How to enable CredSSP delegation in group policy ?

Question

How to enable CredSSP delegation in group policy ?

Jiya Raha 100

I’m running into a technical issue with remote management commands that rely on CredSSP. The authentication mechanism itself is designed to delegate user credentials, but in my case the configured policy is blocking that delegation. Because of this, all remote commands using CredSSP are failing.

Could anyone share clear steps or best practices on how to properly enable CredSSP delegation through Group Policy so that these remote management tasks can succeed ?

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hello,

To enable CredSSP delegation in Group Policy, you must configure the Credentials Delegation policies under Computer Configuration and explicitly allow the target servers via their Service Principal Names (SPNs). Additionally, if you are using WinRM, CredSSP authentication must be enabled on both the client and the service side.

The precise path in Group Policy Editor is: Computer Configuration > Administrative Templates > System > Credentials Delegation. Here, enable either “Allow delegating fresh credentials” or “Allow delegating fresh credentials with NTLM-only server authentication,” depending on your environment. The Kerberos or certificate-based option is preferred for security; NTLM-only should only be used if unavoidable. Once enabled, you must add the SPNs of the servers you want to delegate to. For example, for Remote Desktop scenarios, valid entries include TERMSRV/*, TERMSRV/hostname.domain.com, or TERMSRV/*.domain.com. For WinRM, use the WSMAN/hostname.domain.com format. A single wildcard is permitted.

If your remote management relies on WinRM, you also need to enable CredSSP authentication under:

Computer Configuration > Administrative Templates > Windows Components > Windows Remote Management (WinRM) > WinRM Client > Allow CredSSP authentication
Computer Configuration > Administrative Templates > Windows Components > Windows Remote Management (WinRM) > WinRM Service > Allow CredSSP authentication

On the server side, ensure that WinRM has an HTTP or HTTPS listener configured. Without this, CredSSP authentication will fail even if the policies are correctly set. You can verify and configure listeners using winrm quickconfig or PowerShell cmdlets like Enable-WSManCredSSP.

One important note: CredSSP is not constrained delegation. It passes the user’s full credentials to the remote server. This means you should only delegate to trusted servers and avoid enabling NTLM-only unless absolutely required. For environments patched against CVE-2018-0886, also review the Encryption Oracle Remediation policy under the same Credentials Delegation node. Set it to “Force Updated Clients” or “Mitigated” depending on whether all endpoints are patched.

I recommend testing the configuration by running Enter-PSSession -ComputerName <server> -Authentication CredSSP from PowerShell after applying the policies. If it fails, double-check that the SPN entries match the exact target server names and that both client and server policies are aligned.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

HL.

Answer 2

To enable CredSSP delegation through Group Policy, configure both the delegation policy under Credentials Delegation and, for WinRM scenarios, enable CredSSP on both the client and the service.

Open Group Policy Editor.
Go to Computer Configuration > Administrative Templates > System > Credentials Delegation.
Enable the policy that matches the credential flow:
- Allow Delegating Fresh Credentials: use this when server authentication is done through Kerberos or a trusted certificate.
- Allow Delegating Fresh Credentials with NTLM-only Server Authentication: use this only when NTLM is being used. This is less secure because credentials are sent to an unauthenticated server.
In the enabled policy, add the target server SPN entries that are allowed to receive delegated credentials. CredSSP delegation requires specifying which servers can be delegated to.
- The server list uses Service Principal Names (SPNs).
- A single wildcard is allowed.
- Example patterns documented for Remote Desktop are TERMSRV/*, TERMSRV/host.humanresources.fabrikam.com, and TERMSRV/*.humanresources.fabrikam.com.
If the remote management commands use WinRM, also enable CredSSP authentication in Group Policy:
- Client: Computer Configuration\Administrative Templates\Windows Components\Windows Remote Management (WinRM)\WinRM Client > Allow CredSSP authentication
- Service: Computer Configuration\Administrative Templates\Windows Components\Windows Remote Management (WinRM)\WinRM Service > Allow CredSSP authentication
Ensure the remote server has an HTTP or HTTPS listener configured for WinRM.

If NTLM-only authentication is required for WinRM, also enable AllowFreshCredentialsWhenNTLMOnly under Computer Configuration\Administrative Templates\System\Credentials Delegation and add an SPN with the WSMAN prefix.

Security best practice:

CredSSP passes the user’s full credentials to the remote server and is not constrained delegation.
Prefer Kerberos or certificate-based authentication where possible.
Use the NTLM-only policy only when necessary.
Review Encryption Oracle Remediation under Computer Configuration -> Administrative Templates -> System -> Credentials Delegation and use a protection level appropriate for patched clients and servers. The available options are Force Updated Clients, Mitigated, and Vulnerable.