Skip to content
WindowsHardening

Area 02 / 12

Credential Protection

Credential theft from LSASS is the engine of lateral movement. This area isolates NTLM hashes and Kerberos tickets with virtualization-based Credential Guard, runs LSASS as a protected process, turns off legacy providers that keep plaintext passwords, and trims cached credentials.

Start the path

Learning path

0/4 done
  1. 01Credential Guard and LSA protection: protect LSASSHow Credential Guard and LSA protection (RunAsPPL) stop credential dumping, how to enable and verify them, what they break, and the legacy settings to turn off alongside.
  2. 02Cached logons, WDigest and credential exposure settingsCut the credentials Windows keeps on disk and in memory: cached logon count, WDigest, cleanup after logoff, stored network passwords and Credential Manager.
  3. 03RDP without exposing credentials: RCG and Restricted AdminStop RDP leaving reusable credentials on servers: Remote Credential Guard, Restricted Admin mode, DisableRestrictedAdmin and credential delegation policy.
  4. 04Windows Hello for Business: trust models and PIN policyDeploy Windows Hello for Business with cloud Kerberos trust or key trust, require TPM-backed keys, set PIN policy, and verify provisioning for users and admins.