How to Configure Windows Defender Credential Guard in Windows 11

The Local Security Authority Subsystem Service (lsass.exe) handles authentication tokens, NTLM password hashes, Kerberos Ticket Granting Tickets (TGTs), and cached domain credentials on Windows systems. In traditional enterprise environments, adversary techniques like Pass-the-Hash, Pass-the-Ticket, and memory scrapers (e.g., Mimikatz) extract raw credentials directly from LSASS process memory once administrator rights are achieved. Windows Defender Credential Guard leverages Virtualization-based Security (VBS) to decouple credential validation from the standard OS, executing an isolated mini-kernel (LSAiso) inside a hypervisor-protected memory container that standard administrative processes cannot access.

Hardware and Architectural Prerequisites

Credential Guard relies on hypervisor hardware protections built into modern processors:

• CPU Virtualization: Intel VT-x or AMD-V enabled in UEFI firmware alongside Second Level Address Translation (SLAT / EPT / NPT).
• I/O MMU: Intel VT-d or AMD-Vi IOMMU memory protection enabled to block direct memory access (DMA) attacks.
• UEFI Secure Boot: Native 64-bit UEFI firmware with Secure Boot enabled to verify hypervisor boot chain integrity.
• Windows Editions: Windows 11 Enterprise, Education, or Pro (Version 22H2 and later enables Credential Guard by default on clean installations of enterprise editions with qualifying hardware).

Enabling Credential Guard via Local Group Policy

To manually enforce and lock Credential Guard across Windows 11 workstations:

1. Press Win + R, type gpedit.msc, and press Enter to launch the Local Group Policy Editor.
2. Navigate through the policy tree:
   Computer Configuration > Administrative Templates > System > Device Guard.
3. In the right-hand details pane, double-click Turn On Virtualization Based Security.
4. Set the policy state to Enabled.
5. Under the Select Platform Security Level dropdown, choose Secure Boot and DMA Protection.
6. Under Credential Guard Configuration, select Enabled with UEFI lock.
   Note: The UEFI lock prevents rogue administrators or malware from disabling Credential Guard by editing registry keys; disabling it later requires physical access to UEFI boot menus.
7. Click Apply, then click OK.
8. Restart your computer to allow UEFI firmware and Hyper-V hypervisor services to initialize the isolated LSA environment.

Configuring Credential Guard via Registry

For scripted deployments or Intune policy scripts, configure the corresponding registry values under HKEY_LOCAL_MACHINE:

# Enable Virtualization-Based Security (VBS)
Set-ItemProperty -Path "HKLM:SYSTEMCurrentControlSetControlDeviceGuard" -Name "EnableVirtualizationBasedSecurity" -Value 1 -Type DWord

# Enforce Secure Boot and DMA Protection
Set-ItemProperty -Path "HKLM:SYSTEMCurrentControlSetControlDeviceGuard" -Name "RequirePlatformSecurityFeatures" -Value 3 -Type DWord

# Enable Credential Guard with UEFI Lock (Value 1 = With UEFI Lock, 2 = Without Lock)
Set-ItemProperty -Path "HKLM:SYSTEMCurrentControlSetControlLsa" -Name "LsaCfgFlags" -Value 1 -Type DWord

Verifying Credential Guard Operational Status

To confirm that Credential Guard is active and shielding secrets in isolated memory:

1. Press Win + R, type msinfo32.exe, and press Enter to open System Information.
2. Scroll down the System Summary pane to inspect the security properties:
   • Virtualization-based security: Should report Running.
   • Virtualization-based security Services Running: Must list Credential Guard.
3. Alternatively, verify status using PowerShell:

   (Get-CimInstance -ClassName Win32_DeviceGuard -Namespace rootMicrosoftWindowsDeviceGuard).SecurityServicesRunning

   A returned integer array containing 1 confirms Credential Guard is active and protecting NTLM hashes and Kerberos tickets.