Credential Guard (Lsa
Whether Credential Guard isolates secrets in virtualisation-based security.
Use it to tell whether domain secrets were isolated by VBS, and spot that being switched off.
- SYSTEM
- Defence Evasion
What It Is
Credential Guard is a Windows feature that protects the secrets behind domain sign-in, such as NTLM password hashes and Kerberos ticket-granting tickets. It uses virtualisation-based security (VBS) to hold them in an isolated process, LsaIso.exe, which the running system cannot read, even with administrator rights. LsaCfgFlags, in the Lsa key of the SYSTEM hive, says whether Credential Guard is configured to run, and a change applies after a restart. Windows 11 22H2 and later turn it on by default on domain-joined devices that meet its requirements.
What It Proves
LsaCfgFlags set to 1 or 2 turns Credential Guard on, isolating derived secrets so they cannot be read from LSASS. A 0 or missing value means that isolation is not in force.
What It Does Not Prove
The registry value is the configured state. The running state also depends on hardware and VBS and is best confirmed on the live host. It is on by default on eligible Windows 11 22H2 devices.
Where It Lives
Credential Guard (LsaCfgFlags) lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| Credential Guard is set on with a UEFI lock, so a registry edit cannot turn it off. WinInit event 13 in the System log confirms it started at boot. |
| Credential Guard is configured off, so LSASS keeps NTLM hashes and Kerberos tickets in its own memory. WinInit event 14 in the System log at boot shows the setting in force. |
How to Read It
Read LsaCfgFlags under Control\Lsa (policy sets it under Policies\Microsoft\Windows\DeviceGuard). 1 means on with a UEFI lock, 2 on without a lock, 0 means off. To put it right, re-enable it through policy, reboot, and confirm the running state on the host.
- When Windows Writes It
- It is written when Group Policy or an administrator sets the value. It takes effect at the next boot.
- Which Windows Versions
- Windows 10 and Server 2016 to 11 (default on eligible 11 22H2 hardware)
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper
Hunt It
Microsoft does not list which registry values Defender records, so confirm LsaCfgFlags writes appear before relying on it. A hit shows the configured state, not the running one, which changes only after a reboot.
// Credential Guard (LsaCfgFlags) changed or removedDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Credential Guard (LsaCfgFlags) shows.
- Credential Guard Started, WinInit Event 13Not in the RegistryConfirms Credential Guard actually started at boot, which the setting alone cannot.
Sources
The facts on this page come from these public pages, which say more on each point.