RDP Restricted Admin Mode

🔒 Secure Bits 💡
𝗗𝗼 𝗬𝗼𝘂 𝗨𝘀𝗲 𝗥𝗲𝘀𝘁𝗿𝗶𝗰𝘁𝗲𝗱 𝗔𝗱𝗺𝗶𝗻 𝗠𝗼𝗱𝗲 𝗳𝗼𝗿 𝗥𝗗𝗣?

If not, you should—it 𝗽𝗿𝗲𝘃𝗲𝗻𝘁𝘀 𝗰𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹 𝗲𝘅𝗽𝗼𝘀𝘂𝗿𝗲.

𝗪𝗵𝘆 𝗜𝘁 𝗘𝘅𝗶𝘀𝘁𝘀:
Restricted Admin Mode was designed to let administrators connect to a potentially compromised device without passing their credentials to it.

You must already be an administrator on the target machine, but your credentials never leave the source system, preventing theft and lateral movement attacks.

𝗪𝗵𝘆 𝗜𝘁 𝗠𝗮𝘁𝘁𝗲𝗿𝘀:
✅ 𝗦𝘁𝗼𝗽𝘀 𝗖𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹 𝗧𝗵𝗲𝗳𝘁 – Protects privileged accounts during RDP sessions.
✅ 𝗜𝗱𝗲𝗮𝗹 𝗳𝗼𝗿 𝗝𝘂𝗺𝗽 𝗛𝗼𝘀𝘁𝘀 & 𝗣𝗔𝗪𝘀 – Securely connect to your devices without risk.
✅ 𝗙𝗲𝗲𝗹𝘀 𝗟𝗶𝗸𝗲 𝗦𝗦𝗢 – No password entry needed—your local admin credentials are used, but never sent to the target.

𝗛𝗼𝘄 𝘁𝗼 𝗘𝗻𝗮𝗯𝗹𝗲 𝗜𝘁:
🔹𝗢𝗻 𝘁𝗵𝗲 𝗧𝗮𝗿𝗴𝗲𝘁 𝗗𝗲𝘃𝗶𝗰𝗲:
Add this registry key:
HKLM\SYSTEM\CurrentControlSet\Control\LSA
REG_DWORD – DisableRestrictedAdmin – 0

🔹𝗢𝗻 𝘁𝗵𝗲 𝗦𝗼𝘂𝗿𝗰𝗲 (𝗝𝘂𝗺𝗽𝗛𝗼𝘀𝘁/𝗣𝗔𝗪):
Administrative Templates\System\Credentials Delegation\Restrict delegation of credentials to remote servers – Require Restricted Admin

⚠️ 𝗟𝗶𝗺𝗶𝘁𝗮𝘁𝗶𝗼𝗻: Since no credentials are stored on the target, SSO won’t work from that machine.

I explain more about this feature in my Cybersecurity Courses 👇
https://academy.horizon-secured.com/p/courses

👉 Do you use this feature in your environment?