In modern enterprise environments, remote access is essential for daily IT operations. Administrators frequently rely on Remote Desktop Protocol (RDP) to manage servers, troubleshoot systems, and maintain infrastructure.
However, remote sessions can introduce significant security risks if credential handling is not properly controlled.
In traditional Remote Desktop scenarios, authentication credentials or their corresponding hashes may be temporarily stored in the memory of the remote host. If that system becomes compromised, attackers may attempt to extract those credentials and use them to move laterally across the network.
This technique is commonly associated with credential harvesting attacks such as Pass-the-Hash and memory dumping, where malicious actors extract authentication secrets from system memory to gain unauthorized access to other systems.
Microsoft provides mechanisms to mitigate this risk by controlling how credentials are delegated during remote sessions.
By enforcing policies through Microsoft Intune, organizations can ensure that credentials used during remote connections are non-exportable, preventing reusable authentication secrets from being stored on remote hosts.
When enabled, this control helps protect administrative sessions and significantly reduces the risk of credential theft and lateral movement.
The result is a stronger security posture where remote management remains efficient while authentication secrets remain protected.
Why This Policy Matters
Remote administration is necessary in most enterprise environments, but it also represents a common entry point for credential theft attacks.
Without proper protections in place:
Remote systems may temporarily store reusable credentials
Compromised servers may become credential harvesting points
Attackers may extract NTLM hashes or passwords from memory
Stolen credentials may be reused for lateral movement
By enforcing delegation of non-exportable credentials:
Reusable credentials are never exposed to the remote host
Credential harvesting risks are significantly reduced
Administrative sessions remain protected
Lateral movement opportunities are minimized
This approach aligns with modern security principles such as Least Privilege, Credential Protection, and Zero Trust architecture.
How the Policy Strengthens Security Governance
This configuration ensures that Windows protects authentication secrets during Remote Desktop sessions.
When enforced:
Credentials remain protected on the originating device
Remote hosts cannot store reusable authentication secrets
Credential harvesting attempts become significantly harder
Administrative sessions remain secure even when connecting to potentially compromised systems
By deploying this control through Microsoft Intune, organizations can centrally enforce secure credential delegation across all managed endpoints.
Windows CSP Overview
The policy responsible for enforcing this behavior is exposed through the Windows Policy Configuration Service Provider (CSP) framework.
The configuration RemoteHostAllowsDelegationOfNonExportableCredentials ensures that credentials used during remote sessions cannot be exported or reused by the remote host.
This setting applies at the device scope and is supported on modern Windows editions including Pro, Enterprise, and Education starting with Windows 10 version 1803 and later.
When deployed through Intune configuration profiles, the policy ensures consistent credential protection across all managed devices.
Description Framework Properties
This policy is implemented through the Windows CSP framework, allowing Intune to configure the setting directly at the operating system level.
Key configuration properties include:
Format: chr (string)
Access Type: Add, Delete, Get, Replace
These properties allow administrators to deploy and manage the configuration centrally using Intune while ensuring that the setting remains persistent across device restarts.
ADMX Mapping (For Reference)
For organizations that still rely on traditional Group Policy or operate in hybrid environments, this CSP setting maps directly to the equivalent Administrative Template configuration.
Policy Name AllowProtectedCreds
Friendly Name Remote host allows delegation of non-exportable credentials
Location Computer Configuration
Policy Path System → Credentials Delegation
Registry Key Software\Policies\Microsoft\Windows\CredentialsDelegation
Registry Value Name AllowProtectedCreds
ADMX File CredSsp.admx
This mapping ensures that the same security configuration can be enforced consistently across both Group Policy and Intune-managed environments.
How to Configure Secure Credential Delegation for Remote Sessions Using Intune (Settings Catalog)
You can enforce this policy centrally using the Intune Settings Catalog, ensuring consistent protection of credentials during Remote Desktop sessions across all Windows devices.
To begin, sign in to the Microsoft Intune admin center and follow the steps below, as illustrated in the screenshot.
Create the Configuration Profile
In the Microsoft Intune admin center:
Navigate to Devices
Select Windows
Click Configuration
Select + Create policy
In the Create a profile pane:
Platform: Windows 10 and later
Profile type: Settings catalog
Click Create to continue.
At this stage, you have created the foundation of a Settings Catalog policy. In the next steps, you will search for and configure the setting that controls how credentials are delegated during remote sessions.
This ensures that Windows protects authentication secrets by allowing delegation of non-exportable credentials, preventing reusable credentials from being stored on remote hosts and reducing the risk of credential theft during Remote Desktop connections.
Define Basic Profile Details
After clicking Create, the next step is to define the basic details of the configuration profile. This stage is essential for long-term management, clarity, and governance within Microsoft Intune especially in environments with multiple endpoint hardening policies and security baselines.
Providing a clear Name and a concise but meaningful Description ensures that the purpose of the policy is immediately understood by administrators and security teams in the future.
As shown in the screenshot, configure the fields as follows:
Policy Name and Description
Name: WIN – Endpoint Hardening – Protect Credentials During Remote Sessions
Description: This policy strengthens endpoint security by preventing credential exposure during Remote Desktop sessions. It enforces the use of non-exportable credentials, reducing the risk of credential theft, credential harvesting, and lateral movement attacks within managed Windows environments.
The Platform field is already pre-selected as Windows, so no changes are required.
Once the name and description are defined, click Next to proceed to the configuration settings.
Configure the Setting Using the Settings Picker
With the profile basics defined, the next step is to configure the policy using the Settings picker, where you select the exact Windows security setting to enforce.
Click Add settings to open the Settings picker panel.
By default, this setting is not configured, which means Windows will follow its existing behavior and will not explicitly enforce this credential protection control through Intune unless you enable it.
As shown in the screenshot, use the search field at the top of the Settings picker and type:
Remote host allows delegation of non-exportable credentials
Then click Search to filter the results.
From the returned results:
Select the Administrative Templates > System > Credentials Delegation category
Choose the setting: Remote host allows delegation of non-exportable credentials
Once selected, the setting is added to the configuration profile. Back on the configuration page, change the value from its default state to Enabled.
When enabled, Windows ensures that credentials used during Remote Desktop sessions remain non-exportable, preventing reusable authentication secrets from being transmitted to the remote host.
This significantly reduces the risk of credential theft, credential harvesting, and lateral movement attacks, while allowing administrators to securely manage remote systems.
This configuration aligns with modern endpoint hardening practices and supports Zero Trust security principles, ensuring that authentication secrets remain protected even during remote administrative sessions.
After configuring the setting, click Next to continue with the profile deployment steps.
Configure Scope Tags (Optional)
Scope tags are used to control who can view and manage this policy within the Microsoft Intune admin center. They are particularly useful in environments with delegated administration, multiple IT teams, or regional management models.
As shown in the screenshot, the Default scope tag is selected. This is the standard and recommended configuration for most environments, as it ensures the policy is visible to all administrators who have access to Intune.
Optionally, custom scope tags can be assigned if you need to:
Restrict policy visibility to specific IT roles or teams
Enforce administrative separation of duties
Support delegated or region-based Intune management
If no additional scope tags are required, keep the Default selection and click Next to continue.
Assignments – Restrict Anonymous Access Policy
After configuring the policy settings, the next step is to assign the policy to the appropriate target group. Assignments define which devices will receive and enforce this configuration, ensuring the policy is applied in a controlled and intentional manner.
In the Assignments tab, click Add groups under Included groups and search for the group you want to target. This approach allows you to deploy the policy gradually, starting with test devices before expanding to production.
As shown in the screenshot, the policy is assigned to the following group:
GRP – MS365Education – Test Computers
Once the group is selected, verify the following:
The group appears under Included groups
The group status is Active
No assignment filters are applied (unless explicitly required)
At this stage, no Excluded groups are configured, which is appropriate for controlled test deployments.
After confirming the assignment, click Next to proceed to the Review + Create step.
Review + Create – Final Validation
The Review + Create step is the final checkpoint before deploying the policy. This is where you validate that all configurations are correct and aligned with your intended endpoint credential protection objective.
Pay special attention to the following items:
Policy name and description:
Confirm that the policy clearly reflects its purpose: strengthening endpoint security by protecting credentials during Remote Desktop sessions and preventing reusable authentication secrets from being exposed to remote hosts.
Configuration settings Verify that Remote host allows delegation of non-exportable credentials is set to Enabled under Administrative Templates > System > Credentials Delegation.
Scope tags: Ensure the correct scope tag is assigned. In this example, the Default scope tag is used.
Assignments: Confirm the policy is assigned to the intended group: GRP – MS365Education – Test Computers
Also verify that no unintended exclusions are configured.
This final review step helps prevent misconfigurations, unintended deployments, or scope issues especially in environments with multiple security baselines, delegated administration, and layered endpoint security policies.
Once everything has been validated, click Create to finalize and deploy the policy to the assigned devices.
Monitor Policy Deployment Status
After creating and assigning the WIN – Endpoint Hardening – Protect Credentials During Remote Sessions configuration profile, the next step is to verify its deployment status.
This validation confirms that the policy has been successfully applied and that Windows is enforcing secure credential delegation during Remote Desktop sessions on the targeted devices.
Although Microsoft Intune can take up to 8 hours to deliver configuration profiles automatically, deployment often occurs much faster. If needed, you can accelerate the process by:
Triggering a manual device sync from the Company Portal
Initiating a sync directly from the Microsoft Intune admin center
Monitoring deployment ensures that the credential protection policy is active and operating as intended.
How to Verify Policy Deployment Status
To review the deployment results:
In the Microsoft Intune admin center, navigate to Devices ➝ Configuration profiles
Use the search bar to locate the profile: WIN – Endpoint Hardening – Protect Credentials During Remote Sessions
Select the policy to open the Overview page.
Review Deployment Metrics
Intune provides clear indicators to evaluate the policy deployment status:
Succeeded – Devices have successfully applied the policy
In progress – Devices are still processing the configuration
Error – The policy failed to apply and requires investigation
Not applicable – The device does not support the configuration
When devices report Succeeded, it confirms that Windows is enforcing the policy Remote host allows delegation of non-exportable credentials, helping ensure that authentication secrets are not exposed during Remote Desktop sessions.
This verification step confirms that the credential protection control is successfully deployed and protecting managed Windows endpoints.
Why This Validation Matters
Monitoring the deployment status ensures that the credential protection policy is correctly enforced across managed devices.
It confirms that:
Secure credential delegation is actively applied
Remote sessions are protected against credential exposure
There are no deployment failures or unsupported devices
The endpoint security baseline remains consistent across the environment
This final validation step completes the policy lifecycle from configuration and deployment to enforcement and verification.
Security hardening is only effective when it is verified.
Client-Side Verification via Event Viewer
After the device has synced with Intune, you can perform a client-side verification to confirm that the WIN – Endpoint Hardening – Protect Credentials During Remote Sessions policy was successfully applied.
This validation helps ensure that the credential protection configuration is actively enforced at the operating system level.
Windows records Intune policy processing events locally, allowing administrators to confirm policy enforcement without relying only on the Intune portal.
How to Verify
Open Event Viewer on the target device
Navigate to: Applications and Services Logs ➝ Microsoft ➝ Windows ➝ DeviceManagement-Enterprise-Diagnostics-Provider ➝ Admin
Select Filter Current Log
Look for Event ID 813 or Event ID 814, which indicate successful processing of Intune configuration policies
Open the event details and confirm that the policy Remote host allows delegation of non-exportable credentials was applied
Pro Tip
Match the event timestamp with the device’s most recent Intune sync.
Event IDs 813 and 814 are reliable indicators that the configuration policy was processed by the Windows MDM engine.
If the policy is correctly applied, Windows will enforce secure credential delegation during Remote Desktop sessions, ensuring that authentication secrets remain protected and are not exposed to remote hosts.
Why This Matters for Endpoint Security
Credential theft remains one of the most common techniques used by attackers to move laterally across enterprise environments.
Without proper protections, compromised servers may expose reusable credentials stored in memory during remote sessions.
By enforcing delegation of non-exportable credentials through Microsoft Intune and validating the configuration locally, organizations ensure that:
Authentication secrets remain protected on the originating device
Remote hosts cannot store reusable credentials
Credential harvesting risks are reduced
Administrative sessions are protected against credential replay attacks
This simple but powerful configuration strengthens credential protection without disrupting legitimate administrative workflows.
Key Takeaway
Security hardening does not always require complex architectures.
Sometimes, a single well-governed configuration can eliminate an entire category of risk.
By enforcing secure credential delegation through Microsoft Intune, organizations ensure that authentication secrets are not exposed during Remote Desktop sessions.
Combined with centralized deployment and proper validation, this policy transforms remote administration into a more secure and controlled process.
And in modern endpoint security, protecting credentials means protecting the entire environment.
More Information
For additional technical details, refer to the official Microsoft documentation below:
https://learn.microsoft.com/en-us/mem/intune/configuration/settings-catalog
https://learn.microsoft.com/en-us/mem/intune/configuration/device-profiles
https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-credentialsdelegation
https://learn.microsoft.com/en-us/windows/security/identity-protection/remote-credential-guard
https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-monitor
https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-troubleshoot
Thank you!
🖥️ Ricardo Barbosa
🎖️ Microsoft MVP | 📘 Microsoft Certified Trainer (MCT)
☁️ Intune & Cloud Architect |💼 Technology Director at Altelix.com