How to Completely Disable ‘Windows Defender Credential Guard’ via Group Policy in Windows 11

Windows Defender Credential Guard uses virtualization-based security (VBS) in Windows 11 to isolate and protect NTLM password hashes, Kerberos Ticket Granting Tickets (TGTs), and credentials stored by applications as domain credentials. By isolating these secrets in a Hyper-V protected container, Credential Guard actively thwarts pass-the-hash or pass-the-ticket credential theft attacks. However, because it strictly enforces modern security protocols, it can severely break legacy environments. If your organization relies on older third-party SSO solutions, legacy MS-CHAPv2 Wi-Fi authentication, or older apps that require direct, unbrokered access to the LSA (Local Security Authority), Credential Guard will cause persistent authentication failures.

This guide explains how to completely disable Windows Defender Credential Guard via Group Policy in Windows 11, reverting the LSA to standard operation for legacy application compatibility.

Disable Credential Guard via Group Policy

To enforce a strict block that disables the virtualization-based credential protection, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > System > Device Guard

5. In the right-hand pane, locate the policy named Turn On Virtualization Based Security.
6. Double-click the policy to open its configuration window.
7. Ensure the main policy toggle is set to Enabled (if you wish to keep VBS active but only disable Credential Guard).
8. Under the “Options” pane within the policy window, locate the dropdown menu for Credential Guard Configuration.
9. Change the dropdown selection to Disabled.
10. Click Apply, then click OK.

Verify the Configuration Lockdown

Because Virtualization Based Security alters how the Windows kernel and Local Security Authority boot, Group Policy changes to Credential Guard absolutely require a full system reboot.

To enforce the change, open an elevated Command Prompt and execute gpupdate /force, then reboot the workstation. Post-reboot, to verify the restriction is active, press the Windows Key, type msinfo32, and press Enter to open System Information. Scroll to the bottom of the System Summary page and look for Virtualization-based security Services Running. The list should no longer contain “Credential Guard.” Additionally, legacy authentication apps that were previously failing will now correctly pass their NTLM/Kerberos handshakes directly through the LSA.