Merge branch 'main' into repo_sync_working_branch

This commit is contained in:
Stephanie Savell 2023-02-16 10:30:08 -06:00 committed by GitHub
commit de6386e6a2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 7 additions and 1409 deletions

View File

@ -20519,6 +20519,11 @@
"source_path": "windows/client-management/mdm/policy-ddf-file.md", "source_path": "windows/client-management/mdm/policy-ddf-file.md",
"redirect_url": "/windows/client-management/mdm/configuration-service-provider-ddf", "redirect_url": "/windows/client-management/mdm/configuration-service-provider-ddf",
"redirect_document_id": true "redirect_document_id": true
},
{
"source_path": "windows/security/identity-protection/credential-guard/dg-readiness-tool.md",
"redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard",
"redirect_document_id": true
} }
] ]
} }

View File

@ -328,8 +328,6 @@
href: identity-protection/credential-guard/credential-guard-requirements.md href: identity-protection/credential-guard/credential-guard-requirements.md
- name: Manage Credential Guard - name: Manage Credential Guard
href: identity-protection/credential-guard/credential-guard-manage.md href: identity-protection/credential-guard/credential-guard-manage.md
- name: Hardware readiness tool
href: identity-protection/credential-guard/dg-readiness-tool.md
- name: Credential Guard protection limits - name: Credential Guard protection limits
href: identity-protection/credential-guard/credential-guard-protection-limits.md href: identity-protection/credential-guard/credential-guard-protection-limits.md
- name: Considerations when using Credential Guard - name: Considerations when using Credential Guard

View File

@ -1,6 +1,6 @@
--- ---
title: Manage Windows Defender Credential Guard (Windows) title: Manage Windows Defender Credential Guard (Windows)
description: Learn how to deploy and manage Windows Defender Credential Guard using Group Policy, the registry, or hardware readiness tools. description: Learn how to deploy and manage Windows Defender Credential Guard using Group Policy or the registry.
ms.date: 11/23/2022 ms.date: 11/23/2022
ms.collection: ms.collection:
- highpri - highpri
@ -38,7 +38,7 @@ Windows Defender Credential Guard will be enabled by default when a PC meets the
## Enable Windows Defender Credential Guard ## Enable Windows Defender Credential Guard
Windows Defender Credential Guard can be enabled either by using [Group Policy](#enable-windows-defender-credential-guard-by-using-group-policy), the [registry](#enable-windows-defender-credential-guard-by-using-the-registry), or the [Hypervisor-Protected Code Integrity (HVCI) and Windows Defender Credential Guard hardware readiness tool](#enable-windows-defender-credential-guard-by-using-the-hvci-and-windows-defender-credential-guard-hardware-readiness-tool). Windows Defender Credential Guard can also protect secrets in a Hyper-V virtual machine, just as it would on a physical machine. Windows Defender Credential Guard can be enabled either by using [Group Policy](#enable-windows-defender-credential-guard-by-using-group-policy) or the [registry](#enable-windows-defender-credential-guard-by-using-the-registry). Windows Defender Credential Guard can also protect secrets in a Hyper-V virtual machine, just as it would on a physical machine.
The same set of procedures used to enable Windows Defender Credential Guard on physical machines applies also to virtual machines. The same set of procedures used to enable Windows Defender Credential Guard on physical machines applies also to virtual machines.
> [!NOTE] > [!NOTE]
@ -151,19 +151,6 @@ To enable, use the Control Panel or the Deployment Image Servicing and Managemen
> [!NOTE] > [!NOTE]
> You can also enable Windows Defender Credential Guard by setting the registry entries in the [FirstLogonCommands](/windows-hardware/customize/desktop/unattend/microsoft-windows-shell-setup-firstlogoncommands) unattend setting. > You can also enable Windows Defender Credential Guard by setting the registry entries in the [FirstLogonCommands](/windows-hardware/customize/desktop/unattend/microsoft-windows-shell-setup-firstlogoncommands) unattend setting.
### Enable Windows Defender Credential Guard by using the HVCI and Windows Defender Credential Guard hardware readiness tool
You can also enable Windows Defender Credential Guard by using the [HVCI and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md).
```cmd
DG_Readiness_Tool.ps1 -Enable -AutoReboot
```
> [!IMPORTANT]
> When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work.
>
> This is a known issue.
### Review Windows Defender Credential Guard performance ### Review Windows Defender Credential Guard performance
#### Is Windows Defender Credential Guard running? #### Is Windows Defender Credential Guard running?
@ -178,17 +165,6 @@ You can view System Information to check that Windows Defender Credential Guard
:::image type="content" source="images/credguard-msinfo32.png" alt-text="The 'Virtualization-based security Services Running' entry lists Credential Guard in System Information (msinfo32.exe)."::: :::image type="content" source="images/credguard-msinfo32.png" alt-text="The 'Virtualization-based security Services Running' entry lists Credential Guard in System Information (msinfo32.exe).":::
You can also check that Windows Defender Credential Guard is running by using the [HVCI and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md).
```cmd
DG_Readiness_Tool_v3.6.ps1 -Ready
```
> [!IMPORTANT]
> When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work.
>
> This is a known issue.
> [!NOTE] > [!NOTE]
> For client machines that are running Windows 10 1703, LsaIso.exe is running whenever virtualization-based security is enabled for other features. > For client machines that are running Windows 10 1703, LsaIso.exe is running whenever virtualization-based security is enabled for other features.

File diff suppressed because one or more lines are too long