Essential Eight RA-ML3.7 Enable Remote Credential Guard functionality
What it says
Remote Credential Guard functionality is enabled.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPrevent admin credentials from being exposed during remote logins.
Remote Credential Guard stops hackers from stealing your password when you log in to work computers from far away. Without it, a hacker could pretend to be you and do things like transfer money or delete important files.
Free. Save your status, tasks and notes.
Why it matters
Without Remote Credential Guard, credentials can be exposed during RDP sign-in, enabling lateral movement and privilege escalation.
How to implement
System administrators should enable Remote Credential Guard on all computers that users access remotely by updating security settings in the Group Policy Editor.
IT teams should ensure all Windows systems are running the latest supported version, which includes Credential Guard features, by scheduling regular software updates.
Security officers should educate employees on the importance of Remote Credential Guard by providing training sessions and documentation.
IT support should test remote login processes after implementing Remote Credential Guard to ensure there is no disruption to user services.
Keep it running
Regularly confirm Remote Credential Guard is enabled for all RDP connections via Group Policy and test with representative admin accounts.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Have you enabled Remote Credential Guard on systems used for remote access?
Look at
Check the Group Policy settings on a sample of remote-accessible machines.
Good evidence
All relevant systems have Remote Credential Guard enabled, as shown by a specific Group Policy setting.
- Check 2 of 2What an auditor asks for
Ask for
How often are updates and configurations reviewed to protect remote login credentials?
Look at
Review logs of configuration changes and update schedules.
Good evidence
Regular updates are applied, and configurations are reviewed every six months, with logs to support this practice.
Mappings
Closest match in ASD Information Security Manual: ISM-1897, Enable Remote Credential Guard for credential protection, which asks for the same thing.
ASD Information Security Manual: 2 mappings
This control is equivalent to ISM-1897.
ISM-1897 requires that Remote Credential Guard functionality is enabled to protect credentials during remote authentication. E8-RA-ML3.7 requires the same control outcome by mandating Remote Credential Guard be enabled. Both controls are materially identical in scope and intent (credential theft reduction for remote logons).
This control partially overlaps ISM-1686.
ISM-1686 requires enabling Credential Guard to protect credentials on endpoints from unauthorised access. E8-RA-ML3.7 requires enabling Remote Credential Guard to protect credentials during remote authentication sessions (e.g. RDP). They share a common technical lineage and objective (reducing credential exposure), but Remote Credential Guard is session/remote-access focused while ISM-1686 is about endpoint credential isolation via Credential Guard generally.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and weak protocols; E8-RA-ML3.7 requires Remote Credential Guard functionality to be enabled, a hardening setting such a baseline would include.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.