deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-18 03:43:39 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Update how-it-works.md

Browse Source 
Replaced absolute links with relative links
This commit is contained in:
mgewida1
2025-06-06 11:27:02 -07:00
committed by GitHub
parent e901064907
commit 1317d8fbcd
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
windows/security/identity-protection/credential-guard/how-it-works.md
View File

@ -21,7 +21,8 @@ Kerberos, NTLM, and Credential Manager isolate secrets by using Virtualization-b
:::row-end:::
## VSM and TPM Protections
Secrets protected by Credential Guard are protected in memory isolated at runtime by the hypervisor using [Virtual Secure Mode](https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/tlfs/vsm). On recent supported hardware with TPM2.0, VSM data that is persisted will be protected by a key called the VSM master key which is protected by device firmware protections (see [System Guard: How a hardware-based root of trust helps protect Windows](https://learn.microsoft.com/en-us/windows/security/hardware-security/how-hardware-based-root-of-trust-helps-protect-windows)). The VSM master key is protected by the TPM, ensuring that they key and the secrets protected by Credential Guard can only be accessed in a trusted environment.
Secrets protected by Credential Guard are protected in memory isolated at runtime by the hypervisor using [Virtual Secure Mode](/virtualization/hyper-v-on-windows/tlfs/vsm). On recent supported hardware with TPM2.0, VSM data that is persisted will be protected by a key called the VSM master key which is protected by device firmware protections (see [System Guard: How a hardware-based root of trust helps protect Windows](/windows/security/hardware-security/how-hardware-based-root-of-trust-helps-protect-windows
)). The VSM master key is protected by the TPM, ensuring that they key and the secrets protected by Credential Guard can only be accessed in a trusted environment.
Credential Guard does not typically persist authentication data (NTLM hash and TGTs) and that data is lost between reboots and refreshed when the user signs into the system. This means that it is not dependent on the VSM master key or the TPM to protect that data at rest.