Credential Guard uses virtualization-based security to isolate NTLM password hashes, Kerberos tickets and some stored domain credentials, so malware with admin rights cannot lift them. Microsoft lists it for Enterprise and Education editions. It does not protect your SSH keys, API tokens or browser sessions.
What it protects
Microsoft says Credential Guard prevents credential theft attacks by protecting NTLM password hashes, Kerberos Ticket Granting Tickets and credentials stored by applications as domain credentials.
It uses virtualization-based security to keep those secrets in a protected environment isolated from the running operating system. Microsoft states that malware running in the OS with administrative privileges cannot extract secrets protected by VBS. That defeats attacks such as pass the hash and pass the ticket.
Microsoft also cautions that attackers will likely move to new techniques, so it should sit alongside other measures.
Is it already on?
From Windows 11, 22H2 and Windows Server 2025, Credential Guard is enabled by default on domain-joined, non-domain-controller systems that meet hardware requirements and licensing, and are not explicitly configured to disable it. Default enablement is without UEFI lock, so administrators can disable it remotely.
If it was explicitly disabled before a device updated, the update does not overwrite that choice.
Editions
Microsoft's table lists Credential Guard for Windows Enterprise and Education, and marks Windows Pro and Pro Education/SE as No. Licensing is likewise via Enterprise E3 and E5 and Education A3 and A5. A personal Pro laptop is therefore outside the supported list. The documentation does describe an edge case where a Pro device that previously ran Credential Guard may have it enabled.
Requirements
- Virtualization-based security.
- Secure Boot.
- Recommended: a TPM, and UEFI lock to stop an attacker disabling it through a registry change.
In virtual machines it works on Hyper-V generation 2 VMs, with an IOMMU on the host. It protects against attacks inside the VM, not privileged attacks from the host.
What can break
Microsoft says applications break if they require Kerberos DES, unconstrained delegation, TGT extraction or NTLMv1. Applications that need Digest authentication, credential delegation, MS-CHAPv2 or CredSSP expose credentials to risk. Test developer tooling that uses legacy authentication, such as older VPN clients or internal tools, before rolling out.
Services that rely on Kerberos, such as file shares or remote desktop, keep working.
What it does not cover
Credential Guard is about Windows domain credentials. It does not protect the Active Directory database or the SAM. And it has no say over files you keep yourself: SSH private keys, cloud CLI credentials, tokens in environment variables. Those still need passphrases, short lifetimes and secure storage.
Checklist
- Find out if your edition and device qualify.
- Check whether it is already running.
- Test legacy-auth tools in a pilot group.
- Pair it with disk encryption and least privilege.
- Scan your projects too. Safeguard's free scan at gold.safeguard.sh/scan covers dependencies.
Quick check
Does Credential Guard protect my SSH keys?
No. Microsoft describes it as protecting NTLM hashes, Kerberos tickets and domain credentials. SSH keys are files you must protect separately.
Does it work on Windows Pro?
Microsoft's edition table lists Enterprise and Education as supported and Pro as not supported.
Sources
Last reviewed: 19 October 2026.
