Windows 11 22H2 - Can't use saved credential

Andrzej S Ciesiński 126

After upgrade Windows 11 22H2 I Can't use saved credential (Windows Defender Credential Guard does not allow using saved credentials).
Before it works.

Renè Riedinger 1 Reputation point

2022-09-29T14:54:44.293+00:00

Same issue here!
informatik01 206 Reputation points

2022-10-05T15:57:37.54+00:00

Still this issue is present.
fabioalessandro 1 Reputation point

2022-10-05T18:11:27.04+00:00

resolve with this

Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard.

Add a new DWORD value named EnableVirtualizationBasedSecurity and set its value to 0.
Add another new DWORD value named RequirePlatformSecurityFeatures and set that to 0.

Now go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.

Add a new DWORD value named LsaCfgFlags and set it to 0.

Restart your computer.
David Nelson 131 Reputation points

2022-10-06T00:35:11.013+00:00

I have the same issue. My windows 11 22H2 is up to date.
Levan Kekelidze 6 Reputation points

2022-10-06T01:47:25.877+00:00

Thank you for the information.

Still would be nice to see the related official fix from Microsoft as well.
Renè Riedinger 1 Reputation point

2022-10-06T04:29:18.847+00:00

But why is this feature enabled in Win 11 Pro?
I'm using the Pro version and I have exactly the same behavior/issue
Br
Paweł Mikołajczyk 1 Reputation point

2022-10-06T07:25:49.823+00:00

This same problem win 11 pro ...
Paweł Mikołajczyk 1 Reputation point

2022-10-06T07:27:29.593+00:00

I'm using 11 Pro and have this same problem...
Bcdude 1 Reputation point

2022-10-06T17:24:11.877+00:00

I can’t save credentials for Remote Desktop. I was using streamdeck to automatically sign me in to two different rdp. Now it’s not working. I don’t want to change registry because that could cause other issues since I am not trained in this type of stuff . So what do I do? Switch to a different rdp provider? Or will windows be fixing this soon? I’m on win11 pro latest release .
David Nelson 131 Reputation points

2022-10-06T19:30:09.277+00:00

It seems to be part of Microsoft's efforts to make Windows more secure by default. You can read about is here:
https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-how-it-works

Microsoft clarified how to turn it off in the case where it was turned on by the Windows 11 22H2 update (see above my recent post) with a simple group policy change.
AdamStefanowski-5825 0 Reputation points

2023-11-06T01:30:26.1366667+00:00

Saving generic windows credentials works great for rdc, but if i try to start any other tools like edge or ssms i can not use the saved windows credentials...

C:\Windows\System32\runas.exe /user:domain\user /savecred "C:\Program Files (x86)\Microsoft SQL Server Management Studio 19\Common7\IDE\Ssms.exe"

C:\Windows\System32\runas.exe /savecred /user:DOMIAN\USER "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

is there any solution to that?
Bob Pants 256 Reputation points

2024-04-18T01:14:08.4466667+00:00

Works great in conjunction with fact that security teams are also making us use ridiculously long and complex password that take literally 2 minutes to type in.
Tim Weber 0 Reputation points

2024-04-25T15:46:50.85+00:00
AdamStefanowski,

Not sure if you've already figured this out, but there's a solution for SSMS. I used these instructions: https://dba.stackexchange.com/questions/66014/connect-to-sql-server-with-windows-authentication-in-a-different-domain

https://www.youtube.com/watch?v=WiVBPsqB9b4

Open Credential Manager

Click "Add A Windows Credential"

Populate the "internet or network address" field with the name and port number of the SQL instance you wish to store credentials for. Example: UniServer:1433 (1433 is the default port, you may need a different port, especially if you are connecting to a named instance)

Populate the "User Name" (don't forget to include the domain e.g. MYDOMAIN\MYUSER)

Populate the "Password"

Click OK
KTC_Church 21 Reputation points

2024-05-10T22:34:35.07+00:00

this fixed it! thanks.

23 answers

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more
Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more
Gee580 0 Reputation points

2023-03-14T20:28:01.24+00:00

Originally, Credential Guard was designed for Windows Enterprise and Education Edition. Pro Edition is not covered, but it is enabled by default for all as a mixed-up. This is the culprit. MS should have taken care of Windows Upgrade for Pro Edition.

I disabled Credential Guard to fix this problem. It should not affect the security level if you are using Pro Edition and 22H2 through Windows Update.

So, the fixing is :

Disabling Credential Guard can achieve through Group Policy Editor or some.

This is very easy.

Ref:

https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage#disabling-windows-defender-credential-guard-using-group-policy

https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage

HTH
Please sign in to rate this answer.
Topogigio 16 Reputation points

2023-03-15T08:19:43.1666667+00:00

I tried to disable Credential Guard via GPO but still RDP is asking for credentials.

Policy has been applied, I'm not sure CG has been really disabled.

informatik01 206 Reputation points

2023-03-15T09:48:03.6333333+00:00

@Topogigio

Why bother with disabling Credentials Guard (and thus reducing overall system security) when you can execute a one-liner and successfully add the desired credentials (and it will work 😄)?

See my answer above (Feb 19, 2023) regarding how to solve this problem using the cmdkey which is available in Windows out of the box. Just one line - and your credentials will be finally saved in a way that will make Windows Remote Desktop happy.

Topogigio 16 Reputation points

2023-03-15T10:18:10.2366667+00:00

because I'd like a company-wide fix, and MS docs seems reporting that the feature is an "addon" for Win Enterprise that I can ignore without to compromise security.

However I can confirm that your workaround works on my PC.

BTW disabling Credential Guard has created a LOT of problem on my workstation. Problem accessing DC shares (also GPO files), problem with my Yubi authentication, and a lot of instability. I reverted the setting to "enabled without UEFI".

Gee580 0 Reputation points

2023-03-15T17:14:44.5666667+00:00

Hi Topogigio,

Yubi authentication is 2-factor authentication. Right?

And your system is Enterprise Edition?

If so, I guess my workaround won't work.

BTW, how is the "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\LsaCfgFlags", now?

Is it 2?

And, how about "PS C:\WINDOWS\system32> (Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning"?

Topogigio 16 Reputation points

2023-03-16T09:04:04.9966667+00:00

Yubi is in passworless mode. No login, no psw, only the key to authenticate.

LsaCfgFlags currently is 2. But it was 0 before I restored via GPO the Credential Guard to stop disasters in my environment.

Win is Pro not enterprise

Gee580 0 Reputation points

2023-03-16T18:25:28.1533333+00:00

I took a look at the Yubico articles. It looks like you need to enable the Credential Guard. You should make sure that the configuration of Yubi and the requirements of how to work with the Windows Credential Guard are correct by yourself.

You just disabled it via GPO regardless of the Yubi configuration, didn't you?

So you have a disaster on your hands, I think.

Try a clean install if you can.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Windows 11 22H2 - Can't use saved credential

23 answers

Your answer