Published by


Brink's Avatar
Administrator

Posts: 16,567

Show Printable Version 


How to Verify if Credential Guard is Enabled or Disabled in Windows 10

information   Information
Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard prevents these attacks by protecting NTLM password hashes and Kerberos Ticket Granting Tickets.

Credential Guard offers the following features and solutions:
  • Hardware security Credential Guard increases the security of derived domain credentials by taking advantage of platform security features including, Secure Boot and virtualization.
  • Virtualization-based security Windows services that manage derived domain credentials and other secrets run in a protected environment that is isolated from the running operating system.
  • Better protection against advanced persistent threats Securing derived domain credentials using the virtualization-based security blocks the credential theft attack techniques and tools used in many targeted attacks. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate Device Guard and other security strategies and architectures.
  • Manageability You can manage Credential Guard by using Group Policy, WMI, from a command prompt, and Windows PowerShell.

Credential Guard references: (recommend to read)


This tutorial will show you how to verify if Credential Guard virtualization-based security is enable or disable on your Windows 10 Enterprise or Windows 10 Education PC.


Here's How:

1. Press the Win+R keys to open Run, type msinfo32, and click/tap on OK to open System Information. (see screenshot below)

2. If enabled, Credential Guard should be shown next to Device Guard Security Services Running displayed at the bottom of the System Summary section.

Note   Note
This Microsoft TechNet article states the above to confirm if Credential Manager is enabled or not.

However, I noticed that Credential Guard next to Device Guard Security Services Configured is what actually is shown there or not when you enable or disable Credential Guard in Local Group Policy Editor.


Click image for larger version. 

Name:	Verify_Credential_Guard_msinfo32.jpg 
Views:	29 
Size:	170.5 KB 
ID:	108902



That's it,
Shawn