Overview
The CredGuard command checks the configuration status of Windows Defender Credential Guard, a virtualization-based security feature that protects credentials by isolating LSASS in a secure environment. Understanding Credential Guard status is crucial for assessing credential theft risk.Syntax
Remote Execution
Output
Returns Credential Guard configuration:- Enabled/Disabled status
- Configuration method (UEFI, Registry)
- Running status
- Security Services Running
Use Cases
- Red Team
- Blue Team
- Assess credential theft protection
- Determine if mimikatz will work
- Plan credential access strategy
- Identify systems vulnerable to credential dumping
Example Output
Remote Execution
This command supports remote execution using the
-computername parameter.Detection Considerations
Low detection risk - reads registry and WMI data.
Related Commands
- LSASettings - LSA configuration
- WindowsDefender - Defender settings
- SecureBoot - Secure Boot status