The Vulnerability of the LSA
In a standard Active Directory environment, when a Domain Administrator logs into a Windows Server, the Local Security Authority (LSA) process (lsass.exe) mathematically hashes their password and stores that cryptographic hash directly in the server’s local RAM. This is designed for convenience; it allows the Administrator to access network shares without typing their password repeatedly (Single Sign-On).
However, this creates a catastrophic vulnerability known as a Pass-the-Hash (PtH) attack. If a standard user on that server is compromised, and the attacker manages to escalate their privileges to local SYSTEM, the attacker can use a tool like Mimikatz to dump the physical RAM of the lsass.exe process. The attacker steals the Domain Administrator’s password hash from memory. They do not need to crack the hash; they simply “pass” the hash back into the network to authenticate as the Domain Administrator, achieving total domain compromise in minutes.
To mathematically eliminate this attack vector, Microsoft engineered Windows Defender Credential Guard. Credential Guard does not simply patch the LSA; it fundamentally redesigns the operating system architecture. It utilizes hardware-based virtualization (Hyper-V) to slice the RAM into isolated compartments. The highly sensitive cryptographic secrets are ripped out of the standard operating system and locked inside an impenetrable Virtualization-Based Security (VBS) enclave. Even if an attacker achieves maximum SYSTEM-level privileges in Windows, they cannot read the hash, because the hash physically does not exist in their operating system’s memory space.
Step 1: The Hardware Prerequisites
Credential Guard cannot be installed on legacy hardware. Because it relies on hardware-enforced virtualization, the physical silicon must support it.
- CPU Virtualization Extensions: Intel VT-x or AMD-V must be enabled in the BIOS.
- Second Level Address Translation (SLAT): Intel EPT or AMD RVI must be supported by the CPU.
- TPM 2.0: A Trusted Platform Module version 2.0 chip must be present and active.
- UEFI Secure Boot: The server must boot using modern UEFI with Secure Boot enabled (legacy BIOS will not work).
If you are deploying Credential Guard on virtual machines (like VMware ESXi or Hyper-V), you must enable “Nested Virtualization” and expose the virtual TPM (vTPM) to the guest OS.
Step 2: Enabling Virtualization-Based Security (VBS)
Before Credential Guard can function, you must enable the underlying Hyper-V hypervisor. You do not need to run actual virtual machines on this server; you just need the hypervisor engine.
Open an elevated PowerShell prompt and install the required feature:
Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-Hypervisor -AllRestart the server. The server is now running on top of a micro-hypervisor, preparing the ground for the secure enclave.
Step 3: Deploying Credential Guard via Group Policy
While you can enable Credential Guard via registry edits, enterprise architectures require consistent, automated deployment using Group Policy Objects (GPO).
- Open the Group Policy Management Console (GPMC) on your Domain Controller.
- Create a new GPO named
SEC-CredentialGuard-Enforceand link it to your Servers Organizational Unit (OU). - Edit the GPO and navigate to: Computer Configuration > Administrative Templates > System > Device Guard.
- Double-click the policy named Turn On Virtualization Based Security.
- Select Enabled.
Step 4: The Cryptographic Configuration
Within the VBS policy window, you must make specific architectural decisions:
- Select Platform Security Level: Choose Secure Boot and DMA Protection. This guarantees that malicious hardware (like a Thunderbolt device) cannot execute Direct Memory Access (DMA) attacks to bypass the enclave.
- Credential Guard Configuration: Choose Enabled with UEFI lock.
(Critical Warning: The “UEFI lock” option is mathematically absolute. Once applied, it writes a flag directly into the motherboard’s UEFI firmware. A rogue Domain Admin cannot simply turn off the GPO to disable Credential Guard. To disable it, they must physically walk up to the server, reboot it, and press a key on the physical keyboard to clear the UEFI variable. This prevents remote attackers from disabling your security).
Step 5: Verifying the Mathematical Isolation
Apply the GPO and reboot the target Windows Server. The server will take slightly longer to boot as the hypervisor establishes the isolated LSA (Isolated User Mode).
To mathematically prove that the credentials are secure, you must verify the state of the VBS enclave.
Open PowerShell and query the WMI interface:
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuardLook at the SecurityServicesRunning array. It must explicitly list “Credential Guard” (Value 1).
For a visual confirmation, open msinfo32.exe (System Information). Scroll to the bottom of the summary page. You will see three critical lines:
- Virtualization-based security: Running
- Virtualization-based security Services Configured: Credential Guard
- Virtualization-based security Services Running: Credential Guard
If an attacker now executes Mimikatz on this server, the tool will violently fail to extract the NTLM hashes or Kerberos Ticket Granting Tickets (TGTs). The standard lsass.exe process is now merely a hollow proxy; the actual cryptographic secrets are locked in a hardware-backed vault that the standard operating system cannot mathematically touch.
Conclusion
Allowing Windows Server to store high-value cryptographic hashes in standard RAM guarantees devastating lateral movement during a security breach. By deploying Windows Defender Credential Guard, security architects fundamentally sever the relationship between the operating system and its authentication secrets. The ability to leverage hypervisor-enforced virtualization, mathematically lock configurations via UEFI, and block DMA hardware attacks transforms a highly vulnerable server into a zero-trust cryptographic fortress, completely neutralizing Pass-the-Hash and Pass-the-Ticket attack vectors.