This article describes how to configure Credential Guard using Microsoft Intune, Group Policy, or the registry.

Default enablement

Starting in Windows 11, 22H2 and Windows Server 2025, Credential Guard isenabled by default on devices which meet the requirements.

System administrators can explicitlyenable ordisable Credential Guard using one of the methods described in this article. Explicitly configured values overwrite the default enablement state after a reboot.

If a device has Credential Guard explicitly turned off before updating to a newer version of Windows where Credential Guard is enabled by default, it will remain disabled even after the update.

Enable Credential Guard

Credential Guard should be enabled before a device is joined to a domain or before a domain user signs in for the first time. If Credential Guard is enabled after domain join, the user and device secrets may already be compromised.

To enable Credential Guard, you can use:

• Microsoft Intune/MDM
• Group policy
• Registry

The following instructions provide details about how to configure your devices. Select the option that best suits your needs.

Verify if Credential Guard is enabled

Checking Task Manager ifLsaIso.exe is running isn't a recommended method for determining whether Credential Guard is running. Instead, use one of the following methods:

• System Information
• PowerShell
• Event Viewer

System Information

You can useSystem Information to determine whether Credential Guard is running on a device.

1. SelectStart, typemsinfo32.exe, and then selectSystem Information
2. SelectSystem Summary
3. Confirm thatCredential Guard is shown next toVirtualization-based Security Services Running

PowerShell

You can use PowerShell to determine whether Credential Guard is running on a device. From an elevated PowerShell session, use the following command:

(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning

The command generates the following output:

• 0: Credential Guard is disabled (not running)
• 1: Credential Guard is enabled (running)

Event viewer

Perform regular reviews of the devices that have Credential Guard enabled, using security audit policies or WMI queries.
Open the Event Viewer (eventvwr.exe) and go toWindows Logs\System and filter the event sources forWinInit:

Credential Guard (LsaIso.exe) was started and will protect LSA credentials.

Credential Guard (LsaIso.exe) configuration: [**0x0** | **0x1** | **0x2**], **0**

Credential Guard (LsaIso.exe) is configured but the secure kernel isn't running;continuing without Credential Guard.

Credential Guard (LsaIso.exe) failed to launch: [error code]

Error reading Credential Guard (LsaIso.exe) UEFI configuration: [error code]

Disable Credential Guard

There are different options to disable Credential Guard. The option you choose depends on how Credential Guard is configured:

• Credential Guard running in a virtual machine can bedisabled by the host
• If Credential Guard is enabledwith UEFI Lock, follow the procedure described indisable Credential Guard with UEFI Lock
• If Credential Guard is enabledwithout UEFI Lock, or as part of thedefault enablement update, use one of the following options to disable it:
  • Microsoft Intune/MDM
  • Group policy
  • Registry

The following instructions provide details about how to configure your devices. Select the option that best suits your needs.

Disable Credential Guard with UEFI lock

If Credential Guard is enabled with UEFI lock, follow this procedure since the settings are persisted in EFI (firmware) variables.

1. Follow the steps inDisable Credential Guard

2. Delete the Credential Guard EFI variables by using bcdedit. From an elevated command prompt, type the following commands:

   mountvol X: /scopy %WINDIR%\System32\SecConfig.efi X:\EFI\Microsoft\Boot\SecConfig.efi /Ybcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d "DebugTool" /application osloaderbcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} path "\EFI\Microsoft\Boot\SecConfig.efi"bcdedit /set {bootmgr} bootsequence {0cb3b571-2f2e-4343-a879-d86a476d7215}bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISObcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X:mountvol X: /d

3. Restart the device. Before the OS boots, a prompt appears notifying that UEFI was modified, and asking for confirmation. The prompt must be confirmed for the changes to persist.

Disable Credential Guard for a virtual machine

From the host, you can disable Credential Guard for a virtual machine with the following command:

Set-VMSecurity -VMName <VMName> -VirtualizationBasedSecurityOptOut $true

Next steps

• Review the advice and sample code for making your environment more secure and robust with Credential Guard in theAdditional mitigations article
• Reviewconsiderations and known issues when using Credential Guard