Dhammaan isticmaalayaasha maamulayaasha nidaamka waxay leeyihiin hal walaac oo dhab ah - xaqiijinta aqoonsiga xiriirinta Desktop Fog . ^(Desktop)Tani waa sababta oo ah malware-ku wuxuu heli karaa dariiqa kombuyuutar kasta oo kale oo ku yaal isku xirka desktop-ka oo wuxuu khatar ku yahay xogtaada. Taasi waa sababta Windows OS u iftiimiso digniinta " Hubi inaad ku kalsoon tahay PC-kan, ku xidhidhiyaha kombuyuutar aan la aamini karin waxay dhaawac u geysan kartaa kombuyutarkaaga^{(Make sure you trust this PC, connecting to an untrusted computer might harm your PC)} " markaad isku daydo inaad ku xidho desktop fog.

Maqaalkan, waxaan ku arki doonaa sida muuqaalka ilaalinta aqoonsiga fog^{(Remote Credential Guard)} , kaas oo lagu soo bandhigay  Windows 10 , wuxuu kaa caawin karaa ilaalinta aqoonsiga fog ee desktop Windows 10 Enterprise iyo Windows Server .

Ilaalada aqoonsiga fog^{(Remote Credential Guard)} ee Windows 10

Muuqaalka waxaa loogu talagalay in lagu baabi'iyo hanjabaadaha ka hor inta aysan u dhicin xaalad halis ah. Waxay kaa caawinaysaa inaad ka ilaaliso aqoonsigaaga isku xirka Desktop Fog adiga oo codsiyada ^(Desktop)Kerberos dib ugu celinaya aaladda codsanaysa xidhiidhka. Waxa kale oo ay siisaa waayo-aragnimada calaamad-ku-meel- gaadhka ah ee fadhiyada Desktop- ka Fog.^{(Remote Desktop)}

Haddii ay dhacdo nasiib darro kasta oo aaladda bartilmaameedka ah la jabiyo, aqoonsiga isticmaalaha lama soo bandhigin sababtoo ah labadaba aqoonsiga iyo soo-jeedinta aqoonsiga weligood looma diro aaladda bartilmaameedka ah.

Habka operandi ee Ilaalinta Aqoonsiga Fog^{(Remote Credential Guard)} wuxuu aad ula mid yahay ilaalinta ay bixiso Ilaalada Aqoonsiga ee mishiinka maxaliga ah marka laga reebo Ilaalada Aqoonsiga^{(Credential Guard)} sidoo kale waxay ilaalisaa aqoonsiga domain ee kaydsan iyada oo loo sii marayo Maareeyaha Aqoonsiga^{(Credential Manager)} .

Shakhsigu waxa uu u isticmaali karaa Ilaalinta Aqoonsiga Fog ee^{(Remote Credential Guard)} hababka soo socda-

1. Mar haddii shahaadooyinka maamuluhu^{(Administrator)} ay mudnaanta sare leeyihiin, waa in la ilaaliyo. Adigoo isticmaalaya Ilaaliyaha Aqoonsiga Fog^{(Remote Credential Guard)} , waxaa laguu xaqiijin karaa in aqoonsigaaga la ilaaliyo maadaama aysan u oggolaan in aqoonsiyadu u gudbaan shabakadda aaladda bartilmaameedka ah.
2. Shaqaalaha Helpdesk^(Helpdesk) ee ururkaaga waa in ay ku xidhmaan aaladaha ku biiray domain-ka kuwaas oo laga yaabo in wax loo dhimo. Ilaalada Aqoonsiga Fog^{(Remote Credential Guard)} , shaqaalaha miiska caawinta wuxuu isticmaali karaa RDP si uu ugu xidho aaladda la beegsanayo iyada oo aan waxyeello loo geysanin aqoonsigooda malware.

Shuruudaha hardware iyo software

Si aad awood ugu yeelatid habsami u shaqaynta Ilaalada Aqoonsiga Fog^{(Remote Credential Guard)} , hubi in shuruudaha soo socda ee macmiilka Desktop-ka fog^{(Remote Desktop)} iyo adeegaha ay buuxiyeen.

1. Macmiilka Desktop-ka fog^{(Remote Desktop Client)} iyo adeegaha waa in lagu biiraa hagaha Active Directory
2. Labada qalabba waa inay ku biiraan isla goob isku mid ah, ama waa in server-ka Desktop-ka fog^{(Remote Desktop)} lagu biiraa goob xidhiidh aamin ah la leh bogga agabka macmiilka.
3. Xaqiijinta Kerberos waxay ahayd in la hawlgeliyo.
4. Macmiilka Desktop-ka fog^{(Remote Desktop)} waa inuu shaqeeyaa ugu yaraan Windows 10 , nooca 1607 ama Windows Server 2016 .
5. The Remote Desktop Universal Platform Windows^{(Remote Desktop Universal Windows Platform)} ma taageerto Ilaalada Aqoonsiga Fog^{(Remote Credential Guard)} sidaa darteed, isticmaal abka Windows -ka caadiga ah ee Desktop- ka fog.^{(Remote Desktop)}

Ka yeel Ilaalada Aqoonsiga Fog^{(Remote Credential Guard)} ee Diiwaangelinta^(Registry)

Si aad awood ugu siiso Ilaalinta Aqoonsiga Fog ee^{(Remote Credential Guard)} aaladda la beegsaday, fur Tifaftiraha Diiwaanka^{(Registry Editor)} oo tag furaha soo socda:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa

Ku dar qiime cusub oo DWORD ah oo lagu magacaabo DisableRestrictedAdmin . Deji qiimaha goobta diiwaangelintan 0 si aad u daarto Ilaalada Aqoonsiga Fog^{(Remote Credential Guard)} .

Xir Tifaftiraha Diiwaanka

Waxaad awood u siin kartaa Ilaalinta Aqoonsiga Fog^{(Remote Credential Guard)} adiga oo ka socodsiinaya amarkan soo socda ee CMD:

reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /d 0 /t REG_DWORD

Daar Ilaalada Aqoonsiga Fog^{(Remote Credential Guard)} adiga oo isticmaalaya Siyaasadda Kooxda^{(Group Policy)}

Waa suurtogal in lagu isticmaalo Ilaalinta Aqoonsiga Fog ee^{(Remote Credential Guard)} qalabka macmiilka adiga oo dejinaya Siyaasad Kooxeed^{(Group Policy)} ama adigoo isticmaalaya halbeeg leh Xiriirinta Mashiinka Fog^{(Remote Desktop Connection)} .

Laga bilaabo Console-ka Maareynta Siyaasadda Kooxda^{(Group Policy Management Console)} , u Computer Configuration > Administrative Templates > System > Credentials Delegation.

Hadda, laba-guji Ku xaddid ergada aqoonsiga server-yada fog^{(Restrict delegation of credentials to remote servers)} si aad u furto sanduuqa Guryaha.

Hadda gudaha Adeegso sanduuqa habka xaddidan ee soo socda^{(Use the following restricted mode)} , dooro Baahan Ilaaliyaha Aqoonsiga Fog. ^{( Require Remote Credential Guard. )}Xulashada kale Habka maamulka xaddidan^{(Restricted Admin mode)} ayaa sidoo kale jira. Muhiimaddeedu waa marka Ilaalada Aqoonsiga Fog ee fog^{(Remote Credential Guard)} aan la isticmaali karin, waxay isticmaali doontaa habka Maamulka xaddidan .^{(Restricted Admin)}

Si kastaba ha ahaatee, Ilaaliyaha Aqoonsiga Fog^{(Remote Credential Guard)} ama qaabka maamulka xaddidan^{(Restricted Admin)} midna uma soo diri doono aqoonsi qoraal cad seerfarka Desktop-ka fog .^{(Remote Desktop)}

Oggolow Ilaalada Aqoonsiga Fog^{(Allow Remote Credential Guard)} , adiga oo dooranaya ' doorbidayaa Ilaalada Aqoonsiga Fog^{(Prefer Remote Credential Guard)} ' ee doorashada.

Guji OK^{(Click OK)} oo ka bax Console Maamulka Siyaasadda Kooxda^{(Group Policy Management Console)} .

Hadda, laga bilaabo amar degdeg ah, ku socodsii gpupdate.exe /force si loo hubiyo in shayga Siyaasadda Kooxda^{(Group Policy)} la dabaqay.

Adeegso Ilaalada Aqoonsiga Fog^{(Use Remote Credential Guard)} oo leh halbeeg ku xidhidhiyaha Mashiinka^{(Remote Desktop)} Fog

Haddii aadan u isticmaalin Siyaasadda Kooxda^{(Group Policy)} ee ururkaaga, waxaad ku dari kartaa cabbirka fogaanta marka aad bilowdo isku xidhka Desktop Fog si aad u shido Ilaalada Aqoonsiga Fog^{(Desktop Connection)} ee xidhiidhkaas^{(Remote Credential Guard)} .

mstsc.exe /remoteGuard

Waxyaabaha ay tahay inaad maskaxda ku hayso markaad isticmaalayso Ilaalinta Aqoonsiga Fog^{(Remote Credential Guard)}

1. Ilaalada Aqoonsiga Fog^{(Remote Credential Guard)} looma isticmaali karo in lagu xidho aalada ku biirtay Tusaha Firfircoon ee Azure^{(Azure Active Directory)} .
2. Ilaaliyaha Aqoonsiga Desktop Fog^{(Remote Desktop Credential Guard)} wuxuu la shaqeeyaa borotokoolka RDP kaliya.^(RDP)
3. Ilaalada aqoonsiga fog^{(Remote Credential Guard)} kuma jiraan sheegashooyinka aaladaha. Tusaale ahaan, haddii aad isku dayayso inaad ka soo gasho server-ka faylalka fogfog oo seerfarku u baahan yahay sheegasho qalab, gelitaanka waa la diidi doonaa.
4. Seerfarka iyo macmiilku waa inay xaqiijiyaan iyagoo isticmaalaya Kerberos .
5. Goobuhu waa inay lahaadaan xiriir aamin ah, ama labadaba macmiilka iyo server-ka waa in lagu biiraa isla goob isku mid ah.
6. Kadinka Desktop-^{(Remote Desktop Gateway)} ka fog kuma habboona Ilaalada Aqoonsiga Fog^{(Remote Credential Guard)} .
7. Wax aqoonsi ah laguma daadin aaladda la beegsaday . Si kastaba ha noqotee, aaladda la beegsanayo ayaa wali hesha Tigidhada ^(Tickets)Adeegga Kerberos^{(Kerberos Service)} kaligiis.
8. Ugu dambayntii, waa inaad isticmaashaa aqoonsiga isticmaalaha ee ku jira aaladda. Isticmaalka shahaadooyinka la kaydiyay ama aqoonsiga ka duwan kaaga lama ogola.

Waxaad wax badan oo arrintan ku saabsan ka akhriyi kartaa Technet .

la xiriira^(Related) : Sida loo kordhiyo tirada Xidhiidhada Desktop Fog^{(increase the number of Remote Desktop Connections)} ee Windows 10.

Remote Credential Guard protects Remote Desktop credentials

All system administrator users have one very genυine concern – securing credentials over a Remote Dеsktoр connection. This is because malware can find its way to any other compυter over the desktop connection and рose a potentiаl threat to your data. That is why Windows OS flashes a warning “Make sure you trust this PC, connecting to an untrusted computer might harm your PC” when you try to connect to a remote desktop.

In this post, we will see how the Remote Credential Guard feature, which has been introduced in Windows 10, can help protect remote desktop credentials in Windows 10 Enterprise and Windows Server.

Remote Credential Guard in Windows 10

The feature is designed to eliminate threats before it develops into a serious situation. It helps you protect your credentials over a Remote Desktop connection by redirecting the Kerberos requests back to the device that’s requesting the connection. It also provides single sign-on experiences for Remote Desktop sessions.

In the event of any misfortune where the target device is compromised, credentials of the user are not exposed because both credential and credential derivatives are never sent to the target device.

The modus operandi of Remote Credential Guard is very similar to the protection offered by Credential Guard on a local machine except for Credential Guard also protects stored domain credentials via the Credential Manager.

An individual can use Remote Credential Guard in the following ways-

1. Since Administrator credentials are highly privileged, they must be protected. By using Remote Credential Guard, you can be assured that your credentials are protected as it does not allow credentials to pass over the network to the target device.
2. Helpdesk employees in your organization must connect to domain-joined devices that could be compromised. With Remote Credential Guard, the helpdesk employee can use RDP to connect to the target device without compromising their credentials to malware.

Hardware and software requirements

To enable smooth functioning of the Remote Credential Guard, ensure the following requirements of Remote Desktop client and server are met.

1. The Remote Desktop Client and server must be joined to an Active Directory domain
2. Both devices must either joined to the same domain, or the Remote Desktop server must be joined to a domain with a trust relationship to the client device’s domain.
3. The Kerberos authentication should have been enabled.
4. The Remote Desktop client must be running at least Windows 10, version 1607 or Windows Server 2016.
5. The Remote Desktop Universal Windows Platform app doesn’t support Remote Credential Guard so, use Remote Desktop classic Windows app.

Enable Remote Credential Guard via Registry

To enable Remote Credential Guard on the target device, open Registry Editor and go to the following key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa

Add a new DWORD value named DisableRestrictedAdmin. Set the value of this registry setting to 0 to turn on Remote Credential Guard.

Close the Registry Editor.

You can enable Remote Credential Guard by running the following command from an elevated CMD:

reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /d 0 /t REG_DWORD

Turn on Remote Credential Guard by using Group Policy

It is possible to use Remote Credential Guard on the client device by setting a Group Policy or by using a parameter with Remote Desktop Connection.

From the Group Policy Management Console, navigate to Computer Configuration > Administrative Templates > System > Credentials Delegation.

Now, double-click Restrict delegation of credentials to remote servers to open its Properties box.

Now in the Use the following restricted mode box, choose Require Remote Credential Guard. The other option Restricted Admin mode is also present. Its significance is that when Remote Credential Guard cannot be used, it will use Restricted Admin mode.

In any case, neither Remote Credential Guard nor Restricted Admin mode will send credentials in clear text to the Remote Desktop server.

Allow Remote Credential Guard, by choosing ‘Prefer Remote Credential Guard’ option.

Click OK and exit the Group Policy Management Console.

Now, from a command prompt, run gpupdate.exe /force to ensure that the Group Policy object is applied.

Use Remote Credential Guard with a parameter to Remote Desktop Connection

If you don’t use Group Policy in your organization, you can add the remoteGuard parameter when you start Remote Desktop Connection to turn on Remote Credential Guard for that connection.

mstsc.exe /remoteGuard

Things you should keep in mind when using Remote Credential Guard

1. Remote Credential Guard cannot be used to connect to a device that is joined to Azure Active Directory.
2. Remote Desktop Credential Guard only works with the RDP protocol.
3. Remote Credential Guard does not include device claims. For example, if you’re trying to access a file server from the remote and the file server requires device claim, access will be denied.
4. The server and client must authenticate using Kerberos.
5. The domains must have a trust relationship, or both the client and the server must be joined to the same domain.
6. Remote Desktop Gateway is not compatible with Remote Credential Guard.
7. No credentials are leaked to the target device . However, the target device still acquires the Kerberos Service Tickets on its own.
8. Lastly, you must use the credentials of the user who is logged into the device. Using saved credentials or credentials that are different than yours are not permitted.

You can read more on this at Technet.

Related: How to increase the number of Remote Desktop Connections in Windows 10.

Related posts

• Kordhi tirada Xidhiidhada Mashiinka Fog ee gudaha Windows 11/10

• Furaha Daaqadaha ayaa xayiran ka dib markii laga beddelay fadhi Fog

• Laguma koobi karo koojka fadhiga fog ee miiska gudaha Windows 10

• Khalad xaqiijineed ayaa dhacay, Shaqada la codsaday lama taageero

• Ku samee isku xidhka Desktop-ka fog ee gaaban gudaha Windows 11/10

• Hagaaji Desktop Fog ma ku xidhmi doono Windows 10

• Daar Desktop Fog Windows 10 wax kayar 2 Daqiiqo

• Sida Looga Habeeyo Mishiinka Fog ee Router-ka

• Daar Desktop Fog adoo isticmaalaya Command Prompt ama PowerShell

• Xidhiidhka RDP wuu gooyaa marka aad awood u siiso Sound on Desktop Fog

• Sida loo soo diro Ctrl+Alt+Delete gudaha Fadhiga Fog ee Miiska

• Si aad meel fog uga soo gasho, waxaad u baahan tahay inaad ka soo gasho Adeegyada Desktop Fog

• Ka saar gelinta taariikhda isku xirka Desktop Fog ee gudaha Windows 11

• Software-ka ugu fiican ee Desktop-ka fog ee bilaashka ah ee Windows 10

• Isku daygii calaamada wuu guuldarraystay markii la isku xidhayay Desktop Fog

• Microsoft Remote Desktop App ee loogu talagalay Windows 11/10

• Ku xidh Android ku Windows 10 addoo isticmaalaya Mishiinka Fog ee Microsoft

• Kombiyuutarka fog ma shaqaynayo ama kuma xidhi doono gudaha Windows 11/10

• Sida loo xakameeyo kombuyutarka Windows-ka iyadoo la isticmaalayo Desktop Fog ee Mac

• Hagaaji arrimaha isku xirka Desktop Fog iyo khaladaadka ku jira Windows 11/10