Credential Guard is a new feature in Windows 10 and it is a Enterprise feature only.
How does it works:
Credential Guard isolates secrets that previous versions of Windows stored in the Local Security Authority (LSA) by using virtualization-based security.
Credential Guard offers the following features and solutions:
•Hardware security Credential Guard increases the security of derived domain credentials by taking advantage of platform security features including, Secure Boot and virtualization.
•Virtualization-based security Windows services that manage derived domain credentials and other secrets run in a protected environment that is isolated from the running operating system.
•Better protection against advanced persistent threats Securing derived domain credentials using the virtualization-based security blocks the credential theft attack techniques and tools used in many targeted attacks. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate Device Guard and other security strategies and architectures.
•Manageability You can manage Credential Guard by using Group Policy, WMI, from a command prompt, and Windows PowerShell.
Read more about Credential Guard on Microsoft TechNet:
https://technet.microsoft.com/itpro/windows/keep-secure/credential-guard
How to build the prereq into Windows 10 Enterprise Base Image with MDT
There is only 2 Windows features that need to be enabled – so why not do it in the base image – then when the organization is ready to implement Credential Guard it is just to configure the GPO.
Enable “Hyper-V Hypervisor”
Enable “Isolated User Mode”
And then Build and Capture the base image as you normally will do in MDT
Hardware and software requirements
The PC must meet the following hardware and software requirements to use Credential Guard:
| Requirement | Description | ||||||
|---|---|---|---|---|---|---|---|
| Windows 10 Enterprise | The PC must be running Windows 10 Enterprise. | ||||||
| UEFI firmware version 2.3.1 or higher and Secure Boot | To verify that the firmware is using UEFI version 2.3.1 or higher and Secure Boot, you can validate it against the System.Fundamentals.Firmware.CS.UEFISecureBoot.ConnectedStandby Windows Hardware Compatibility Program requirement. | ||||||
| Virtualization extensions | The following virtualization extensions are required to support virtualization-based security:
|
||||||
| x64 architecture | The features that virtualization-based security uses in the Windows hypervisor can only run on a 64-bit PC. | ||||||
| A VT-d or AMD-Vi IOMMU (Input/output memory management unit) | In Windows 10, an IOMMU enhances system resiliency against memory attacks. ¹ | ||||||
| Trusted Platform Module (TPM) version 1.2 or 2.0 | TPM 1.2 and 2.0 provides protection for encryption keys that are stored in the firmware and are used by Credential Guard. See the following table to determine which TPM versions are supported on your OS.
Note If you don’t have a TPM installed, Credential Guard will still be enabled, but the keys used to encrypt Credential Guard will not be protected by the TPM.
|
||||||
| Secure firmware update process | To verify that the firmware complies with the secure firmware update process, you can validate it against the System.Fundamentals.Firmware.UEFISecureBoot Windows Hardware Compatibility Program requirement. | ||||||
| The firmware is updated for Secure MOR implementation | Credential Guard requires the secure MOR bit to help prevent certain memory attacks. | ||||||
| Physical PC | For PCs running Windows 10, you cannot run Credential Guard on a virtual machine. |
¹ If you choose the Secure Boot and DMA protection option in the Group Policy setting, an IOMMU is required. The Secure Boot Group Policy option enables Credential Guard on devices without an IOMMU.
Mobile-First Cloud-First 