credential Guard for RDP
- 1Remote Credential Guard is the recommended alternative:
- 2On the client machine:
- 3Win+R → gpedit.msc
- 4Computer Configuration → Admin Templates → System → Credentials Delegation
- 5Enable "Restrict delegation of credentials to remote servers"
- 6Set to "Require Remote Credential Guard"
- 7Or use command line:
- 8mstsc /remoteGuard
- 9This protects credentials while allowing RDP connections
- 10Both client and server must support this feature
Solution 2: Configure Kerberos Delegation
- 1For domain environments, set up proper Kerberos delegation:
- 2Active Directory Users and Computers:
- 3Find the computer account → Properties → Delegation tab
- 4Select "Trust this computer for delegation to specified services only"
- 5Add the services that need credential pass-through
- 6For network shares:
- 7Ensure SPN (Service Principal Names) are registered correctly
- 8CMD: setspn -L computername to verify
- 9Kerberos works with Credential Guard; NTLM does not
Solution 3: Disable Credential Guard if Incompatible
- 1Warning: reduces security — use only if other methods fail
- 2Via Group Policy:
- 3Computer Configuration → Admin Templates → System → Device Guard
- 4Set "Turn On Virtualization Based Security" to Disabled
- 5Or via registry:
- 6HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
- 7Set "LsaCfgFlags" to 0
- 8Also: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard
- 9Set "EnableVirtualizationBasedSecurity" to 0
- 10Restart PC — may need to disable via bcdedit as well
- 11bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO
FIXES THIS IN 5 MINUTES
Fix Credential Guard Blocking Saved Passwords and Credentials Automatically
RescuePC Toolkit includes 109+ automated repairs that fix this problem with one click. No command line knowledge required.
Download Now - Free TrialNo credit card required • Works on Windows 10 & 11