Windows 11 22H2 - Can't use saved credential

Andrzej S Ciesiński 126

After upgrade Windows 11 22H2 I Can't use saved credential (Windows Defender Credential Guard does not allow using saved credentials).
Before it works.

Renè Riedinger 1 Reputation point

2022-09-29T14:54:44.293+00:00

Same issue here!
informatik01 206 Reputation points

2022-10-05T15:57:37.54+00:00

Still this issue is present.
fabioalessandro 1 Reputation point

2022-10-05T18:11:27.04+00:00

resolve with this

Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard.

Add a new DWORD value named EnableVirtualizationBasedSecurity and set its value to 0.
Add another new DWORD value named RequirePlatformSecurityFeatures and set that to 0.

Now go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.

Add a new DWORD value named LsaCfgFlags and set it to 0.

Restart your computer.
David Nelson 131 Reputation points

2022-10-06T00:35:11.013+00:00

I have the same issue. My windows 11 22H2 is up to date.
Levan Kekelidze 6 Reputation points

2022-10-06T01:47:25.877+00:00

Thank you for the information.

Still would be nice to see the related official fix from Microsoft as well.
Renè Riedinger 1 Reputation point

2022-10-06T04:29:18.847+00:00

But why is this feature enabled in Win 11 Pro?
I'm using the Pro version and I have exactly the same behavior/issue
Br
Paweł Mikołajczyk 1 Reputation point

2022-10-06T07:25:49.823+00:00

This same problem win 11 pro ...
Paweł Mikołajczyk 1 Reputation point

2022-10-06T07:27:29.593+00:00

I'm using 11 Pro and have this same problem...
Bcdude 1 Reputation point

2022-10-06T17:24:11.877+00:00

I can’t save credentials for Remote Desktop. I was using streamdeck to automatically sign me in to two different rdp. Now it’s not working. I don’t want to change registry because that could cause other issues since I am not trained in this type of stuff . So what do I do? Switch to a different rdp provider? Or will windows be fixing this soon? I’m on win11 pro latest release .
David Nelson 131 Reputation points

2022-10-06T19:30:09.277+00:00

It seems to be part of Microsoft's efforts to make Windows more secure by default. You can read about is here:
https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-how-it-works

Microsoft clarified how to turn it off in the case where it was turned on by the Windows 11 22H2 update (see above my recent post) with a simple group policy change.
AdamStefanowski-5825 0 Reputation points

2023-11-06T01:30:26.1366667+00:00

Saving generic windows credentials works great for rdc, but if i try to start any other tools like edge or ssms i can not use the saved windows credentials...

C:\Windows\System32\runas.exe /user:domain\user /savecred "C:\Program Files (x86)\Microsoft SQL Server Management Studio 19\Common7\IDE\Ssms.exe"

C:\Windows\System32\runas.exe /savecred /user:DOMIAN\USER "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

is there any solution to that?
Bob Pants 256 Reputation points

2024-04-18T01:14:08.4466667+00:00

Works great in conjunction with fact that security teams are also making us use ridiculously long and complex password that take literally 2 minutes to type in.
Tim Weber 0 Reputation points

2024-04-25T15:46:50.85+00:00
AdamStefanowski,

Not sure if you've already figured this out, but there's a solution for SSMS. I used these instructions: https://dba.stackexchange.com/questions/66014/connect-to-sql-server-with-windows-authentication-in-a-different-domain

https://www.youtube.com/watch?v=WiVBPsqB9b4

Open Credential Manager

Click "Add A Windows Credential"

Populate the "internet or network address" field with the name and port number of the SQL instance you wish to store credentials for. Example: UniServer:1433 (1433 is the default port, you may need a different port, especially if you are connecting to a named instance)

Populate the "User Name" (don't forget to include the domain e.g. MYDOMAIN\MYUSER)

Populate the "Password"

Click OK
KTC_Church 21 Reputation points

2024-05-10T22:34:35.07+00:00

this fixed it! thanks.

23 answers

Peter Lapornik 21 Reputation points

2022-10-06T14:44:13.867+00:00

A word of warning - you probably shouldn't disable virtualisation-based security completely as some of these features are helpful. All you need to do is disable Credential Guard. A good source of information for this is the following: https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage
Please sign in to rate this answer.

2 people found this answer helpful.
Paweł Mikołajczyk 1 Reputation point

2022-10-06T15:21:16.03+00:00

So what is best solution to off credential Guard?

Martin Smulian 1 Reputation point

2022-10-06T16:19:39.993+00:00

I don't think that the suggested work-around does disable everything.

After setting
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard.
new DWORD value named EnableVirtualizationBasedSecurity and set its value to 0.
new DWORD value named RequirePlatformSecurityFeatures and set that to 0.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.
new DWORD value named LsaCfgFlags and set it to 0

and reboot then when I run msinfo32.exe I see

Virtualisation-based security: Running
Virtualisation-based security required security properties:
Virtualisation-based security available security properties: Base Virtualisation Support, Secure Boot, DMA Protection, Secure Memory Overwrite, UEFI Code Readonly, Mode Based Execution Control
Virtualisation-based security services configured: Hypervisor enforced Code Integrity
Virtualisation-based security services running: Hypervisor enforced Code Integrity
Windows Defender Application Control policy: Enforced
Windows Defender Application Control user mode policy: Off

Peter Lapornik 21 Reputation points

2022-10-07T10:04:18.213+00:00

The important thing is not to see Credential Guard under the Virtualisation-based security services configured and Virtualisation-based security services running rows in msinfo32.exe.

We partially solved it via group policy as per the following example:

Note: In your environment you may want to enable the code integrity and stack protection settings.

You may also need to disable Credential Guard EFI variables (via bcdedit)

The following is a reference for the above:
https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage

David Ching 21 Reputation points

2023-01-08T18:19:01.187+00:00

Thank you for noting that MSINFO shows the status of Credential Guard. The following subset of your steps fixed the problem for me:

Add the LSA registry value (only this one, not the others)

Use gpedit to set "Credential Guard Configuration" to Disabled (didn't disable "Secure Launch Configuration")

I had to delete and re-save the login credentials (the old ones were not valid).

This worked for one laptop. On another computer, in addition I also had to follow these directions to remove the credential guard enabling from the UEFI firmware.

mountvol X: /s
copy %WINDIR%\System32\SecConfig.efi X:\EFI\Microsoft\Boot\SecConfig.efi /Y
bcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d "DebugTool" /application osloader
bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} path "\EFI\Microsoft\Boot\SecConfig.efi"
bcdedit /set {bootmgr} bootsequence {0cb3b571-2f2e-4343-a879-d86a476d7215}
bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO
bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X:
mountvol X: /d

Daniel Montero 0 Reputation points

2023-02-15T22:15:31.2466667+00:00

I tried this guide, but my rdp is still unable to login "Windows Defender Credential Guard does not allow using saved credentials"
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Phil C 6 Reputation points

2022-10-07T10:08:19.147+00:00

I have the same issue with 11 22H2 family. Since the last upgrade of 21H2 and 22H2 I am no able to connect to any of other NAS/Computer in my workgroup. Microsoft MAYDAY MAYDAY

SOLVED

In my case the issue was in the name registered by windows. Instead ov 192.168.1.1 I registered, Windows created a name for my NAS and as I registered the user, evrything went correctly.
Please sign in to rate this answer.

1 person found this answer helpful.
Stano SK 1 Reputation point

2022-10-09T15:43:49.793+00:00

I confirm, I changed the name of my NAS and everything is working ok.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Taiki Bessho 5 Reputation points

2023-02-02T11:50:59.69+00:00

The store app version of the remote desktop client keeps my passwords correctly and does not require me to type the passwords every time.

Maybe Microsoft wants to make us shift to the store app. version.
Please sign in to rate this answer.

1 person found this answer helpful.
Topogigio 16 Reputation points

2023-02-02T11:54:23.4733333+00:00

maybe.

But I need to run something as mRemoteNG to manage and share e lot of connections, and I cannot switch to the other client :(

Dawid Johansson 16 Reputation points

2023-02-02T12:18:56.3666667+00:00

Works for me too but it is worse than the old one in the way I use it. So it's not an option for me
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
T. Kujala 8,741 Reputation points

2022-09-25T05:24:15.3+00:00

Hi @Andrzej S Ciesiński ,

You could try to enable this feature by following the next guide.

https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage
Please sign in to rate this answer.
Aren Cambre 6 Reputation points

2023-01-11T15:34:50.2933333+00:00

That page isn't helpful. The words saved, password, or remember do not appear, yet credential appears 118 times.

Nah, I'm turning off this feature until it stops breaking Remote Desktop Connection.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Andrzej S Ciesiński 126 Reputation points

2022-09-25T09:43:10.74+00:00

I don't want to disable it completely, just allow the use of saved credentials for remote connections.
"GPEDIT: If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*)."
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Windows 11 22H2 - Can't use saved credential

23 answers

Your answer