Credential Guard

The foundational hypervisor technology that enables Credential Guard. VBS uses hardware virtualization to create an isolated virtual secure mode—a separate, minimal-trust operating system environment that runs alongside the normal Windows OS. This secure region protects critical assets like LSASS credentials even if the host kernel is fully compromised. VBS relies on Second Level Address Translation (SLAT) and IOMMU to enforce memory isolation.

The primary attack Credential Guard is designed to defeat. In a PtH attack, an adversary extracts NTLM password hashes from the LSASS process memory using tools like Mimikatz. Instead of cracking the hash, the attacker reuses it directly to authenticate to remote services. Credential Guard prevents this by isolating domain credentials in the virtual secure mode, making them inaccessible to malware running in the normal OS.

A complementary defense that protects Kerberos authentication traffic from offline brute-force attacks like Kerberoasting. Kerberos Armoring (FAST) encrypts the pre-authentication exchange using the target service's public key, preventing attackers from requesting and cracking service tickets. While Credential Guard protects secrets on the endpoint, Kerberos Armoring protects them in transit.

Extends Credential Guard protection to Remote Desktop Protocol (RDP) sessions. When connecting to a remote host, Remote Credential Guard redirects Kerberos authentication requests back to the client device. The user's credentials are never transmitted to or cached on the remote server's memory. This prevents credential theft from compromised remote hosts—a critical control for administrators managing servers.

The full product name for the feature that isolates the Local Security Authority (LSA) subsystem. It stores domain credentials in a virtualized container that the operating system cannot access directly. Key protected assets include:

• NTLM password hashes
• Kerberos Ticket Granting Tickets (TGTs)
• Application credentials managed by the LSA Only trusted, signed binaries in the virtual secure mode can access these secrets.

Provides hardware-rooted proof that Credential Guard is active and untampered. During boot, the TPM measures the integrity of the hypervisor and virtual secure mode components, storing these measurements in Platform Configuration Registers (PCRs). A remote verifier can cryptographically attest that the endpoint has Credential Guard enabled before granting access to sensitive resources—enabling Zero Trust conditional access policies.