In enterprise environments, attackers who gain access to a single workstation can extract cached domain credentials from memory using tools like Mimikatz. These stolen credentials allow the attacker to move laterally across your entire corporate network, accessing file servers, databases, and email systems. Windows Credential Guard is a virtualisation-based security feature in Windows 11 that isolates your domain login credentials inside a protected container that even a compromised operating system kernel cannot access.
How Credential Guard Uses Virtualisation to Protect Passwords
Credential Guard leverages the same Hyper-V hypervisor technology used for virtual machines, but instead of running a separate operating system, it creates a small, isolated security environment called Virtual Secure Mode (VSM). When you log into a domain-joined Windows 11 PC, the Local Security Authority (LSA) process stores your NTLM hashes and Kerberos tickets inside this protected VSM container rather than in standard system memory. Because the container runs at a higher privilege level than the Windows kernel itself, even malware running with full administrator rights cannot read the credentials stored within it.
What You Need Before Enabling Credential Guard
Credential Guard requires specific hardware and software prerequisites. Your computer must have a 64-bit processor with virtualisation extensions (Intel VT-x or AMD-V) enabled in the UEFI/BIOS firmware. The system must also support Secure Boot and must be running Windows 11 Pro, Enterprise, or Education. Home edition does not support this feature. Your machine must also be joined to an Active Directory domain or use Azure Active Directory, as Credential Guard specifically protects domain-based credentials.
Enabling Credential Guard Using Group Policy
The most reliable method for enabling Credential Guard on a domain-joined workstation is through the Local Group Policy Editor.
- Press Windows + R to open the Run dialogue box, type gpedit.msc, and press Enter.
- In the left-hand navigation pane, expand Computer Configuration, then expand Administrative Templates, then expand System, and finally click on Device Guard.
- In the right-hand pane, double-click on the policy named Turn On Virtualization Based Security.
- Set the policy to Enabled.
- Under the Credential Guard Configuration dropdown menu, select Enabled with UEFI lock. This is the most secure option because it prevents the feature from being remotely disabled through a registry change; an attacker would need physical access to the UEFI firmware to turn it off.
- Click Apply and then click OK.
- Restart your computer for the changes to take effect.
Verifying That Credential Guard Is Active
After rebooting, you should confirm that the feature is running correctly.
- Press Windows + R, type msinfo32, and press Enter to open the System Information utility.
- In the left pane, ensure System Summary is selected.
- Scroll down the right-hand pane until you find the entry labelled Virtualization-based security. Its value should read Running.
- Look for the entry Virtualization-based security Services Running. It should list Credential Guard as one of the active services.
If the status shows “Not enabled” or the Credential Guard service is missing, revisit your UEFI/BIOS settings to ensure hardware virtualisation (VT-x or AMD-V) and Secure Boot are both enabled.
Important Compatibility Considerations
Credential Guard intentionally blocks older authentication protocols. Applications or services that rely on NTLMv1, unconstrained Kerberos delegation, or direct extraction of Kerberos TGTs from memory will no longer function. Before deploying Credential Guard across an enterprise fleet, test it on a small group of pilot workstations to identify any legacy application compatibility issues. Additionally, Credential Guard cannot be enabled alongside third-party hypervisors that do not support nested virtualisation, so users running VMware Workstation or older versions of VirtualBox may encounter conflicts.