Skip to main content

​
Overview

The CredGuard command checks the configuration status of Windows Defender Credential Guard, a virtualization-based security feature that protects credentials by isolating LSASS in a secure environment. Understanding Credential Guard status is crucial for assessing credential theft risk.

​
Syntax

Seatbelt.exe CredGuard

​
Remote Execution

Seatbelt.exe CredGuard -computername=TARGET.domain.com [-username=DOMAIN\user -password=pass]

​
Output

Returns Credential Guard configuration:
  • Enabled/Disabled status
  • Configuration method (UEFI, Registry)
  • Running status
  • Security Services Running

​
Use Cases

  • Red Team
  • Blue Team
  • Assess credential theft protection
  • Determine if mimikatz will work
  • Plan credential access strategy
  • Identify systems vulnerable to credential dumping

​
Example Output

====== CredGuard ======

CredentialGuard      : Not Configured
LsaCfgFlags          : 0
SecurityServicesRunning : 0

  [*] Credential Guard is NOT running

​
Remote Execution

This command supports remote execution using the -computername parameter.

​
Detection Considerations

Low detection risk - reads registry and WMI data.