Website under construction

Credential Guard 
Credential Guard isolates secrets by using virtualization-based technologies so that only privileged 
systems can access them. Credential Guard offers the following features: 

Hardware security This increases the security of derived domain credentials by taking 
advantage of platform security features, including Secure Boot and virtualization. 

Virtualization-based security Windows services that manage derived domain credentials and 
other secrets run in a protected environment that is isolated from the running OS. 

---

112 
CHAPTER 4 | Security and identity 

Better protection against advanced persistent threats Secures derived domain credentials by 
using the virtualization-based security. This blocks the credential theft attack techniques and tools 
used in many attacks. Malware running in the OS with administrative privileges cannot extract 
secrets that are protected by virtualization-based security. 

Manageability Manage by using Group Policy, WMI, from a command prompt, and Windows 
PowerShell. 
Normally, secrets are stored in the memory of the Local Security Authority (LSA) process in Windows. 
With Credential Guard, the LSA talks to a new component called isolated LSA. This isolated LSA is 
virtualization-based and is not accessible by the rest of the OS. Figure 4-1 illustrates the isolation 
provided by the Virtualization-based security for the LSAIso process in respect the LSASS process. 
Figure 4-1:
Virtualization-based LSA process 
When Credential Guard is turned on, older variants of NTLM or Kerberos (i.e., NTLM v1, MS-CHAPv2, 
etc.) are no longer supported. 
Because Credential Guard is virtualization-based, it requires some specific hardware support. The 
following table details some of those requirements: