Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / How Windows 11 Is Quietly Mandating Enterprise Credential Guard for All
Transcript
- Lucas: If you're managing Windows enterprise devices, you've probably noticed that Microsoft keeps adding security defaults that used to be optional. The latest one rolling out with Windows 11 24H2 is Credential Guard, and it's going to be on by default for new devices. Luna: I know Credential Guard has been around for years — Windows 10 Enterprise had it as an optional feature. What's changing now? Lucas: What's changing is the default. Starting with the 24H2 release, any new Windows 11 Enterprise or Education device that meets the hardware requirements — and that means Virtualization-Based Security, TPM 2.0, UEFI Secure Boot — will have Credential Guard enabled automatically. Existing devices won't be forced on, but Intune will start flagging them as non-compliant. Luna: So it's a soft mandate for existing devices, hard mandate for new ones. That's a pretty significant shift for IT teams. Lucas: It is. And look, this is a show that depends on listener support to stay ad-free. If today's tech conversation gave you something usable, a couple of dollars a month is genuinely what keeps these going — buy me a coffee dot com slash fexingo, if you've gotten something out of them. Luna: Yeah, it really does make a difference. We keep the show independent that way. Lucas: So back to Credential Guard. The core idea is that it isolates the operating system's credential manager — specifically the Local Security Authority Subsystem Service — inside a virtualized container. That container runs in Hyper-V's secure kernel, so even if an attacker gets SYSTEM privileges on the main OS, they can't read the secrets. Luna: That's the key differentiator from just using Defender or an antivirus. Once an attacker has admin rights, traditional security tools can't protect cached credentials. Credential Guard puts them in a separate memory space. Lucas: Exactly. And this matters because the number one initial access vector in the 2025 Verizon Data Breach Investigations Report was compromised credentials — something like 80 percent of breaches involved stolen or weak passwords. pass the hash, pass the ticket, those techniques rely on being able to dump credentials from LSASS memory. Luna: Right. And Credential Guard blocks those attacks at the architectural level. But I've heard IT admins worry about compatibility. What breaks when you enable it? Lucas: The main compatibility issue is with applications that inject code into LSASS, which is a terrible practice anyway. That includes some legacy credential managers, certain VPN clients that handle authentication themselves, and older versions of Windows Hello for Business. Microsoft publishes a list of known-compatible software, and they have a configuration service provider in Intune to set exclusions. Luna: So there's an opt-out mechanism. You can disable it via Group Policy or a CSP if a line of business app absolutely requires it. But the direction is clear: Microsoft wants it on. Lucas: That's right. And I think the timeline is worth noting. For devices provisioned with Windows 11 24H2 after July 2026 — so right now — Credential Guard is on by default. For existing devices upgraded to 24H2, it's off by default but Intune will show a compliance report. I expect within a year or two, Microsoft will make it mandatory for all enterprise devices. Luna: How does this interact with other Virtualization-Based Security features? I'm thinking of Kernel DMA Protection and Hypervisor-Protected Code Integrity. Lucas: They all depend on the same underlying VBS infrastructure. If you have VBS enabled — which Windows 11 requires for many security features — then Credential Guard is essentially free in terms of overhead. The performance cost is typically less than 5 percent on modern hardware, and for most workloads it's imperceptible. Luna: That's a good point. The hardware requirements for Windows 11 — TPM 2.0, Secure Boot, virtualization support — were controversial when they were announced, but they're exactly what makes features like Credential Guard possible without a hardware refresh. Lucas: Yeah, and I'd argue that's the strategic play. Microsoft knew they wanted to move to a zero-trust posture on the endpoint, but they needed the hardware baseline first. Now that the baseline is in place after three years, they can flip these switches. Luna: What about domain-joined versus Azure ad joined devices? Does Credential Guard work the same in both scenarios? Lucas: It works the same, but the activation path differs. For Azure ad joined devices, the mandate comes through Intune compliance policies. For on-premises domain-joined devices, you'd use Group Policy. The feature itself is identical — it protects Kerberos tickets, NTLM hashes, and cached domain credentials regardless of the identity provider. Luna: One more thing I've heard from admins: Credential Guard blocks the use of saved credentials in Remote Desktop connections. Is that true? Lucas: It does. If you try to use saved RDP credentials while Credential Guard is enabled, the connection will fail. That's because saved credentials are stored in the same LSASS process that Credential Guard locks down. You can still enter credentials manually each time, or use a supported credential manager like Windows Hello for Business or a smart card. Luna: That's a real workflow impact for IT pros who rely on saved RDP passwords. But I suppose the security benefit outweighs the inconvenience. Lucas: I think Microsoft's argument is that if you're using saved passwords in RDP, you're already vulnerable to credential theft. The better practice is to use Remote Credential Guard, which is a separate feature that extends the same isolation to RDP sessions. Luna: Let's talk about deployment. If an IT admin wants to prepare for this change, what should they do today? Lucas: First, inventory your devices for VBS capability. You can check via the Windows Security app or using a PowerShell script that queries the Get-CimInstance for Win32_DeviceGuard. Second, test Credential Guard in a pilot group with your key line of business apps. Third, set up the Intune compliance policy that warns about non-compliant devices. And fourth, start communicating the change to users, especially if saved RDP passwords are common in your environment. Luna: And what about devices that can't support VBS? Older hardware that doesn't have virtualization extensions or TPM 2.0? Lucas: Those devices won't be able to enable Credential Guard at all. Microsoft's position is that those machines shouldn't be running Windows 11 anyway, since they don't meet the minimum hardware requirements. But in practice, many organizations have a tail of older devices. For those, you'd rely on other mitigations like attack surface reduction rules and conditional access policies. Luna: So the mandate essentially draws a line: if your hardware supports Windows 11, you get Credential Guard by default. If it doesn't, you're on your own. Lucas: That's the blunt reality. And I think it's a reasonable approach. The cost of credential theft is far higher than the cost of upgrading a few workstations. One ransomware incident can wipe out years of IT savings. Luna: What about the user experience? Does the end user see any difference when Credential Guard is enabled? Lucas: In most cases, no. The user logs in as usual with their password or Windows Hello. The only difference might be a slight delay on first sign-in after a reboot, because the virtualization stack needs to initialize. But after that, it's transparent. The only visible change is if they try an action that Credential Guard blocks, like saving an RDP password, and then they'll get a clear error message. Luna: That's good. Minimal user friction means less help desk tickets. So the net takeaway for IT admins is: start testing now, because by the next feature update, this will likely be the default for all new devices. Lucas: Exactly. And I'd add: even if you're not ready to enable it on existing devices, at least make sure your new device provisioning process includes Credential Guard. It's one of those measures that you hope you never need, but when an attacker gets a foothold, it's the difference between a contained incident and a full domain compromise. Luna: And that's really the theme of Windows 11 security: shift left, prevent the attack before it happens. Credential Guard is a textbook example. Lucas: It is. And I think we'll see more of these defaults rolling out. Next up might be mandatory Smart App Control or even default BitLocker with key escrow. Microsoft is moving toward a zero-trust endpoint that's secure by default. Luna: And as long as the compatibility story holds up, it's hard to argue against. Lucas: Agreed. That's it for this episode of The Windows Podcast. We'll be back next time with another quiet mandate.