Windows 10 Enterprise Security: Credential Guard and Device Guard

Summary: "Overview of two new Windows 10 Enterprise Ready Security features: Credential Guard and Device Guard."

What is Device Guard and Credential Guard?

Device Guard and Credential Guard are Virtualization-based security (VBS). With Local Security Authority (LSA) functions using Hypervisor Code Integrity (HVCI) drivers and a compliant BIOS with the Windows 10 Enterprise/Education Edition operating system. It is only available to computers covered by a Microsoft Volume License Agreement (VLA).

Credential Guard uses virtualization-based security to isolate secrets (credentials) so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks. Credential Guard prevents these attacks by protecting NT LAN Manager protocol (NTLM) password hashes and Kerberos Ticket Granting Tickets. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Credential Guard is not dependent on Device Guard.

Device Guard is a combination of enterprise-related hardware and software security features. When they are configured together, they lock a device down so that it can only run trusted applications. If it is not a trusted application, it cannot run. You can configure it to lock a device down. So that the device can only run trusted applications that are defined in your code integrity policies. Device Guard depends on Virtualization based security (VBS).

Top of the Page

How do they work?

Virtualization-Based Security features of Windows 10 Enterprise/Education leverage a range of security elements like UEFI, Secure Boot, Trusted Platform Module (TPM) 2.0. Dell has verified select Precision, Latitude, and OptiPlex computers that must have updated BIOS and HVCI-compliant drivers.

UEFI firmware version 2.3.1 or higher: UEFI is locked down, so that the settings in UEFI cannot be changed to compromise Device Guard security. (Boot order, Boot entries, Secure Boot, Virtualization extensions, IOMMU, Microsoft UEFI CA.)

Top of the Page

Credential Guard.

• Hardware security: Credential Guard increases the security of derived domain credentials by taking advantage of platform security features including, Secure Boot and virtualization.
• Better protection against advanced persistent threats: Securing derived domain credentials using the virtualization-based security blocks the credential theft attack techniques and tools that are used in many targeted attacks.
  • Virtualization-based security protects your secrets against Malware running in the operating system with administrative privileges.
• Manageability: You can manage Credential Guard by using Group Policy, WMI, from a command prompt, and Windows PowerShell.

Protect derived domain credentials with Credential Guard 

Top of the Page

Device Guard.

• Using traditional methods like anti-virus solutions provides an inadequate defense against new attacks. (Signature-based detection to fight against malware.) Especially with thousands of new malicious files created every day.
• Device Guard on Windows 10 Enterprise changes from a mode where apps are trusted unless blocked by an anti-virus or other security solution. It changes to a mode where the operating system trusts only authorized apps set by your enterprise. You designate these trusted apps by creating code integrity policies.

Four ways to manage Device Guard

• Group Policy: Windows 10 provides an administrative template to configure and deploy the configurable code integrity policies for your organization. This template also allows you to specify which hardware-based security features you would like to enable and deploy. You can manage these settings along with your existing Group Policy Objects (GPOs), which makes it simpler to implement Device Guard features.
• Microsoft System Center Configuration Manager: You can use System Center Configuration Manager to simplify deployment and management of catalog files. Including code integrity policies, and hardware-based security features, it also provides version control.
• Windows PowerShell
• Microsoft Intune

Top of the Page

Frequently Asked Questions.

What is Windows 10 Enterprise SKU?
Windows 10 Enterprise SKU is a different Windows OS version that is only available for Microsoft volume license customers. Those who purchase computers with the Windows 10 Professional license, and then upgrade to Windows 10 Enterprise to obtain incremental features. Windows 10 Enterprise includes two security features that are not available on Professional or Home SKUs: Credential Guard and Device Guard. Details of feature comparison among Windows OS SKUs.

What is Device Guard and Credential Guard?
Device Guard and Credential Guard are the new security features that are only available on Windows 10 Enterprise today. Device Guard is a combination of enterprise-related hardware and software security features. When they are configured together, they lock a device down so that it can only run trusted applications. If it is not a trusted application, it cannot run. Credential Guard uses virtualization-based security to isolate secrets (credentials) so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks. Credential Guard prevents these attacks by protecting NTLM password hashes and Kerberos Ticket Granting Tickets.

What is virtualization based security (VBS)?
This is protection that uses the hypervisor to help protect the kernel and other parts of the OS. With VBS default kernel-mode code integrity policy or the code integrity policy that you configure and deploy becomes more robust.

How do I verify that Virtualization Based Protection of Code Integrity is enabled?
The simplest mechanism is to run the System Information app (msinfo32). Look for the following line: "Device Guard Security Services Running." It should report: "Hypervisor enforced Code Integrity." There is also a Windows Management Instrumentation (WMI) interface for review using management tools.

If a computer is not Win10 Enterprise Ready, can that computer still run on Win10 Enterprise?
Yes, as long as a computer is purchased with Win10 Pro. Volume license customers can always upgrade that computer to Win10 Enterprise. All the Enterprise incremental features work fine EXCEPT Device Guard and Credential Guard. This is because these two security features require BIOS, driver, and processor features to be compliant with Microsoft requirements.

What are the requirements to enable Device Guard and Credential Guard on my Dell computers?
Customers who intend to upgrade their computers to enable Device Guard and Credential Guard require the following three criteria:

1. Latitude/OptiPlex/Precision/Venue devices must be Win10 Enterprise Ready. Ensure that the BIOS and drivers are updated to the version that are Enterprise Ready capable. See platform list for detail BIOS/HVCI drivers readiness per platform.
2. Configuration must use DG/CG capable processors. Processors that are DG/CG capable means they are supporting Intel VT-x and VT-d features. These features are mandatory requirements to support Device Guard and Credential Guard on Windows 10. To check if your processor supports Intel VT-x and VT-d. See this link to: Intel® Product Specifications
3. Customers must have a Microsoft Volume License; Win10 Enterprise is not an OEM SKU. Customers can only get Win10 Enterprise bits from Microsoft directly.

Detailed requirements:

More Requirements for Windows 10 1607

You must have a Microsoft Volume License for Win10 Enterprise procured directly from Microsoft (including customers upgrading from a Windows 10 Pro SKU that Dell ships). Dell does not provide Windows 10 Enterprise as an OEM SKU.

If you want to deploy Device Guard, see: Windows Defender Device Guard deployment guide To deploy Credential Guard, see: Requirements and deployment planning guidelines for Credential Guard 

What are the BIOS settings that need to be set for Device Guard and Credential Guard?
These options should be enabled. Ensure you have the latest BIOS that is listed in the supported BIOS list.

How to validate Device Guard and Credential Guard?
You can use the Device Guard and Credential Guard validation tool

• Check if the computer is capable to run Device Guard or Credential Guard
• Disable and Enable Device Guard or Credential Guard

Before you run the tool, ensure that you have enabled the correct execution policy in PowerShell. (See Figure 1. Below)

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned

Figure 1. - Execution policy in PowerShell example.

To Validate: DG_Readiness.ps1 –Capable -[DG/CG/HVCI] -AutoReboot

To Enable: DG_Readiness.ps1 –Enable -[DG/CG] –AutoReboot

To Disable: DG_Readiness.ps1 –Disable -[DG/CG] -AutoReboot

Is my computer pre-configured with Device Guard or Credential Guard?
No, Dell is ensuring the computers that are verified are fully verified from a BIOS firmware and HVCI driver compliance perspective. This is all that you need to enable the computers for the Device or Credential Guard. You would have to enable the features based on the enable switch above or the step-by-step procedure in the deployment guide (See the resources section).

What is HVCI Driver Readiness and how do I know I have the right drivers?
HVCI is Hypervisor Code Integrity. The HVCI service in Windows 10 determines whether code running in kernel mode is securely designed and trustworthy. It offers Zero Day, and vulnerability exploit protection capabilities. It ensures that all software runs in kernel mode, including drivers, securely allocates memory and operates as they are intended.

Use the DGReadiness Tool:

To Validate: DG_Readiness.ps1 –Capable –HVCI -AutoReboot

NOTE: Dell has verified the driver readiness on the Dell supported drivers. If you install any other third-party drivers on the computer, you need to ensure that they are HVCI-compliant. Driver compatibility with Device Guard in Windows 10

Which Dell computers support Device Guard and Credential Guard?
To enable Device Guard and Credential Guard, Dell SkyLake and KabyLake generation computers require both a compatible BIOS and Hypervisor Code integrity (HVCI) compliant drivers.

Here are all the computers that Dell supports this feature set on. The table below list the driver versions and the BIOS versions for each platform.

If a processor is vPro, does that mean they are DG/CG capable?
Yes. In addition, some non-vPro processors are also DG/CG (VT-x/VT-d) capable. To check if your processor supports Intel VT-x and VT-d. See this link to: Intel® Product Specifications

Top of the Page

Resources

• Windows 11 Enterprise Security: Credential Guard and Device Guard
• Device guard deployment guide
• Windows Defender Credential Guard hardware requirements
• Windows Defender Device Guard hardware requirements

Top of the Page