UCF STIG Viewer Logo

Passwords must not be saved in the Remote Desktop Client.


Overview

Finding ID Version Rule ID IA Controls Severity
V-14247 WN12-CC-000096 SV-52958r1_rule Medium
Description
Saving passwords in the Remote Desktop Client could allow an unauthorized user to establish a remote desktop session to another system. The system must be configured to prevent users from saving passwords in the Remote Desktop Client.
STIG Date
Windows Server 2012 / 2012 R2 Member Server Security Technical Implementation Guide 2016-12-19

Details

Check Text ( C-47264r2_chk )
If the following registry value does not exist or is not configured as specified, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \Software\Policies\Microsoft\Windows NT\Terminal Services\

Value Name: DisablePasswordSaving

Type: REG_DWORD
Value: 1
Fix Text (F-45884r1_fix)
Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Connection Client -> "Do not allow passwords to be saved" to "Enabled".