Connect to VMConnect Failed with Your credentials did not work

Windows Server 2025 Core
Hyper-V

Overview of VMConnect

Default port: 2179
Using RDP potocal

Symptoms

Issue: VMConnect fails with "Your credentials did not work Windows Defender Credential Guard does not allow using Windows logon credentials. Please enter your credentials".

Solution

Disable the GPO Computer Configuration\Administrative Templates\System\Device Guard\Turn On Virtualizaton Based Security on VMM server.

gpupdate /force

(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning

---

Issue: VMConnect fails with "Your credentials did not work The credentials that were used to connect HYPER-V-1 did not work. Please enter new credentials".

Workaround

Enable the GPO on VMM server:

Computer Configuration\Administrative Templates\System\Credentials Delegation\Allow Delegating Default Credentials
Computer Configuration\Administrative Templates\System\Credentials Delegation\Allow Delegating Default Credentials with NTLM-only Server Authentication
Computer Configuration\Administrative Templates\System\Credentials Delegation\Allow Delegating Fresh Credentials
Computer Configuration\Administrative Templates\System\Credentials Delegation\Allow Delegating Fresh Credentials with NTLM-only Server Authentication
Computer Configuration\Administrative Templates\System\Credentials Delegation\Allow Delegating Saved Credentials
Computer Configuration\Administrative Templates\System\Credentials Delegation\Allow Delegating Saved Credentials with NTLM-only Server Authentication

Add the servers list values TERMSRV/* and Microsoft Virtual Console Service/*.
Check the Concatenate OS defaults with input above.

Reference

・ https://www.neolisk.blog/posts/2010-10-07-virtualization-cannot-connect-to-server-hyperv/
・ https://support.huawei.com/enterprise/zh/knowledge/EKB1001588524
・ https://www.thewindowsclub.com/your-credentials-did-not-work-in-remote-desktop-on-windows-10

Maybe Reason

Disable Enhanced Session Mode on Server.

Set-VMHost -EnableEnhancedSessionMode $false

Check Time / Kerberos skew.

Get-Date
w32tm /query /status
w32tm /resync

Ensure delegation is configured.

Enable-WSManCredSSP -Role Client -DelegateComputer "HyperVHost"  # On Client
Enable-WSManCredSSP -Role Server  # On Server

Disable remote UAC token filtering.

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
Restart-Service WinRM -Force

Disable guest.

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "forceguest" -Value 0 -Force
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "forceguest"