---
title: Identity - Credential Protection
slug: identity-credential-protection
docTags: 
createdAt: 2026-10-12T22:00:22.904Z
---

# Enterprise

***

## ESM Security Setting - Credential Guard Policy

**Description**: Credential Guard Configuration: 0 - Turns off `CredentialGuard` remotely.

**Why It's Important**: Credential Guard protects sensitive login information by isolating it in a secure part of the system that malware can’t easily access. Enabling it with UEFI lock makes this protection even stronger by preventing it from being turned off remotely or tampered with. SHIELD enables this policy to ensure that credential protection is enforced at the hardware level, making it extremely difficult for attackers to steal login data. It’s like locking your keys in a safe that can’t be opened without physically accessing the device—secure, reliable, and tamper-proof.

**Learn More**

- [DeviceGuard Policy CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deviceguard?WT.mc_id=Portal-fx#lsacfgflags)

***

# Privileged

***

## PSM Security Setting - Credential Guard Policy

**Description**: Credential Guard Configuration: 0 - Turns off `CredentialGuard` remotely if configured previously without UEFI Lock, 1 - Turns on `CredentialGuard` with UEFI lock. 2 - Turns on `CredentialGuard` without UEFI lock.

**Why It's Important**: This policy protects credentials by isolating them in a secure environment with virtualization-based security, and using UEFI lock ensures the protection cannot be disabled remotely.

**Learn More**

- [DeviceGuard Policy CSP | Microsoft Learn](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deviceguard?WT.mc_id=Portal-fx#lsacfgflags)