Restricted Admin Mode
Whether Restricted Admin mode is available for inbound RDP on this host.
Use it to tell whether RDP can be used without sending a password, which also allows hash logon.
- SYSTEM
- Defence Evasion
What It Is
Restricted Admin mode lets a member of the remote host's Administrators group sign in over Remote Desktop without sending their credentials to that host. Because no password or other reusable credential reaches the host, none can be harvested there if it has been compromised. DisableRestrictedAdmin, in the Lsa key of the SYSTEM hive, controls whether the host accepts the mode, which Microsoft's update 2973351 turned off by default in 2014. A 0 there also lets the host accept Remote Credential Guard, a related mode that keeps the user's credentials on their own computer.
What It Proves
DisableRestrictedAdmin set to 0 makes Restricted Admin RDP available, a network logon that does not send the password to the host. That mode can be driven with a stolen hash.
What It Does Not Prove
It shows the host will accept the mode, not that anyone used it. Some administration workflows enable it on purpose, so read it with the RDP logon history.
Where It Lives
Restricted Admin Mode lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| Restricted Admin RDP is available, so a logon can succeed from a hash without a password. Check type 10 logons in event 4624 in the Security log where Restricted Admin Mode reads Yes. |
| The mode is off, the common state. A later change to 0 on a host that does not need it is worth investigating. |
How to Read It
Read DisableRestrictedAdmin under Control\Lsa, where 1 or missing means the mode is off. A 0 enables it. Pair it with DisableRestrictedAdminOutboundCreds when reviewing a jump host. To put it right, set it to 1 unless the mode is required, and check type 10 RDP logons in event 4624 in the Security log.
- When Windows Writes It
- When an administrator or an attacker with admin rights writes the value.
- Which Windows Versions
- Windows 8.1 and Server 2012 R2 to 11
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper
Hunt It
Defender records writes to this value. A 0 shows the host will accept the mode, not that anyone used it, so match it against type 10 logons.
// Restricted Admin mode enabledDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Restricted Admin Mode shows.
- RDP Enabled (fDenyTSConnections)Shows whether the host accepts RDP at all, since without it this mode is never used.
- RDP Logons, Security Event 4624 (Type 10)Not in the RegistryShows RDP logons, and whether any used Restricted Admin mode.
Sources
The facts on this page come from these public pages, which say more on each point.