Credential theft is still the shortest path from one infected laptop to a full network compromise. An attacker who can read password hashes and Kerberos tickets from memory can reuse them on other machines. Credential Guard, managed from Intune, moves those secrets into an isolated area of memory protected by virtualization-based security (VBS), where even malware running as admin cannot read them.
This article explains what Credential Guard and VBS actually do, what licensing they need, how to configure them with Credential Guard Intune policy, and the other Windows 11 hardening settings that belong in the same build.
What VBS and Credential Guard do
Virtualization-based security (VBS) uses the Windows hypervisor to create an isolated region of memory that the normal operating system cannot access. Think of it as a small, locked room inside the device. Even if the main Windows kernel is compromised, code running there cannot reach into that room.
Credential Guard is one of the features that uses that room. Instead of keeping NTLM password hashes and Kerberos ticket-granting tickets in the normal LSASS process, Windows keeps them in an isolated process protected by VBS. Credential dumping tools that read LSASS memory come back without the secrets they want. That directly blunts pass-the-hash and pass-the-ticket attacks.
Credential Guard does not protect everything. It does not protect the local account database or the Active Directory database on domain controllers, and it is not meant to be enabled on domain controllers. It protects credentials in memory on the devices where users sign in.
Licensing and hardware requirements
This is where many small businesses get caught out. Credential Guard requires Windows Enterprise or Education. It is not available on Windows Pro.
License
Credential Guard
VBS, memory integrity, LSA protection
Windows Pro (including Business Premium devices on Pro)
No
Yes
Windows Enterprise E3 or E5 (included in Microsoft 365 E3 and E5)
Yes
Yes
Windows Education A3 or A5
Yes
Yes
If your users are on Microsoft 365 E3 or E5, devices step up to Enterprise through subscription activation. If you are on Business Premium with Windows Pro, you can still deploy most of the hardening in this article, just not Credential Guard itself, unless you add Windows Enterprise E3.
On the hardware side, devices need 64-bit Windows, virtualization extensions (Intel VT-x or AMD-V with SLAT), and ideally an IOMMU, Secure Boot and TPM 2.0. Most business laptops bought in the last few years meet these, but older desktops sometimes do not.
Credential Guard may already be on
Starting with Windows 11 22H2, Credential Guard is enabled by default on devices that meet the license and hardware requirements and have not been explicitly configured to turn it off. Default enablement is without UEFI lock, which means it can still be turned off remotely.
Two catches. First, if a device had Credential Guard explicitly disabled before the upgrade, it stays disabled. Second, default enablement is not the same as managed enablement. I still configure it explicitly from Intune so the setting is documented, reported on, and cannot drift.
Configuring Credential Guard with Intune
In the Intune admin center, go to Devices > Configuration > Create > New policy. Platform Windows 10 and later, profile type Settings catalog.
Add settings from the Device Guard category.
Set Credential Guard to Enabled without lock for your first rollout.
Turn on virtualization-based security and require platform security features (Secure Boot, and DMA protection where supported).
Assign to a pilot group, then all Enterprise-licensed Windows devices. Devices need a restart to apply.
You can also configure Credential Guard from an Account protection policy under Endpoint security. Pick one place, not both, to avoid conflicts.
With lock or without? Enabling with UEFI lock means Credential Guard cannot be turned off by policy later. Turning it off requires physically clearing the UEFI configuration on each device. Start without lock. Move to UEFI lock only once you are confident nothing in your environment needs it off.
Check for compatibility issues first
Credential Guard blocks some old and weak authentication methods. Before a wide rollout, check for:
Wi-Fi or VPN using MS-CHAPv2 (PEAP-MSCHAPv2 or EAP-MSCHAPv2). Single sign-on stops working and users are prompted for credentials. The real fix is moving to certificate-based authentication such as EAP-TLS.
NTLMv1 dependencies, often old NAS devices or legacy apps.
Kerberos unconstrained delegation or DES encryption.
Digest authentication or CredSSP in older line-of-business apps.
File shares and Remote Desktop over Kerberos keep working normally.
The rest of the Windows 11 hardening set
Credential Guard is one piece. These are the companion settings I deploy from Intune on most Windows 11 builds:
Memory integrity (hypervisor-protected code integrity, HVCI): uses VBS to stop unsigned or tampered kernel drivers from loading. Available on Pro. Test older hardware drivers first.
LSA protection: runs LSASS as a protected process, which blocks many credential dumping tools. Available on Pro, and a useful fallback where Credential Guard is not licensed.
Microsoft vulnerable driver blocklist: blocks known abused drivers. Pair it with the attack surface reduction rule that blocks abuse of exploited vulnerable signed drivers.
BitLocker with TPM: full disk encryption with recovery keys escrowed to Entra ID.
Windows Hello for Business: moves users off passwords, which reduces what there is to steal in the first place.
Windows LAPS: unique local admin passwords, so a stolen local hash is useless elsewhere.
How to verify it is running
Do not rely on spotting the isolated LSA process in Task Manager. Use one of these instead:
Open System Information and check that Credential Guard is listed under Virtualization-based Security Services Running.
Use the Win32_DeviceGuard WMI class from an elevated PowerShell session and confirm the running security services include Credential Guard.
Check the Intune policy report for devices with errors, which usually means missing hardware support or a conflicting policy.
If you want this rolled into a full hardened build, our endpoint security baseline service covers Credential Guard, VBS, ASR, firewall and account protection together. If you are deciding whether Enterprise licensing is worth it for Credential Guard and the other E3/E5 features, our E5 vs E3 calculator helps, and the Intune health check will tell you which devices already have it running.
No. Credential Guard needs Windows Enterprise or Education. On Pro, deploy LSA protection and memory integrity instead, which give partial protection against credential dumping.
Is Credential Guard on by default in Windows 11?
On Windows 11 22H2 and later, it is enabled by default on devices that meet the license and hardware requirements, unless it was explicitly disabled before. Configure it from Intune anyway so it is managed and reported.
Will Credential Guard break our Wi-Fi?
It can if your Wi-Fi uses PEAP-MSCHAPv2. Users lose single sign-on and get credential prompts. Moving to certificate-based EAP-TLS fixes it and is the better design anyway.
Not sure whether your Windows devices are actually running Credential Guard, VBS and LSA protection? Book a free Microsoft 365 security assessment and we will report on your hardening state device by device.
Credential theft is still the shortest path from one infected laptop to a full network compromise. An attacker who can read password hashes and Kerberos tickets from memory can reuse them on other machines. Credential Guard, managed from Intune, moves those secrets into an isolated area of memory protected by virtualization-based security (VBS), where even malware running as admin cannot read them.
This article explains what Credential Guard and VBS actually do, what licensing they need, how to configure them with Credential Guard Intune policy, and the other Windows 11 hardening settings that belong in the same build.
What VBS and Credential Guard do
Virtualization-based security (VBS) uses the Windows hypervisor to create an isolated region of memory that the normal operating system cannot access. Think of it as a small, locked room inside the device. Even if the main Windows kernel is compromised, code running there cannot reach into that room.
Credential Guard is one of the features that uses that room. Instead of keeping NTLM password hashes and Kerberos ticket-granting tickets in the normal LSASS process, Windows keeps them in an isolated process protected by VBS. Credential dumping tools that read LSASS memory come back without the secrets they want. That directly blunts pass-the-hash and pass-the-ticket attacks.
Credential Guard does not protect everything. It does not protect the local account database or the Active Directory database on domain controllers, and it is not meant to be enabled on domain controllers. It protects credentials in memory on the devices where users sign in.
Licensing and hardware requirements
This is where many small businesses get caught out. Credential Guard requires Windows Enterprise or Education. It is not available on Windows Pro.
If your users are on Microsoft 365 E3 or E5, devices step up to Enterprise through subscription activation. If you are on Business Premium with Windows Pro, you can still deploy most of the hardening in this article, just not Credential Guard itself, unless you add Windows Enterprise E3.
On the hardware side, devices need 64-bit Windows, virtualization extensions (Intel VT-x or AMD-V with SLAT), and ideally an IOMMU, Secure Boot and TPM 2.0. Most business laptops bought in the last few years meet these, but older desktops sometimes do not.
Credential Guard may already be on
Starting with Windows 11 22H2, Credential Guard is enabled by default on devices that meet the license and hardware requirements and have not been explicitly configured to turn it off. Default enablement is without UEFI lock, which means it can still be turned off remotely.
Two catches. First, if a device had Credential Guard explicitly disabled before the upgrade, it stays disabled. Second, default enablement is not the same as managed enablement. I still configure it explicitly from Intune so the setting is documented, reported on, and cannot drift.
Configuring Credential Guard with Intune
Devices > Configuration > Create > New policy. Platform Windows 10 and later, profile type Settings catalog.You can also configure Credential Guard from an Account protection policy under Endpoint security. Pick one place, not both, to avoid conflicts.
With lock or without? Enabling with UEFI lock means Credential Guard cannot be turned off by policy later. Turning it off requires physically clearing the UEFI configuration on each device. Start without lock. Move to UEFI lock only once you are confident nothing in your environment needs it off.
Check for compatibility issues first
Credential Guard blocks some old and weak authentication methods. Before a wide rollout, check for:
File shares and Remote Desktop over Kerberos keep working normally.
The rest of the Windows 11 hardening set
Credential Guard is one piece. These are the companion settings I deploy from Intune on most Windows 11 builds:
How to verify it is running
Do not rely on spotting the isolated LSA process in Task Manager. Use one of these instead:
If you want this rolled into a full hardened build, our endpoint security baseline service covers Credential Guard, VBS, ASR, firewall and account protection together. If you are deciding whether Enterprise licensing is worth it for Credential Guard and the other E3/E5 features, our E5 vs E3 calculator helps, and the Intune health check will tell you which devices already have it running.
Microsoft’s configuration guide: Configure Credential Guard.
Frequently asked questions
Does Credential Guard work on Windows 11 Pro?
No. Credential Guard needs Windows Enterprise or Education. On Pro, deploy LSA protection and memory integrity instead, which give partial protection against credential dumping.
Is Credential Guard on by default in Windows 11?
On Windows 11 22H2 and later, it is enabled by default on devices that meet the license and hardware requirements, unless it was explicitly disabled before. Configure it from Intune anyway so it is managed and reported.
Will Credential Guard break our Wi-Fi?
It can if your Wi-Fi uses PEAP-MSCHAPv2. Users lose single sign-on and get credential prompts. Moving to certificate-based EAP-TLS fixes it and is the better design anyway.
Not sure whether your Windows devices are actually running Credential Guard, VBS and LSA protection? Book a free Microsoft 365 security assessment and we will report on your hardening state device by device.