Windows Credential Guard

Credential Guard is a security feature on Windows that helps protect user login credentials from being stolen by attackers. It works by isolating the Local Security Authority Subsystem (LSASS) process in a virtualized environment. LSASS is a critical process that stores things like passwords and Kerberos tickets, which attackers might try to steal to gain access to your system or network.

Here's a breakdown of how Credential Guard works:

Isolation: Credential Guard uses virtualization-based security (VBS) to create a secure container that even administrators on the system can't access. This makes it much harder for attackers to steal the credentials stored in LSASS.

Protection against specific attacks: By isolating LSASS, Credential Guard helps prevent attacks like pass-the-hash (PtH) and pass-the-ticket (PtT) attacks. These attacks involve stealing the hashed version of a password or a Kerberos ticket and using it to impersonate a legitimate user on the network.

Some things to keep in mind about Credential Guard:

Availability: It's only available on Windows 10 Enterprise edition and later versions.

Impact on applications: Some applications that rely on older authentication protocols might not work correctly when Credential Guard is enabled.

Virtual Machine compatibility: Credential Guard can also be used on Hyper-V virtual machines to protect secrets from attacks within the VM itself.

Overall, Credential Guard is a valuable security feature that can help to protect your system from credential theft attacks. If you're using a Windows 10 Enterprise machine, it's a good idea to check if Credential Guard is enabled and consider enabling it if it's not already on.