This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(182.40000000000003, 18%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPD%3C/text%3E%3C/svg%3E)
We are experiencing a reproducible issue with Remote Credential Guard (RCG) when connecting from Windows 11 24H2 clients to a Windows Server 2025 RDP host. Remote Credential Guard works correctly before installing update KB5072033 on the client. Immediately after installing this update, RCG stops functioning.
The issue is fully reproducible and affects only Windows 11 24H2 clients where KB5072033 is installed. The Windows Server 2025 host has also received the December cumulative update, but this does not change the behavior: RCG still fails when the client has KB5072033 installed.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(16, 31%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERT%3C/text%3E%3C/svg%3E)
Microsoft, any progress in this? it is a showstopper for Server 2025 deployment!!
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(80, 11%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EHK%3C/text%3E%3C/svg%3E)
Sadly April Updates didnt fix it either
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(163.2, 98%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDC%3C/text%3E%3C/svg%3E)
not tested yet but promising :)
*
--edit
KB5083631
Installed on a 25H2 Windows 11 client still doesnt fix the issue,
When remoting to Windows Server 2025 - second hop doesnt work for network drives,
When remoting to Windows Server 2022 - second hop works as expected.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(147.20000000000002, 75%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EF%3C/text%3E%3C/svg%3E)
if source and target machine have got KB5083631 installed, both web sso and network share access seems fixed during my initial tests.
scenario's tested:
Windows 11 25h2 --> rdp /remoteguard to windows 11 25h2
Windows 11 24h2 --> rdp /remoteguard to windows 11 25h2.
Thank you SteveS :-p
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 55.00000000000001%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAK%3C/text%3E%3C/svg%3E)
I can confirm it works from Windows 11 25H2 to Windows Server 2025 with mentioned KIR fix.
@MTG If the RD Session Host role is installed on the server, RCG must be enabled at the GPO level (client). It does not work with the mstsc.exe -remoteGuard parameter.”
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(108.80000000000001, 77%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM%3C/text%3E%3C/svg%3E)
Hi Adam.
I can confirm it works from Windows 11 25H2 to Windows Server 2025 with mentioned KIR fix.
Now that puzzles me. That fix is active at my target server, active for months and no, we don't use /remoteguard, but have it required using GPOs. All three KIRs are enabled (for comparison, look at the screenshot, please):
Let's compare: server build is 10.0.26100.32860
Client is 10.0.26200.8457 - same for you???
Hi @MTG , I have only KIR 251003_17001 installed and enabled. My server si same build "10.0.26100.32860", and multiple W11 24/25H2 clients confirmed working. What is your error ?
@Adam Karas Are you sure that you use the same client version, please share it. My error? The same as 2 years ago when all this started: Try to access a domain resource from within an RDP session that was initiated from Win11 24/25H2 on server 2025 and you'll get a reauthentication prompt immediately. No error, just the need to reauthenticate which defies the purpose of remote credential guard completely. The KIR was working, but just when Server 2025 was accessed from older OS' like Win11 23H2, it never worked for 25H2. If, like you, I only activate KIR...17001, it doesn't change a thing. Weird. Sure that you get that right? Some people RDP into already authenticated console sessions - then, logically, the problem never surfaces. So please share your client version and proceedings.
@MTG This is/was my error on WSrv 2025 (double hop). Client W11 10.0.26100.7171 or 26220.8474, both working. Ping me on email (should be visible in my MS profile), dont want to spam here, I hope I can help you, spent lot of days troubleshooting RCG issues.
Thanks, same error here. However, be aware that your 26220.8474 is no stable release but a preview release and that 10.0.26100.7171 works here, too. So I wonder if you can test with a simple w11 25H2 with may update: 10.0.26200.8457
@MTG Yup, thats my personal insider preview version. I don't have clients updated with May update yet, but I don't think this update will have any effect.
Just so that you understand: the versions you use have no problem. I knew that before. But that are not the stable 25H2 versions that we use. Those still have the problem when RDPing to Server 2025!
@MTG just tested with 26200.8390, working.
Then tell me what you might be doing differently. Me and others have observed that it does not work despite the KIR being active. So my steps for reproduction are: Windows domain, join both devices, install may updates, apply KIR - broken. No other GPOs active apart from that that requires remote credential guard.
Hello,
I've managed to find confirmation of this issue, posted on Reddit by u/SteveSyfuhs.
https://www.reddit.com/r/activedirectory/comments/1gqq27g/comment/o0aso8c/
Additionally, I've installed KB5077241 on my Windows 11 25H2 client but installing this update didn't fix the Remote Credential Guard issue between Windows 11 25H2 client (26200.7922) and Windows Server 2025 RDP host (26100.32370).
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(265.6, 59%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGK%3C/text%3E%3C/svg%3E)
Steve Syfuhs: "Sadly yes. Tooling problem. Fix is getting expedited. Please don't ask when. I don't know."
We're slowly getting desperate here.
A few months ago, we created a new RDS farm, but RCD wasn't working. We upgraded Windows Server 2022 to Windows Server 2025, and RCD started working again. Then the 2025-12 update came along and RDC stopped working again.
Now we're considering rebuilding the entire farm with Windows 2022. I no longer have any confidence in Windows Server 2025 :-(
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Comments have been turned off. Learn more
Hello,
I’ve tested the latest Windows 11 preview build KB5073379 (26200.7705) together with the Windows Server 2025 build from 01/26 (26100.32230).
Unfortunately, multi‑hop authentication with Remote Credential Guard still does not work.
I’ve had partial success with the Kerberos second hop after creating a scheduled task on the RDS server that runs klist.exe purge at user logon.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(284.8, 51%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMK%3C/text%3E%3C/svg%3E)
Hi Dawid,
Could you provide an example how to create Scheduled Task trigger when user logon to RDS Session and run this command?
Thanks
Here's an example that works for me, but it's not a consistent fix. It works on the initial logon, but when the user reconnects to a disconnected session, it may stop working again.
klist.exe purge.
We are specifically talking about passwordless RDP by utilizing /remoteguard option.
mstsc /v:<fqdn> /remoteguard
Why they keep braking this over and over ... and is there a fix on the way? @Steve Syfuhs
Hello,
Most recent out-of-band update KB5077744
while promising to fix remote desktop authentication errors,
doesnt fix Remote Credential Guard scenario
Yes and don't ask when it will be fixed...
https://www.reddit.com/r/activedirectory/comments/1gqq27g/comment/o0d2cor/?force-legacy-sct=1
Hello, yes after April's patch tuesday and released vulnerabilities,
I've decided to rebuild our session hosts with Windows Server 2022, wait until this is fixed and then perfrom in-place upgrade "back" to 2025.
The attitude of Steve Syfuhs, as the person who ‘runs’ the Windows Authentication team, perfectly reflects the current state of Microsoft’s leadership.