RDP Saved Credentials Not Allowed: Group Policy Fix

Last updated: 30 October 2026

Remote Desktop shows "Your credentials did not work. Your system administrator does not allow the use of saved credentials to log on to the remote computer because its identity is not fully verified" when the client cannot verify the server's identity, for example for a host in another domain or a workgroup. Windows then refuses to use saved credentials. You can allow saved credentials for specific servers with Group Policy or the registry.

In this guide

• Why it happens
• Fix with Group Policy
• Registry equivalent
• If it still fails
• FAQ
• Sources

Why it happens

Windows treats a connection as unsafe when it cannot verify the remote server, such as with no trust between client and server or with a self-signed certificate. It then blocks saved credentials and asks for a password every time.

Fix with Group Policy

On the client computer, open gpedit.msc and go to Computer Configuration, Administrative Templates, System, Credentials Delegation.

1. Enable Allow delegating saved credentials with NTLM-only server authentication, click Show, and add the server in the form TERMSRV/server1. Use a wildcard for a domain (TERMSRV/*.example.com) or TERMSRV/* for any computer. Keep TERMSRV in capitals.
2. Enable Allow delegating saved credentials and add the same entries.
3. Make sure Deny delegating saved credentials is disabled or not configured, because deny rules win.
4. Run gpupdate /force in an elevated Command Prompt, then reconnect.

The server name must match exactly what you type in the Remote Desktop connection field.

Registry equivalent

Under HKLM\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation set the DWORD values AllowSavedCredentialsWhenNTLMOnly and AllowSavedCredentials to 1. Each policy has a subkey with a string value named 1 set to TERMSRV/* or your chosen server.

If it still fails

• Check the policy "Network access: Do not allow storage of passwords and credentials for network authentication". It must be disabled.
• Delete the saved entry in Credential Manager and save the credentials again.
• Connect by the same name you listed in the policy, not by IP address, unless you listed the IP.
• Prefer fixing the root cause: use a trusted certificate on the server so its identity is verified.

FAQ

Is TERMSRV/* safe?

It allows saved credentials for any server, which is convenient but weaker. List only the servers you use.

Do I make the change on the server?

No. Make it on the client computer you connect from.

Does it work on Windows 11?

Yes, the same policies exist on current Windows versions.

Sources

• Windows OS Hub: Fix saved RDP credentials not working

More on this site: Security guides · All IT guides