Glossary
Credential Guard
A Windows feature that uses virtualization-based security to isolate NTLM hashes and Kerberos secrets from LSASS, defeating most credential dumping.
Credential Guard uses virtualization-based security (VBS) to move secrets that LSASS would normally hold, such as NTLM password hashes and Kerberos ticket-granting ticket keys, into an isolated process (LsaIso.exe) that runs in a separate, hypervisor-protected trust level. Even code running as SYSTEM in the normal operating system cannot read that memory.
It requires UEFI, Secure Boot and CPU virtualization support, and runs on Enterprise and Education editions and Windows Server. It is enabled by default on eligible Windows 11 22H2+ Enterprise/Education devices and domain-joined Windows Server 2025 member servers. It blocks NTLMv1, unconstrained Kerberos delegation and saved-credential delegation, and does not protect domain controller databases.