L1 BIO 09.02.05 ISO A.9.4.1 CIS Windows - RDP password save

Intune: Do Not Allow RDP Passwords To Be Saved

πŸ“… 2025-10-30
β€’
⏱️ 2 minuten lezen
β€’
πŸ”΄ Must-Have

πŸ’Ό Management Samenvatting

Block RDP password saving - voorkomt credential storage in .rdp files (cleartext passwords on disk).

Aanbeveling
IMPLEMENT
Risico zonder
High
Risk Score
7/10
Implementatie
2u (tech: 1u)
Van toepassing op:
βœ“ Windows 10
βœ“ Windows 11

RDP saved passwords = credential theft: RDP client: 'Save my credentials' checkbox β†’ password saved in .rdp file, Storage: Weakly encrypted (reversible), Attack: Steal .rdp file (USB, email) β†’ extract password β†’ RDP access. Defense: Block password saving β†’ users must type password each time β†’ no stored credentials.

PowerShell Modules Vereist
Primary API: Microsoft Graph API
Connection: Connect-MgGraph
Required Modules: Microsoft.Graph.DeviceManagement

Implementatie

Block password save: Policy: Do not allow passwords to be saved: Enabled, Effect: 'Save credentials' checkbox disabled in RDP client, Users: Must enter password per session, Modern alternative: Azure AD authentication (no passwords).

Vereisten

  1. Intune subscription
  2. Windows 10/11

Implementatie

Intune Settings Catalog: Remote Desktop Services β†’ Do not allow passwords to be saved: Enabled.

Compliance

CIS Windows Benchmark L1, BIO 09.02, ISO 27001 A.9.4.1.

Monitoring

Gebruik PowerShell-script do-not-allow-passwords-to-be-saved-is-set-to-enabled.ps1 (functie Invoke-Monitoring) – Controleren.

Remediatie

Gebruik PowerShell-script do-not-allow-passwords-to-be-saved-is-set-to-enabled.ps1 (functie Invoke-Remediation) – Herstellen.

Compliance & Frameworks

Automation

Gebruik het onderstaande PowerShell script om deze security control te monitoren en te implementeren. Het script bevat functies voor zowel monitoring (-Monitoring) als remediation (-Remediation).

PowerShell
<# .SYNOPSIS Intune Security Options: Do Not Allow Passwords To Be Saved .DESCRIPTION CIS - Passwords opslaan niet toestaan in RDP. .NOTES Filename: no-password-save.ps1|Author: Nederlandse Baseline voor Veilige Cloud|Feature: RDP Security|Expected: Not allowed #> #Requires -Version 5.1 #Requires -RunAsAdministrator [CmdletBinding()]param([switch]$WhatIf, [switch]$Monitoring, [switch]$Remediation, [switch]$Revert) $ErrorActionPreference = 'Stop'; $RegPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services"; $RegName = "DisablePasswordSaving"; $ExpectedValue = 1 function Connect-RequiredServices { $p = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent()); return $p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) } function Test-Compliance { $r = [PSCustomObject]@{ScriptName = "pwd-save.ps1"; PolicyName = "Password Saving"; IsCompliant = $false; CurrentValue = $null; Details = @() }; try { if (Test-Path $RegPath) { $v = Get-ItemProperty -Path $RegPath -Name $RegName -ErrorAction SilentlyContinue; if ($v -and $v.$RegName -eq $ExpectedValue) { $r.IsCompliant = $true; $r.Details += "Password saving disabled" }else { $r.Details += "Password saving enabled" } }else { $r.Details += "Not configured" } }catch { $r.Details += "Error: $($_.Exception.Message)" }; return $r } function Invoke-Remediation { if (-not(Test-Path $RegPath)) { New-Item -Path $RegPath -Force | Out-Null }; Set-ItemProperty -Path $RegPath -Name $RegName -Value $ExpectedValue -Type DWord -Force; Write-Host "Password saving disabled in RDP" -ForegroundColor Green } function Invoke-Monitoring { $r = Test-Compliance; Write-Host "`n$($r.PolicyName): $(if($r.IsCompliant){'COMPLIANT'}else{'NON-COMPLIANT'})" -ForegroundColor $(if ($r.IsCompliant) { 'Green' }else { 'Red' }); return $r } try { if (-not(Connect-RequiredServices)) { exit 1 }; if ($Monitoring) { $r = Invoke-Monitoring; exit $(if ($r.IsCompliant) { 0 }else { 1 }) }elseif ($Remediation) { if (-not $WhatIf) { Invoke-Remediation } }elseif ($Revert) { Remove-ItemProperty -Path $RegPath -Name $RegName -ErrorAction SilentlyContinue }else { $r = Test-Compliance; exit $(if ($r.IsCompliant) { 0 }else { 1 }) } }catch { Write-Error $_; exit 1 }

Risico zonder implementatie

Risico zonder implementatie
High: Hoog: Saved RDP passwords = credential theft (weakly encrypted).

Management Samenvatting

Block RDP password saving. Credential protection. Users type password per session. Implementatie: 1-2 uur.