Credential Protection¶
When a user logs in, Windows keeps their credentials in memory inside a process called LSASS so that network connections can reuse them. Tools like Mimikatz read LSASS and pull out password hashes and, with some settings, plaintext passwords. Everything on this page makes that harder: isolating LSASS from the rest of the OS, refusing to load unknown code into it, and not keeping the plaintext around in the first place.
Virtualization-based security and Credential Guard¶
VBS uses the CPU's virtualization to run a small, isolated part of Windows that the main OS can't read, even with kernel access. Credential Guard puts the credentials in there. Hypervisor-protected code integrity (HVCI) uses the same isolation to verify drivers.
gpedit.msc → Computer Configuration → Administrative Templates → System → Device Guard → Turn On Virtualization Based Security. Enable it, then set each option:
| CIS | Option | Set to | Why |
|---|---|---|---|
| 18.9.5.1 | (the policy itself) | Enabled | |
| 18.9.5.2 | Select Platform Security Level | Secure Boot and DMA Protection (or Secure Boot) | What VBS relies on to trust the boot |
| 18.9.5.3 | Virtualization Based Protection of Code Integrity | Enabled with UEFI lock | Kernel code must be signed; the lock means malware can't turn it off from inside Windows |
| 18.9.5.4 | Require UEFI Memory Attributes Table | True | |
| 18.9.5.5 | Credential Guard Configuration | Enabled with UEFI lock | Credentials live in the isolated environment |
| 18.9.5.6 | Secure Launch Configuration | Enabled | Firmware-level boot protection where the hardware supports it |
| 18.9.5.7 | Kernel-mode Hardware-enforced Stack Protection | Enabled in enforcement mode | Hardware-backed defense against return-oriented programming in the kernel |
On a VMware image, VBS needs the VM's virtualization settings to expose it (VM → Settings → Processor → Virtualize Intel VT-x/EPT) and UEFI boot with Secure Boot. If the VM doesn't support it, the policy sets without effect. Set it anyway; it's harmless, and it takes effect if the platform ever supports it.
Check what's actually running:
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select SecurityServicesRunning, VirtualizationBasedSecurityStatus
SecurityServicesRunning containing 1 means Credential Guard is up; 2 means HVCI.
LSASS as a protected process¶
Even without VBS, LSASS can run as a protected process that only signed, Microsoft-approved code can touch.
System → Local Security Authority:
| CIS | Setting | Set to | Why |
|---|---|---|---|
| 18.9.27.2 | Configures LSASS to run as a protected process | Enabled with UEFI Lock | Debuggers and credential-dumping tools can't open LSASS |
| 18.9.27.1 | Allow Custom SSPs and APs to be loaded into LSASS | Disabled | Authentication packages are how attackers install password-capturing hooks; only Microsoft's load |
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v AllowCustomSSPsAPs /t REG_DWORD /d 0 /f
Don't keep plaintext around¶
| CIS | Setting | Where | Set to |
|---|---|---|---|
| 18.4.6 | WDigest Authentication | MS Security Guide, or ...\SecurityProviders\WDigest\UseLogonCredential = 0 |
Disabled |
| 2.3.10.4 | Network access: Do not allow storage of passwords and credentials for network authentication | secpol.msc Security Options |
Enabled |
| 2.3.11.7 | Do not store LAN Manager hash value on next password change | Security Options | Enabled |
All three are also on the Authentication Protocols page; they belong in both places.
Cached logons¶
Domain credentials are cached on the machine so a laptop can log in with no domain controller in reach. Each cached entry is a hash on disk. secpol.msc → Security Options → Interactive logon: Number of previous logons to cache: 10 or fewer (STIG WN11-SO-000085; the Windows default is 10, an image may have raised it).
Verify¶
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL
reg query "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" /v UseLogonCredential
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard"
RunAsPPL 1, UseLogonCredential 0, and the DeviceGuard key showing EnableVirtualizationBasedSecurity 1, HypervisorEnforcedCodeIntegrity 1, LsaCfgFlags 1.
Example¶
Task Manager shows a process named procdump64.exe that just exited, and C:\Users\bob\lsass.dmp exists. That's a memory dump of LSASS, taken to extract credentials offline. Every password of every user who has logged in since boot should be treated as compromised. Delete the dump, change the passwords, set RunAsPPL, and note it for forensics.