How To Verify if Credential Guard Is Enabled or Disabled in Windows

Credential Guard is a Windows feature that secures the login credentials you use when logging in to Windows in enterprise environments. This guide explains what Windows Credential Guard is, what is required to use it, and how to check whether it is enabled or disabled.

If you prefer watching over reading, watch How to Verify if Credential Guard is Enabled or Disabled in Windows.

What is Windows Credential Guard?

The primary purpose of Windows Credential Guard is to help prevent credential theft by isolating sensitive Windows authentication from the rest of the operating system. It primarily uses Virtualization-based Security (VBS) to protect NTLM password hashes, Kerberos Ticket Granting Tickets (TGTs), and credentials stored within applications as domain credentials.

However, Credential Guard doesn’t cover every type of credential or authentication method. For instance, it doesn’t protect credentials supplied for NTLM authentication, nor does it protect Kerberos service tickets.

Credential Guard is only supported on Windows 11 and Windows 10 Enterprise and Education editions. It is not supported on Windows 11 and Windows 10 Home or Pro, so if you are a home user, you are unlikely to have access to or any need for it.

Credential Guard requires Virtualization-based Security (VBS) hardware support, and for Secure Boot to be enabled.

As of Windows 11 version 22H2, if your system meets the above requirements, Credential Guard will be enabled by default.

This means manual intervention is typically only required if you need to disable it for legacy app compatibility or if you are running it on a Virtual Machine (VM).

How it works

Credential Guard uses a combination of hardware-based security features and Virtualization-based Security (VBS) to isolate sensitive Windows credentials from the rest of the operating system. Features such as Secure Boot and Trusted Platform Module (TPM) help establish a trusted boot environment, while VBS uses hardware virtualization to store sensitive credential secrets in a separate environment from the normal Windows OS.

By storing sensitive authentication secrets in an isolated VBS environment, Credential Guard prevents malware and other unauthorized software from accessing them, even when an attacker gains administrative privileges on the device. This separation makes it harder for attackers to steal credentials from system processes.

Why verifying Credential Guard status is important

Credential Guard protects against pass-the-hash and pass-the ticket attacks that use credentials stolen from Windows machines to impersonate users and gain further access to enterprise Windows networks and the sensitive data on them.

In enterprise IT, it’s vital to utilize all available security technologies to protect your infrastructure, data, and users. Additionally, leveraging all reasonable security measures is often a requirement for compliance with GDPR, CCPA, HIPAA, and other emerging data privacy legal frameworks.

If Credential Guard is available and supported on the Windows systems you are responsible for, there is no reason it should be disabled.

How to verify if Credential Guard is enabled or disabled

You can use one of the following methods to check the status of Windows Credential Guard on a single PC.

Method 1: Using System Information

• Right-click on the Start button and select Run.
• Enter msinfo32 in the Run dialog and click OK.
• Click on System Summary in the left navigation panel.
• In the right panel, scroll down to Virtualization-based Security Services Running. If Credential Guard is listed, it is currently running on the device.

If Windows Credential Guard is disabled or not available on your system, it will not appear.

Tip: You can also check Virtualization-based Security Services Configured to verify if it has been configured to run

Method 2: Using Group Policy Editor

You can also use the Group Policy Editor to check the enforcement status of Windows Credential Guard:

• Right-click on the Start button and select Run.
• Enter gpedit.msc and click OK to open the Group Policy Editor.
• Navigate to Computer Configuration > Administrative > Templates > System > Device Guard.
• Locate the Turn On Virtualization-based Security policy and open it.
• If the policy is Enabled, you can check the options to see whether it’s enforced with UEFI (preventing it from being disabled) or not.

If the policy is set to Not Configured, Credential Guard is not enforced by Group Policy (but still may be enabled by default)

Note: Group Policy shows whether Credential Guard has been configured through this policy, but it doesn’t necessarily confirm if it’s currently running.

Method 3: Checking the Windows Event Viewer

The Windows Event Viewer can be used to see information logged by Credential Guard.

• Search for and open Event Viewer from the Start menu.
• Locate the Windows Credential Guard logs at Applications and Services Logs/Microsoft/Windows > DeviceGuard.
• Open the Operational log.

You can then verify that Credential Guard is working by inspecting the log entries. If there are no logs present, Device Guard may not be supported or enabled on your system. To aid in visualizing the verification process, you may view this video: ‘How to Verify if Device Guard is Enabled or Disabled in Windows’.

Method 4: Using PowerShell commands

The Get-CimInstance PowerShell cmdlet can be used to check whether or not Credential Guard is enabled or disabled by following these steps:

• Open PowerShell as Administrator
• Run the following PowerShell command:

(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning

• Check the value returned by the command:
  • 0 = Credential Guard is not running
  • 1 = Credential Guard is running
  • 2 = Memory integrity (HCVI) is running. This value does not indicate that Credential Guard is running.

If this command returns 1, then Credential Guard is active on the device. If it returns 0, Credential Guard is not currently running. A result that contains 1 and 2 indicates that both Credential Guard and memory integrity are working.

Pro Tip: If you want a more detailed breakdown without the True/False logic, simply run:

Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard

Check the SecurityServicesRunning property to determine which security services are currently running. The VirtualizationBasedSecurityStatus property can also demonstrate whether virtualization-based security (VBS) is enabled,

What should I do if Credential Guard is not supported on my device?

If a device you are responsible for does not meet the requirements for Credential Guard, you can check whether the required hardware features are disabled by checking your BIOS/UEFI. You can then enable secure boot, UEFI boot, and the TPM if they are present. In some cases, it is possible to purchase a physical TPM module that can be installed in compatible systems if it is not included.

Note for VM Users: If you are running Windows in a virtual environment (like VMware or Hyper-V), you must enable Nested Virtualization in your host’s settings, or Credential Guard will report as “Unsupported” despite your hardware being capable.

How do I enable Credential Guard if it’s disabled?

Credential Guard will be automatically enabled on compatible systems running the latest version of Windows 11. If you want to enforce it, you can enable the Group Policy shown above.

Managing the security of Windows devices at scale

While Group Policy can be used to enforce Credential Guard on all devices in an enterprise environment, it is still important to check that all devices support it and that it is active. Doing so manually would be time-consuming and potentially leave security gaps if a device’s hardware configuration changes. This means that automated and ongoing monitoring and management is a must to ensure the security of Windows credentials in Windows domains, especially when employees may be using their own devices.