In addition, Credential Guard has specific hardware requirements, namely: The Credential Guard feature is just available with the Windows 10 Enterprise or Education editions. Local Security Authority Subsystem Service (LSASS)), in a secured isolated container which uses Hyper-V and virtualization based security (VBS) for additional protections. NTLM hashes and Kerberos tickets) and the process that manages them (i.e. Here's Microsoft's one-sentence definition of Credential Guard, according to a spokesperson:Ĭredential Guard is the ability to store derived credentials (i.e. With Windows 10 and Device Guard, credentials are stored encrypted using Hyper-V, an approach known as 'virtualization-assisted security.' Credential Guard blocks access 'even when an untrusted program has full administrative access to your environment,' Armstrong explained. He explained that previous Windows versions used the Local Security Authority (also known as 'LSASS.EXE') to store credential information. The demo by Ben Armstrong, a Hyper-V program manager at Microsoft, showed how a machine enabled with Credential Guard can block access attempts by attackers or malware. Microsoft published a demo this week of Credential Guard, a Windows 10 security virtualization feature designed to ward off credential theft.

Microsoft credential manager