Save Remote Desktop credentials safely (and remove them)

Ticking Remember me in Remote Desktop saves you typing a password every time. It also means anyone who can use your computer can open your server. This guide shows where Windows and Mac store those logins, when saving them is a sensible choice, and how to find and delete them, including from the command line.

Before you start

• Your server's IP address and username from your VPS provider's control panel. This guide uses 203.0.113.10 and admin.
• A Windows 10/11 computer with Remote Desktop Connection (mstsc), or a Mac with Windows App.
• No administrator rights are needed. Saved RDP logins belong to your own Windows user account.

Where Remote Desktop saves logins

Windows (mstsc): saved passwords go into Credential Manager, under Windows Credentials. Each entry is named TERMSRV/ followed by the server address, for example TERMSRV/203.0.113.10. Windows encrypts them and ties them to your Windows user account.

.rdp files: a saved .rdp file holds the address and username, but not the password. The password stays in Credential Manager. This is why copying an .rdp file to another computer does not copy your login.

Mac (Windows App): user accounts you add are stored by the app and protected by macOS. You can view and remove them in Windows App under Settings → Accounts (the exact menu name can change between versions).

When saving is fine, and when it is not

Saving the password is reasonable when:

• the computer is yours alone, with its own Windows sign-in password or PIN;
• the disk is encrypted, for example with BitLocker or FileVault;
• the screen locks automatically when you step away.

Do not save it when:

• the computer is shared with family, colleagues or customers;
• it is a public, hotel or library computer;
• the server holds money-related access, such as trading or payment accounts, and you would rather type the password each time.

On a public computer, see Use Remote Desktop safely from a public computer.

Save a login in mstsc

1. Press Win + R, type mstsc and press Enter.
2. Click Show Options and enter 203.0.113.10:3389 in Computer and admin in User name.
3. Tick Allow me to save credentials.
4. Click Connect, enter the password, and tick Remember me.

Next time, Remote Desktop signs in without asking.

View and delete saved logins in Credential Manager

1. Open Start, type Credential Manager and open it.
2. Click Windows Credentials.
3. Look for entries starting with TERMSRV/.
4. Expand one and click Remove to delete it, or Edit to update the password after you change it on the server.

You can also remove a saved login from mstsc itself: on the General tab, below the user name, click delete next to the saved credentials message.

List and delete logins with cmdkey

cmdkey is built into Windows and is faster when you manage several servers. Open Command Prompt or PowerShell as your normal user. List every saved entry:

cmdkey /list

RDP entries look like this:

Target: Domain:target=TERMSRV/203.0.113.10
Type: Domain Password
User: admin

Delete one by its target name, exactly as shown after target=:

cmdkey /delete:TERMSRV/203.0.113.10

To list only Remote Desktop entries in PowerShell:

cmdkey /list | Select-String 'TERMSRV'

You can also add an entry without typing the password on the command line. This command prompts for it:

cmdkey /generic:TERMSRV/203.0.113.10 /user:admin /pass

Block saved passwords on a shared computer

On a shared Windows Pro computer that you administer, you can stop Remote Desktop from saving passwords at all:

1. Run gpedit.msc as Administrator.
2. Go to Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Connection Client.
3. Set Do not allow passwords to be saved to Enabled.
4. Run gpupdate /force.

Check it works

After you remove a login, run cmdkey /list again. The TERMSRV/ entry for your server should be gone. Then connect with mstsc to 203.0.113.10:3389. Remote Desktop should ask for the password instead of signing in straight away.

Troubleshooting

• "Your credentials did not work" after a password change: the old saved password is still being sent. Delete the TERMSRV/ entry and connect again. See Fix "Your credentials did not work".
• Remember me has no effect: a policy blocks saved passwords, or the entry was saved under a different address, such as a hostname instead of the IP. Check cmdkey /list.
• cmdkey shows no TERMSRV entries but RDP still logs in: the login may be saved under a generic target, or by a connection manager app. Check that app's own settings.
• Entry will not delete: copy the target name exactly, including TERMSRV/, and run the command as the same Windows user who saved it.

Next steps

• Change the server password regularly: Change your Windows server password safely.
• Lock down logins further: Secure Remote Desktop on Windows Server.
• Manage many servers: Manage many servers with a Remote Desktop connection manager.