Description: This policy setting enables Remote Assistance invitations to be generated with improved encryption so that only computers running this version (or later versions) of the operating system can connect. This policy setting does not affect Remote Assistance connections that are initiated by instant messaging contacts or the unsolicited Offer Remote Assistance. If you enable this policy setting, only computers running this version (or later versions) of the operating system can connect to this computer. If you disable this policy setting, computers running this version and a previous version of the operating system can connect to this computer. If you do not configure this policy setting, users can configure the setting in System Properties in the Control Panel.

Why It's Important: This setting improves security by blocking older, less secure versions of Windows from connecting through Remote Assistance. Older systems may not support modern encryption standards, which could expose sensitive data or allow unauthorized access. By requiring newer Windows versions, we make sure that only devices with up-to-date security features can connect—like only letting people with secure ID badges into a restricted area.

Learn More

Description: This policy setting allows you to turn on or turn off Offer (Unsolicited) Remote Assistance on this computer. If you enable this policy setting, users on this computer can get help from their corporate technical support staff using Offer (Unsolicited) Remote Assistance. If you disable this policy setting, users on this computer cannot get help from their corporate technical support staff using Offer (Unsolicited) Remote Assistance. If you do not configure this policy setting, users on this computer cannot get help from their corporate technical support staff using Offer (Unsolicited) Remote Assistance. If you enable this policy setting, you have two ways to allow helpers to provide Remote Assistance: "Allow helpers to only view the computer" or "Allow helpers to remotely control the computer." When you configure this policy setting, you also specify the list of users or user groups that are allowed to offer remote assistance. To configure the list of helpers, click "Show." In the window that opens, you can enter the names of the helpers. Add each user or group one by one. When you enter the name of the helper user or user groups, use the following format: <Domain Name>\<User Name> or <Domain Name>\<Group Name> If you enable this policy setting, you should also enable firewall exceptions to allow Remote Assistance communications. The firewall exceptions required for Offer (Unsolicited) Remote Assistance depend on the version of Windows you are running. Windows Vista and later Enable the Remote Assistance exception for the domain profile. The exception must contain: Port 135:TCP %WINDIR%\System32\msra.exe %WINDIR%\System32\raserver.exe Windows XP with Service Pack 2 (SP2) and Windows XP Professional x64 Edition with Service Pack 1 (SP1) Port 135:TCP %WINDIR%\PCHealth\HelpCtr\Binaries\Helpsvc.exe %WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe %WINDIR%\System32\Sessmgr.exe For computers running Windows Server 2003 with Service Pack 1 (SP1) Port 135:TCP %WINDIR%\PCHealth\HelpCtr\Binaries\Helpsvc.exe %WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe Allow Remote Desktop Exception

Why It's Important: This setting improves privacy and security by making sure that support staff can’t remotely access a user’s computer unless the user explicitly asks for help. It avoids accidental or unauthorized remote access and ensures users stay in control of when and how their devices are accessed. It’s like requiring someone to knock and be invited in, rather than letting them walk in unannounced—even if they’re trusted.

Learn More

Description: This policy setting allows you to turn on or turn off Solicited (Ask for) Remote Assistance on this computer. If you enable this policy setting, users on this computer can use email or file transfer to ask someone for help. Also, users can use instant messaging programs to allow connections to this computer, and you can configure additional Remote Assistance settings. If you disable this policy setting, users on this computer cannot use email or file transfer to ask someone for help. Also, users cannot use instant messaging programs to allow connections to this computer. If you do not configure this policy setting, users can turn on or turn off Solicited (Ask for) Remote Assistance themselves in System Properties in Control Panel. Users can also configure Remote Assistance settings. If you enable this policy setting, you have two ways to allow helpers to provide Remote Assistance: "Allow helpers to only view the computer" or "Allow helpers to remotely control the computer." The "Maximum ticket time" policy setting sets a limit on the amount of time that a Remote Assistance invitation created by using email or file transfer can remain open. The "Select the method for sending email invitations" setting specifies which email standard to use to send Remote Assistance invitations. Depending on your email program, you can use either the Mailto standard (the invitation recipient connects through an Internet link) or the SMAPI (Simple MAPI) standard (the invitation is attached to your email message). This policy setting is not available in Windows Vista since SMAPI is the only method supported. If you enable this policy setting you should also enable appropriate firewall exceptions to allow Remote Assistance communications.

Why It's Important: This setting improves security and control by disabling the ability for users to send out Remote Assistance invitations. It helps prevent unauthorized or accidental sharing of access to their computer, especially in environments where remote support must be tightly managed. It’s like turning off the “help me” button unless IT has approved it—ensuring that remote access only happens through secure, monitored channels.

Learn More

Description: This policy setting specifies whether Remote Desktop Services always prompts the client for a password upon connection. You can use this setting to enforce a password prompt for users logging on to Remote Desktop Services, even if they already provided the password in the Remote Desktop Connection client. By default, Remote Desktop Services allows users to automatically log on by entering a password in the Remote Desktop Connection client. If you enable this policy setting, users cannot automatically log on to Remote Desktop Services by supplying their passwords in the Remote Desktop Connection client. They are prompted for a password to log on. If you disable this policy setting, users can always log on to Remote Desktop Services automatically by supplying their passwords in the Remote Desktop Connection client. If you do not configure this policy setting, automatic logon is not specified at the Group Policy level.

Why It's Important: This setting adds an extra layer of security by making sure users always confirm their identity when connecting remotely. Even if someone saved a password in the Remote Desktop app, they’ll still be asked to enter it again when the connection starts. It’s like double-checking someone’s ID before letting them into a secure building—helping prevent unauthorized access if a device or account is misused.

Learn More

Description: Specifies whether to require the use of a specific encryption level to secure communications between client computers and RD Session Host servers during Remote Desktop Protocol (RDP) connections. This policy only applies when you are using native RDP encryption. However, native RDP encryption (as opposed to SSL encryption) is not recommended. This policy does not apply to SSL encryption. If you enable this policy setting, all communications between clients and RD Session Host servers during remote connections must use the encryption method specified in this setting. By default, the encryption level is set to High. The following encryption methods are available: * High: The High setting encrypts data sent from the client to the server and from the server to the client by using strong 128-bit encryption. Use this encryption level in environments that contain only 128-bit clients (for example, clients that run Remote Desktop Connection). Clients that do not support this encryption level cannot connect to RD Session Host servers. * Client Compatible: The Client Compatible setting encrypts data sent between the client and the server at the maximum key strength supported by the client. Use this encryption level in environments that include clients that do not support 128-bit encryption. * Low: The Low setting encrypts only data sent from the client to the server by using 56-bit encryption. If you disable or do not configure this setting, the encryption level to be used for remote connections to RD Session Host servers is not enforced through Group Policy. Important FIPS compliance can be configured through the System cryptography. Use FIPS compliant algorithms for encryption, hashing, and signing settings in Group Policy (under Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options.) The FIPS compliant setting encrypts and decrypts data sent from the client to the server and from the server to the client, with the Federal Information Processing Standard (FIPS) 140 encryption algorithms, by using Microsoft cryptographic modules. Use this encryption level when communications between clients and RD Session Host servers require the highest level of encryption.

Why It's Important: This setting makes sure that any data sent during a Remote Desktop session—like login info, files, or screen content—is encrypted, meaning it’s scrambled so no one else can read it. By enforcing a strong encryption level (usually “High”), we protect sensitive information from being intercepted by hackers or malicious software. It’s like using a secure tunnel for your remote connection, so even if someone tries to peek in, they won’t be able to understand what’s being sent.

Learn More

Description: This policy setting allows you to specify whether to require user authentication for remote connections to the RD Session Host server by using Network Level Authentication. This policy setting enhances security by requiring that user authentication occur earlier in the remote connection process. If you enable this policy setting, only client computers that support Network Level Authentication can connect to the RD Session Host server. To determine whether a client computer supports Network Level Authentication, start Remote Desktop Connection on the client computer, click the icon in the upper-left corner of the Remote Desktop Connection dialog box, and then click About. In the About Remote Desktop Connection dialog box, look for the phrase Network Level Authentication supported. If you disable this policy setting, Network Level Authentication is not required for user authentication before allowing remote connections to the RD Session Host server. If you do not configure this policy setting, the local setting on the target computer will be enforced. On Windows Server 2012 and Windows 8, Network Level Authentication is enforced by default. Important: Disabling this policy setting provides less security because user authentication will occur later in the remote connection process.

Why It's Important: This setting helps protect the system by making sure that any remote management traffic is encrypted and authenticated. It blocks untrusted or unsecured connections that could be used by attackers to control or spy on the system. Think of it like requiring a secure, verified phone line for sensitive conversations—so no one can eavesdrop or impersonate someone else. It’s a key part of keeping remote access safe and locked down.

Learn More

Description: Controls whether passwords can be saved on this computer from Remote Desktop Connection. If you enable this setting the password saving checkbox in Remote Desktop Connection will be disabled and users will no longer be able to save passwords. When a user opens an RDP file using Remote Desktop Connection and saves his settings, any password that previously existed in the RDP file will be deleted. If you disable this setting or leave it not configured, the user will be able to save passwords using Remote Desktop Connection.

Why It's Important: This setting helps protect sensitive accounts by making sure passwords aren’t stored on the device, where they could be stolen or misused. Even though saving a password is convenient, it can be risky—especially if someone else gains access to the computer. By requiring users to type their password each time, we reduce the chance of unauthorized access and keep remote connections more secure.

Learn More

Description: This policy setting enables Remote Assistance invitations to be generated with improved encryption so that only computers running this version (or later versions) of the operating system can connect. This policy setting does not affect Remote Assistance connections that are initiated by instant messaging contacts or the unsolicited Offer Remote Assistance. If you enable this policy setting, only computers running this version (or later versions) of the operating system can connect to this computer. If you disable this policy setting, computers running this version and a previous version of the operating system can connect to this computer. If you do not configure this policy setting, users can configure the setting in System Properties in the Control Panel.

Why It's Important: This policy is like only allowing visitors who carry modern, secure ID badges into a building. By limiting Remote Assistance connections to newer Windows versions, SHIELD ensures that only systems with up-to-date security features can access the device. It helps prevent older, potentially insecure systems from connecting, reducing the risk of exploitation and maintaining a higher standard of security during remote support sessions.

Learn More

Description: This policy setting allows you to turn on or turn off Solicited (Ask for) Remote Assistance on this computer. If you enable this policy setting, users on this computer can use email or file transfer to ask someone for help. Also, users can use instant messaging programs to allow connections to this computer, and you can configure additional Remote Assistance settings. If you disable this policy setting, users on this computer cannot use email or file transfer to ask someone for help. Also, users cannot use instant messaging programs to allow connections to this computer. If you do not configure this policy setting, users can turn on or turn off Solicited (Ask for) Remote Assistance themselves in System Properties in Control Panel. Users can also configure Remote Assistance settings. If you enable this policy setting, you have two ways to allow helpers to provide Remote Assistance: "Allow helpers to only view the computer" or "Allow helpers to remotely control the computer." The "Maximum ticket time" policy setting sets a limit on the amount of time that a Remote Assistance invitation created by using email or file transfer can remain open. The "Select the method for sending email invitations" setting specifies which email standard to use to send Remote Assistance invitations. Depending on your email program, you can use either the Mailto standard (the invitation recipient connects through an Internet link) or the SMAPI (Simple MAPI) standard (the invitation is attached to your email message). This policy setting is not available in Windows Vista since SMAPI is the only method supported. If you enable this policy setting you should also enable appropriate firewall exceptions to allow Remote Assistance communications.

Why It's Important: This policy is like disabling the ability to ask for help through a remote doorbell. By turning off Solicited Remote Assistance, SHIELD ensures that remote access to devices only happens through approved and secure channels. It reduces the risk of unauthorized access, prevents accidental exposure of sensitive systems, and aligns with strict support protocols. This is especially important in environments where remote connections must be tightly controlled and monitored.

Learn More

Description: This policy setting allows you to turn on or turn off Solicited (Ask for) Remote Assistance on this computer. If you enable this policy setting, users on this computer can use email or file transfer to ask someone for help. Also, users can use instant messaging programs to allow connections to this computer, and you can configure additional Remote Assistance settings. If you disable this policy setting, users on this computer cannot use email or file transfer to ask someone for help. Also, users cannot use instant messaging programs to allow connections to this computer. If you do not configure this policy setting, users can turn on or turn off Solicited (Ask for) Remote Assistance themselves in System Properties in Control Panel. Users can also configure Remote Assistance settings. If you enable this policy setting, you have two ways to allow helpers to provide Remote Assistance: "Allow helpers to only view the computer" or "Allow helpers to remotely control the computer." The "Maximum ticket time" policy setting sets a limit on the amount of time that a Remote Assistance invitation created by using email or file transfer can remain open. The "Select the method for sending email invitations" setting specifies which email standard to use to send Remote Assistance invitations. Depending on your email program, you can use either the Mailto standard (the invitation recipient connects through an Internet link) or the SMAPI (Simple MAPI) standard (the invitation is attached to your email message). This policy setting is not available in Windows Vista since SMAPI is the only method supported. If you enable this policy setting you should also enable appropriate firewall exceptions to allow Remote Assistance communications.

Why It's Important: This policy is like disabling the ability to ask for help through a remote doorbell. By turning off Solicited Remote Assistance, SHIELD ensures that remote access to devices only happens through approved and secure channels. It reduces the risk of unauthorized access, prevents accidental exposure of sensitive systems, and aligns with strict support protocols. This is especially important in environments where remote connections must be tightly controlled and monitored.

Learn More

Description: This policy setting allows you to turn logging on or off. Log files are located in the user's Documents folder under Remote Assistance. If you enable this policy setting, log files are generated. If you disable this policy setting, log files are not generated. If you do not configure this setting, application-based settings are used.

Why It's Important: This policy is like keeping a visitor log at the front desk. By enabling session logging, SHIELD ensures that every Remote Assistance session is recorded, which helps with auditing, troubleshooting, and accountability. It provides a clear record of who accessed the system and what was done, making it easier to investigate issues or verify support activity. This is especially important in secure environments where transparency and traceability are critical.

Learn More

Description: This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses Basic authentication. If you enable this policy setting, the WinRM client uses Basic authentication. If WinRM is configured to use HTTP transport, the user name and password are sent over the network as clear text. If you disable or do not configure this policy setting, the WinRM client does not use Basic authentication.

Why It's Important: [coming soon]

Learn More

Description: This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses CredSSP authentication. If you enable this policy setting, the WinRM client uses CredSSP authentication. If you disable or do not configure this policy setting, the WinRM client does not use CredSSP authentication.

Why It's Important: [coming soon]

Learn More

Description: This policy setting allows you to manage whether the Windows Remote Management (WinRM) client sends and receives unencrypted messages over the network. If you enable this policy setting, the WinRM client sends and receives unencrypted messages over the network. If you disable or do not configure this policy setting, the WinRM client sends or receives only encrypted messages over the network.

Why It's Important: [coming soon]

Learn More

Description: This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses Digest authentication. If you enable this policy setting, the WinRM client does not use Digest authentication. If you disable or do not configure this policy setting, the WinRM client uses Digest authentication.

Why It's Important: Digest authentication is better than Basic, but still not secure enough for hardened environments. It uses outdated hashing methods and can be vulnerable to replay or brute-force attacks. SHIELD disables this setting to make sure only strong, modern authentication protocols are used. It’s like refusing to use an old lock that’s easy to pick—choosing stronger protection to keep remote access safe.

Learn More

Description: This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses Kerberos authentication directly. If you enable this policy setting, the Windows Remote Management (WinRM) client does not use Kerberos authentication directly. Kerberos can still be used if the WinRM client is using the Negotiate authentication and Kerberos is selected. If you disable or do not configure this policy setting, the WinRM client uses the Kerberos authentication directly.

Why It's Important: Kerberos is secure, but using it directly can introduce risks in environments where authentication flows need to be tightly controlled. Disabling direct Kerberos use forces authentication through Negotiate, which allows for better auditing and control. SHIELD enables this policy to reduce the risk of credential delegation and ensure authentication is scoped properly. It’s like requiring all access requests to go through a checkpoint instead of letting users take shortcuts—more oversight, less risk.

Learn More

Description: This policy setting allows you to manage whether the Windows Remote Management (WinRM) service accepts Negotiate authentication from a remote client. If you enable this policy setting, the WinRM service does not accept Negotiate authentication from a remote client. If you disable or do not configure this policy setting, the WinRM service accepts Negotiate authentication from a remote client.

Why It's Important: [coming soon]

Learn More

Description: This policy setting allows you to manage whether the Windows Remote Management (WinRM) service accepts Basic authentication from a remote client. If you enable this policy setting, the WinRM service accepts Basic authentication from a remote client. If you disable or do not configure this policy setting, the WinRM service does not accept Basic authentication from a remote client.

Why It's Important: Basic authentication sends usernames and passwords in plaintext, which makes them easy to intercept if encryption isn’t enforced. It also doesn’t support modern authentication methods and increases the risk of credential theft. SHIELD disables this setting to make sure only secure, encrypted authentication protocols are used. It’s like refusing to share sensitive information unless the conversation is happening in a locked room—protecting credentials from being exposed or misused.

Learn More

Description: This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses CredSSP authentication. If you enable this policy setting, the WinRM client uses CredSSP authentication. If you disable or do not configure this policy setting, the WinRM client does not use CredSSP authentication.

Why It's Important: CredSSP lets credentials be forwarded to remote systems, which can be risky if those systems are compromised. It increases the chance of credential theft and can be exploited in man-in-the-middle attacks. SHIELD disables this setting to keep authentication local and secure. It’s like refusing to hand your keys to someone else to unlock a door—keeping control in your hands and reducing the risk of misuse.

Learn More

Description: This policy setting allows you to manage whether the Windows Remote Management (WinRM) service automatically listens on the network for requests on the HTTP transport over the default HTTP port. If you enable this policy setting, the WinRM service automatically listens on the network for requests on the HTTP transport over the default HTTP port. To allow WinRM service to receive requests over the network, configure the Windows Firewall policy setting with exceptions for Port 5985 (default port for HTTP). If you disable or do not configure this policy setting, the WinRM service will not respond to requests from a remote computer, regardless of whether or not any WinRM listeners are configured. The service listens on the addresses specified by the IPv4 and IPv6 filters. The IPv4 filter specifies one or more ranges of IPv4 addresses, and the IPv6 filter specifies one or more ranges of IPv6addresses. If specified, the service enumerates the available IP addresses on the computer and uses only addresses that fall within one of the filter ranges. You should use an asterisk (*) to indicate that the service listens on all available IP addresses on the computer. When * is used, other ranges in the filter are ignored. If the filter is left blank, the service does not listen on any addresses. For example, if you want the service to listen only on IPv4 addresses, leave the IPv6 filter empty. Ranges are specified using the syntax IP1-IP2. Multiple ranges are separated using "," (comma) as the delimiter.

Why It's Important: [coming soon]

Learn More

Description: This policy setting allows you to manage whether the Windows Remote Management (WinRM) client sends and receives unencrypted messages over the network. If you enable this policy setting, the WinRM client sends and receives unencrypted messages over the network. If you disable or do not configure this policy setting, the WinRM client sends or receives only encrypted messages over the network.

Why It's Important: Sending unencrypted traffic over the network exposes credentials, commands, and system information to interception. This can lead to data theft or manipulation, especially in environments where remote management is widely used. SHIELD disables this setting to make sure all communication is encrypted and secure. It’s like refusing to send important messages on a postcard—everything goes in a sealed envelope to protect what’s inside.

Learn More

Description: This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses Kerberos authentication directly. If you enable this policy setting, the Windows Remote Management (WinRM) client does not use Kerberos authentication directly. Kerberos can still be used if the WinRM client is using the Negotiate authentication and Kerberos is selected. If you disable or do not configure this policy setting, the WinRM client uses the Kerberos authentication directly.

Why It's Important: Kerberos is secure, but using it directly can introduce risks in environments where authentication flows need to be tightly controlled. Disabling direct Kerberos use forces authentication through Negotiate, which allows for better auditing and control. SHIELD enables this policy to reduce the risk of credential delegation and ensure authentication is scoped properly. It’s like requiring all access requests to go through a checkpoint instead of letting users take shortcuts—more oversight, less risk.

Learn More

Description: This policy setting allows you to manage whether the Windows Remote Management (WinRM) service accepts Negotiate authentication from a remote client. If you enable this policy setting, the WinRM service does not accept Negotiate authentication from a remote client. If you disable or do not configure this policy setting, the WinRM service accepts Negotiate authentication from a remote client.

Why It's Important: [coming soon]

Learn More

Description: This policy setting allows you to set the hardening level of the Windows Remote Management (WinRM) service with regard to channel binding tokens. If you enable this policy setting, the WinRM service uses the level specified in HardeningLevel to determine whether or not to accept a received request, based on a supplied channel binding token. If you disable or do not configure this policy setting, you can configure the hardening level locally on each computer. If HardeningLevel is set to Strict, any request not containing a valid channel binding token is rejected. If HardeningLevel is set to Relaxed (default value), any request containing an invalid channel binding token is rejected. However, a request that does not contain a channel binding token is accepted (though it is not protected from credential-forwarding attacks). If HardeningLevel is set to None, all requests are accepted (though they are not protected from credential-forwarding attacks).

Why It's Important: [coming soon]

Learn More

Description: This policy setting allows you to manage whether the Windows Remote Management (WinRM) service will not allow RunAs credentials to be stored for any plug-ins. If you enable this policy setting, the WinRM service will not allow the RunAsUser or RunAsPassword configuration values to be set for any plug-ins. If a plug-in has already set the RunAsUser and RunAsPassword configuration values, the RunAsPassword configuration value will be erased from the credential store on this computer. If you disable or do not configure this policy setting, the WinRM service will allow the RunAsUser and RunAsPassword configuration values to be set for plug-ins and the RunAsPassword value will be stored securely. If you enable and then disable this policy setting,any values that were previously configured for RunAsPassword will need to be reset.

Why It's Important: [coming soon]

Learn More

Description: This policy setting allows you to specify whether users can run unsigned Remote Desktop Protocol (.rdp) files and .rdp files from unknown publishers on the client computer. If you enable or do not configure this policy setting, users can run unsigned .rdp files and .rdp files from unknown publishers on the client computer. Before a user starts an RDP session, the user receives a warning message and is asked to confirm whether they want to connect. If you disable this policy setting, users cannot run unsigned .rdp files and .rdp files from unknown publishers on the client computer. If the user tries to start an RDP session, the user receives a message that the publisher has been blocked.

Why It's Important: Allowing .rdp files from unknown publishers can lead to phishing or spoofing attacks, where users are tricked into connecting to unsafe systems. Disabling this feature ensures that only verified and trusted remote desktop configurations are used. SHIELD enforces this policy to protect users from accidentally launching malicious remote sessions. It’s like refusing to open a door unless you know who gave you the key—safe, verified, and secure.

Learn More

Description: This policy setting allows you to specify whether the client will establish a connection to the RD Session Host server when the client cannot authenticate the RD Session Host server. If you enable this policy setting, you must specify one of the following settings: Always connect, even if authentication fails: The client connects to the RD Session Host server even if the client cannot authenticate the RD Session Host server. Warn me if authentication fails: The client attempts to authenticate the RD Session Host server. If the RD Session Host server can be authenticated, the client establishes a connection to the RD Session Host server. If the RD Session Host server cannot be authenticated, the user is prompted to choose whether to connect to the RD Session Host server without authenticating the RD Session Host server. Do not connect if authentication fails: The client establishes a connection to the RD Session Host server only if the RD Session Host server can be authenticated. If you disable or do not configure this policy setting, the authentication setting that is specified in Remote Desktop Connection or in the .rdp file determines whether the client establishes a connection to the RD Session Host server when the client cannot authenticate the RD Session Host server.

Why It's Important: Enforcing server authentication helps prevent man-in-the-middle attacks and ensures users only connect to verified servers. It protects credentials and session data from being intercepted and supports compliance with secure remote access policies. SHIELD enables this policy to block connections to unverified servers and remove the option for users to bypass warnings. It’s like refusing to enter a building unless you’re sure it’s the right one—safe, verified, and secure.

Learn More

Description: Controls whether passwords can be saved on this computer from Remote Desktop Connection. If you enable this setting the password saving checkbox in Remote Desktop Connection will be disabled and users will no longer be able to save passwords. When a user opens an RDP file using Remote Desktop Connection and saves his settings, any password that previously existed in the RDP file will be deleted. If you disable this setting or leave it not configured, the user will be able to save passwords using Remote Desktop Connection.

Why It's Important: Disabling password saving helps protect credentials from being accessed by unauthorized users, especially on shared or compromised devices. It enforces secure login practices and prevents cached credentials from being used to access sensitive systems. SHIELD enables this policy to reduce the risk of credential theft and support compliance with security standards. It’s like requiring users to enter their key every time instead of leaving it under the mat—more secure, more accountable.

Learn More

Description: This policy setting specifies whether to prevent the mapping of client drives in a Remote Desktop Services session (drive redirection). By default, an RD Session Host server maps client drives automatically upon connection. Mapped drives appear in the session folder tree in File Explorer or Computer in the format on . You can use this policy setting to override this behavior. If you enable this policy setting, client drive redirection is not allowed in Remote Desktop Services sessions, and Clipboard file copy redirection is not allowed on computers running Windows Server 2003, Windows 8, and Windows XP. If you disable this policy setting, client drive redirection is always allowed. In addition, Clipboard file copy redirection is always allowed if Clipboard redirection is allowed. If you do not configure this policy setting, client drive redirection and Clipboard file copy redirection are not specified at the Group Policy level.

Why It's Important: Enforcing a specific encryption level ensures that all remote desktop sessions are protected with strong encryption. It prevents weak or outdated encryption methods from being used and blocks connections from legacy clients that don’t meet minimum security standards. SHIELD enables this policy to secure remote access, protect sensitive data, and meet compliance requirements. It’s like requiring a secure tunnel for every remote session—no shortcuts, no weak links, just strong protection every time.

Learn More

Description: Set client connection encryption level: Enabled.

Why It's Important: Enforcing a specific encryption level ensures that all remote desktop sessions are protected with strong encryption. It prevents weak or outdated encryption methods from being used and blocks connections from legacy clients that don’t meet minimum security standards. SHIELD enables this policy to secure remote access, protect sensitive data, and meet compliance requirements. It’s like requiring a secure tunnel for every remote session—no shortcuts, no weak links, just strong protection every time.

Learn More

Description: This policy setting specifies whether Remote Desktop Services always prompts the client for a password upon connection. You can use this setting to enforce a password prompt for users logging on to Remote Desktop Services, even if they already provided the password in the Remote Desktop Connection client. By default, Remote Desktop Services allows users to automatically log on by entering a password in the Remote Desktop Connection client. If you enable this policy setting, users cannot automatically log on to Remote Desktop Services by supplying their passwords in the Remote Desktop Connection client. They are prompted for a password to log on. If you disable this policy setting, users can always log on to Remote Desktop Services automatically by supplying their passwords in the Remote Desktop Connection client. If you do not configure this policy setting, automatic logon is not specified at the Group Policy level.

Why It's Important: This policy ensures that users are always prompted to re-enter their password when connecting through Remote Desktop Services, even if credentials were already provided in the client. Enforcing an interactive password prompt helps prevent credential reuse, cached credential attacks, and unauthorized access through saved RDP sessions.

Learn More

Description: This policy setting allows you to specify whether to require user authentication for remote connections to the RD Session Host server by using Network Level Authentication. This policy setting enhances security by requiring that user authentication occur earlier in the remote connection process. If you enable this policy setting, only client computers that support Network Level Authentication can connect to the RD Session Host server. To determine whether a client computer supports Network Level Authentication, start Remote Desktop Connection on the client computer, click the icon in the upper-left corner of the Remote Desktop Connection dialog box, and then click About. In the About Remote Desktop Connection dialog box, look for the phrase Network Level Authentication supported. If you disable this policy setting, Network Level Authentication is not required for user authentication before allowing remote connections to the RD Session Host server. If you do not configure this policy setting, the local setting on the target computer will be enforced. On Windows Server 2012 and Windows 8, Network Level Authentication is enforced by default. Important: Disabling this policy setting provides less security because user authentication will occur later in the remote connection process.

Why It's Important: This policy enforces Network Level Authentication (NLA) for all Remote Desktop connections, requiring users to authenticate before establishing a remote session. It helps prevent unauthorized access and protects the Remote Desktop Session Host from denial-of-service and brute-force attacks by rejecting unauthenticated connections early in the process.

Learn More

Description: This policy setting allows you to configure remote access to computers by using Remote Desktop Services. If you enable this policy setting, users who are members of the Remote Desktop Users group on the target computer can connect remotely to the target computer by using Remote Desktop Services. If you disable this policy setting, users cannot connect remotely to the target computer by using Remote Desktop Services. The target computer will maintain any current connections, but will not accept any new incoming connections. If you do not configure this policy setting, Remote Desktop Services uses the Remote Desktop setting on the target computer to determine whether the remote connection is allowed. This setting is found on the Remote tab in the System properties sheet. By default, remote connections are not allowed. Note: You can limit which clients are able to connect remotely by using Remote Desktop Services by configuring the policy setting at Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security\Require user authentication for remote connections by using Network Level Authentication. You can limit the number of users who can connect simultaneously by configuring the policy setting at Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections\Limit number of connections, or by configuring the policy setting Maximum Connections by using the Remote Desktop Session Host WMI Provider.

Why It's Important: This policy disables Remote Desktop access to prevent users from connecting remotely to the device using Remote Desktop Services (RDP). Disabling RDP reduces the system’s exposure to remote exploitation, credential theft, and brute-force attacks.

Learn More