Disable: 'Restrict delegation of credentials to remote servers' When running in restricted mode, participating apps do not expose credentials to remote computers (regardless of the delegation method). Restricted mode may limit access to resources located on other servers or networks beyond the target computer because credentials are not delegated. Participating apps: Remote Desktop Client If you enable this policy setting, restricted mode is enforced and participating apps will not delegate credentials to remote computers. If you disable or do not configure this policy setting, restricted mode is not enforced and participating apps can delegate credentials to remote computers. Note: To disable most credential delegation, it may be sufficient to deny delegation in Credential Security Support Provider (CredSSP) by modifying Administrative template settings (located at Computer Configuration\Administrative Templates\System\Credentials Delegation). Counter Measure: Enable and configure this setting. Potential Impact: Users may not be able to access resources located on other servers or networks beyond the target computer because credentials are not delegated.

(1) GPO: Computer Configuration\Administrative Templates\System\Credentials Delegation\Restrict delegation of credentials to remote servers (2) REG: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CredentialsDelegation\RestrictedRemoteAdministration