RDP Pass-the-Hash – GUI Session from an NT Hash

RDP supports Pass-the-Hash through Restricted Admin Mode — a feature that uses network logon instead of interactive logon, meaning credentials are not cached on the remote host and the server accepts an NT hash in place of a password. If Restricted Admin Mode is enabled on the target, you get a full graphical RDP session with only the NT hash.

Restricted Admin Mode is disabled by default but is commonly found enabled in larger environments. When it is not enabled, you can turn it on yourself if you have any form of code execution on the target — including through another Pass-the-Hash technique like psexec or wmiexec.

For non-graphical lateral movement with hashes over SMB, see https://hackindex.io/services/smb/exploitation/pass-the-hash.

Enabling Restricted Admin Mode on the Target

If you have remote code execution (psexec, wmiexec, evil-winrm, or any shell), enable Restricted Admin Mode with a registry write:

Or from an existing shell on the target:

Setting DisableRestrictedAdmin to 0 enables the feature. The name is counterintuitive — 0 means Restricted Admin is active, 1 disables it.

Connecting with xfreerdp from Linux

With Restricted Admin Mode enabled on the target, connect directly using the NT hash:

For a domain account:

A successful connection opens a full RDP desktop session as the user whose hash you supplied. The connection uses network logon, so your hash is not exposed on the target host.

If you get a STATUS_LOGON_FAILURE error, Restricted Admin Mode is not enabled or the account does not have RDP access on that host.

Connecting with Mimikatz from Windows

On a Windows foothold, use Mimikatz to inject the hash into a new mstsc.exe process:

This spawns an RDP client window with the target user's identity. The displayed username may show your current user — ignore it. Click Connect and the session authenticates with the injected hash.

Verifying Restricted Admin Mode Status

Check whether it is already enabled on the target before trying to enable it:

Output 0x0 means enabled. Output 0x1 or key not found means disabled.

What Restricted Admin Mode Changes

In a normal RDP session, your credentials are cached in LSASS on the remote host — extractable by anyone who later compromises that host. Restricted Admin Mode uses network logon, which does not cache credentials. This is why the feature exists from a defensive perspective. From an offensive perspective, it is the mechanism that makes Pass-the-Hash over RDP possible.

Because no credentials are cached, a Restricted Admin session cannot re-authenticate to network resources as the logged-in user by default. If you need to access network shares or AD resources from within the session, you may need to run commands under a different authentication context.

Kerberos Ticket via RDP

If you have a TGT for a user rather than a hash, inject it with Rubeus and open an RDP session that uses the ticket for network authentication:

For the full pass-the-ticket workflow, see https://hackindex.io/platforms/active-directory/lateral-movement/pass-the-ticket.