4.2 KiB
title, description, ms.assetid, ms.prod, ms.mktglfcycl, ms.sitesec, ms.pagetype, ms.localizationpriority, author, ms.date
| title | description | ms.assetid | ms.prod | ms.mktglfcycl | ms.sitesec | ms.pagetype | ms.localizationpriority | author | ms.date |
|---|---|---|---|---|---|---|---|---|---|
| Protect derived domain credentials with Windows Defender Credential Guard (Windows 10) | Introduced in Windows 10 Enterprise, Windows Defender Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. | 4F1FE390-A166-4A24-8530-EA3369FEB4B1 | w10 | explore | library | security | high | brianlic-msft | 08/17/2017 |
Protect derived domain credentials with Windows Defender Credential Guard
Applies to
- Windows 10
- Windows Server 2016
Prefer video? See Credential Theft and Lateral Traversal in the Deep Dive into Windows Defender Credential Guard video series.
Introduced in Windows 10 Enterprise and Windows Server 2016, Windows Defender Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Windows Defender Credential Guard prevents these attacks by protecting NTLM password hashes, Kerberos Ticket Granting Tickets, and credentials stored by applications as domain credentials.
By enabling Windows Defender Credential Guard, the following features and solutions are provided:
- Hardware security NTLM, Kerberos, and Credential Manager take advantage of platform security features, including Secure Boot and virtualization, to protect credentials.
- Virtualization-based security Windows NTLM and Kerberos derived credentials and other secrets run in a protected environment that is isolated from the running operating system.
- Better protection against advanced persistent threats When Credential Manager domain credentials, NTLM, and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Windows Defender Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate Windows Defender Device Guard and other security strategies and architectures.
Related topics
- Isolated User Mode in Windows 10 with Dave Probert (Channel 9)
- Isolated User Mode Processes and Features in Windows 10 with Logan Gabriel (Channel 9)
- More on Processes and Features in Windows 10 Isolated User Mode with Dave Probert (Channel 9)
- Mitigating Credential Theft using the Windows 10 Isolated User Mode (Channel 9)
- Protecting network passwords with Windows Defender Credential Guard
- Enabling Strict KDC Validation in Windows Kerberos
- What's New in Kerberos Authentication for Windows Server 2012
- Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide
- Trusted Platform Module
See also
Deep Dive into Windows Defender Credential Guard: Related videos