Identity - Credential Protection
Enterprise
ESM Security Setting - Credential Guard Policy
Description: Credential Guard Configuration: 0 - Turns off CredentialGuard remotely.
Why It's Important: Credential Guard protects sensitive login information by isolating it in a secure part of the system that malware can’t easily access. Enabling it with UEFI lock makes this protection even stronger by preventing it from being turned off remotely or tampered with. SHIELD enables this policy to ensure that credential protection is enforced at the hardware level, making it extremely difficult for attackers to steal login data. It’s like locking your keys in a safe that can’t be opened without physically accessing the device—secure, reliable, and tamper-proof.
Learn More
Privileged
PSM Security Setting - Credential Guard Policy
Description: Credential Guard Configuration: 0 - Turns off CredentialGuard remotely if configured previously without UEFI Lock, 1 - Turns on CredentialGuard with UEFI lock. 2 - Turns on CredentialGuard without UEFI lock.
Why It's Important: This policy protects credentials by isolating them in a secure environment with virtualization-based security, and using UEFI lock ensures the protection cannot be disabled remotely.
Learn More