Section 8: Credential Protection

The Big Picture: Your Sign-In Secrets Are the Prize

When you sign in to Windows, you type a password once. After that, you can open shared folders, use company websites and print without typing it again. How? Windows keeps proof of who you are in memory so it can show it to other services for you.

That proof is gold to an attacker. If they steal it, they do not need your password. They can be you on the network. So Windows works hard to protect these credentials (secrets that prove identity).

Chapter 24 covered how Windows sign-in and accounts work, including the Local Security Authority. Here we focus on how those secrets are defended.

Key words:

8.1 Credential Guard (VBS-Isolated LSASS Secrets)

The old problem. The credentials lived inside lsass.exe memory, in the normal Windows world. An attacker with admin rights could run a tool that dumps (copies) that memory and pulls out hashes and tickets. Famous tools did exactly this. Admin rights are not hard to get once malware is on a PC.

The idea of Credential Guard. Move the most valuable secrets out of the normal world and into the VBS secure world (Section 1.3). The normal LSASS keeps only a small "front desk". The real secrets are held by a separate isolated process, LSAIso (LSA Isolated), in VTL1, which even a fully compromised normal Windows cannot read.

 BEFORE Credential Guard              WITH Credential Guard

 ┌────────────────────────┐      ┌────────────────────────┐
 │ NORMAL WORLD           │      │ NORMAL WORLD           │
 │ ┌────────────────────┐ │      │ ┌────────────────────┐ │
 │ │ lsass.exe          │ │      │ │ lsass.exe          │ │
 │ │ NTLM hashes,       │ │      │ │ (front desk only,  │ │
 │ │ Kerberos tickets   │ │      │ │ no raw secrets)    │ │
 │ └────────────────────┘ │      │ └─────────┬──────────┘ │
 └────────────────────────┘      ├───────────┼────────────┤
   attacker with admin           │ SECURE WORLD (VTL1)    │
   can dump it                   │ ┌─────────▼──────────┐ │
                                 │ │ LSAIso: hashes and │ │
                                 │ │ tickets live here  │ │
                                 │ └────────────────────┘ │
                                 └────────────────────────┘
                                   admin cannot read VTL1

What Credential Guard protects:

Requirements and availability (hedge):

• Needs VBS, so: a 64-bit CPU with virtualization, UEFI with Secure Boot, usually a TPM. TPM is recommended.
• Edition: historically for Enterprise and Education. Newer Windows 11 versions on qualifying hardware can enable it by default for those editions. Pro and Home are usually not covered. Check Microsoft's current documentation for your version.
• It is more useful on PCs joined to a domain, where Kerberos and NTLM matter.

Limits of Credential Guard: It does not stop an attacker who is already running as you from using your session while you are logged in. It also does not protect other credential types (for example, a password typed into a web form). It stops the theft and re-use of the domain secrets.

8.2 Protection Against Credential Theft Techniques

Credential Guard is one piece. Windows protects credentials in several ways at once.

1. LSA protection (RunAsPPL). A Protected Process Light (PPL) is a process that only code signed by Microsoft or a trusted publisher may open or inject into. With LSA protection, lsass.exe runs as a PPL. Memory-dump tools and injected code, even running as admin, are refused. This is often called RunAsPPL after the registry setting. Windows 11 enables it by default on many new installs; depends on version and upgrade history. You can see it in Windows Security → Device security → Core isolation → Local Security Authority protection.

2. Attack surface reduction (ASR) rule. Defender (Section 6) has an optional rule that blocks processes from stealing credentials from LSASS. Used mainly in managed environments.

3. Windows Hello and the TPM (Section 4). With a PIN or fingerprint, the secret is a key in the TPM, not a typed password. There is no password to steal and replay on other devices. The key only works on this machine, and the TPM limits guessing.

4. DPAPI (Data Protection API). Programs, like browsers and apps, often need to store a secret locally (a saved password, a token). Instead of inventing their own protection, they call DPAPI. Windows encrypts the data with a key derived from your sign-in credentials. Other users on the PC cannot read it, and it is tied to your account. Limit: malware running as you can ask DPAPI to decrypt your data, because that is exactly what DPAPI is for. (Some apps add further protection, for example binding data to the TPM.)

5. Credential Manager. A built-in "vault" (Control Panel → Credential Manager) that stores saved Windows and web credentials, protected through DPAPI.

6. Good habits that matter more than any feature:

Techniques and the defence:

Honest summary. No feature makes credential theft impossible. The goal is defence in depth: make each step harder, and make a stolen secret less useful (isolated, short-lived, or tied to one device).

Summary