Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / Windows 11 Credential Guard Is Breaking Enterprise VPNs
Transcript
- Lucas: If you manage enterprise Windows machines and you've seen a sudden spike in VPN help-desk tickets after a recent update, I think I know why. And it's not the VPN vendor's fault. Luna: You're going to say Credential Guard, aren't you? Lucas: Exactly. Windows 11's Credential Guard — that virtualization-based security feature that isolates user secrets in a protected container — has been quietly breaking legacy VPN clients. And with the 24H2 feature update rolling out to more enterprise rings, it's becoming a real pain point. Lucas: Before we go deep, I want to mention something quickly. If this episode saves you even one help-desk ticket, it was worth a coffee. That link is buy me a coffee dot com slash fexingo — listener support is what keeps this show ad-free and focused on real enterprise Windows pain points. Luna: Yeah, it's a tiny ask for something that could save you hours of troubleshooting. Totally second that. Lucas: So, Credential Guard. It was introduced in Windows 10 Enterprise, but it's become much more aggressive in Windows 11, especially with the latest feature updates. The idea is sound: by running the Local Security Authority subsystem in a virtualized container, even if an attacker gains kernel access, they can't dump your credentials. Luna: Right, but the problem is that some VPN clients — especially older ones that use the Credential Manager or the old Pluggable Authentication module — need direct access to the LSA process to inject credentials. Lucas: Exactly. When Credential Guard is on, that injection path is blocked. So the VPN client can't authenticate. The user sees a generic 'connection failed' error, and then they call IT. Luna: I was talking to an IT director at a mid-size financial firm last week. After they pushed the 24H2 update, about 40 percent of their remote workforce couldn't connect to the VPN. They spent three days blaming the network team before someone checked the LSA protection setting. Lucas: That's exactly the pattern. And it's not just one VPN vendor. I've seen reports with Cisco AnyConnect, Palo Alto GlobalProtect, even some older OpenVPN implementations. The common thread is they're using certificate-based authentication with IKEv2 or SSTP, and the credential handshake hits the virtualized LSA. Lucas: Let me be specific about the mechanism. Credential Guard doesn't block all VPN traffic — it blocks the specific call to LsaLogonUser that legacy VPN clients use to submit credentials. Modern VPN clients that use the Windows VPN platform, like the built-in VPN client or Always On VPN, don't have this problem because they use a different API path. Luna: So the fix is either to update the VPN client to one that supports the new API, or to exclude the VPN process from Credential Guard? Lucas: Both options exist, but neither is trivial. Microsoft does allow you to configure Credential Guard exclusions via Group Policy — you can add specific executable names to a list that bypasses the virtualization. But that weakens the security posture, obviously. Luna: And the VPN vendors have been slow to update. Cisco only added native Credential Guard support in AnyConnect version 4.10, which came out late last year. If you're on an older release, you're stuck. Lucas: Right. So the practical advice for IT admins right now is: before you push 24H2 to your remote workforce, audit your VPN client versions. If you're on a pre-2025 version of your VPN software, you're going to have a bad time. Lucas: The better long-term move is to migrate to Always On VPN, which is Microsoft's modern VPN solution and is designed to work with Credential Guard. It uses the Windows VPN platform natively and doesn't need to inject credentials into LSA. Luna: But that's a big project — reconfiguring your VPN infrastructure, updating your device tunnels, retraining users. It's not a quick fix. Lucas: No, it's not. So in the short term, you might need to disable Credential Guard for specific users or groups. You can do that via Group Policy under Computer Configuration -> Administrative Templates -> System -> Device Guard. There's a setting called 'Turn On Virtualization Based Security' — set it to Disabled. Luna: But again, that opens up credential theft attacks. If you're in a highly regulated industry, that might not be acceptable. Lucas: Exactly. So you need to weigh the risk. Some organizations are choosing to keep Credential Guard on and instead update their VPN client to a version that supports the new credential API. Others are creating exclusion lists for the VPN client executable. Lucas: There's also a middle ground: you can configure Credential Guard to run without UEFI lock, which allows it to be turned off remotely if needed. But that reduces the security guarantee. Luna: I think the takeaway is: if you haven't tested your VPN with Credential Guard enabled, you're flying blind. And with 24H2 being pushed more aggressively now, it's only a matter of time before you get that spike in tickets. Lucas: Yeah. And the worst part is that the error messages are misleading. The VPN client usually says 'unable to establish connection' or 'authentication failure' — it never says 'Credential Guard blocked my credential injection'. So IT spends hours chasing network issues. Luna: One quick diagnostic tip: check the Event Viewer under Applications and Services Logs -> Microsoft -> Windows -> LSA. If you see Event ID 3066 or 3067, that's Credential Guard rejecting an authentication request. Lucas: That's gold. Write that down, listeners. Event ID 3066 and 3067 in the LSA log are your smoking gun. Lucas: So to summarize: Windows 11 Credential Guard is a powerful security feature, but it breaks legacy VPN clients that rely on direct LSA credential injection. The fix is to update your VPN client, migrate to Always On VPN, or configure exclusions. Don't ignore it — because 24H2 is making this problem much more common. Luna: And if you're an IT admin listening, test this before you push the update to your remote workers. Your help desk will thank you. Lucas: Absolutely. Thanks, Luna. That's all for this episode of The Windows Podcast. We'll be back with another deep dive into enterprise Windows pain points next week.