VSM is a feature that leverages the virtualization extensions of the CPU to provide added security of data in memory. The first technology you'll need to understand before we can really dig into either Device Guard or Credential Guard, is Virtual Secure Mode (VSM). It’s worth noting here that these are enterprise features, and as such are included only in the Windows Enterprise client. Let's dive in and take a logical approach to understanding each. The two are different, but complimentary as they offer different protections against different types of threats.

Its focus is preventing malicious code from running by ensuring only known good code can run.Ĭredential Guard is a specific feature that is not part of Device Guard that aims to isolate and harden key system and user secrets against compromise, helping to minimize the impact and breadth of a Pass the Hash style attack in the event that malicious code is already running via a local or network based vector. This post serves to detail the Device Guard and Credential Guard feature sets, and their relationship to each other.įirst, let's set the foundation by thinking about the purpose of each feature:ĭevice Guard is a group of key features, designed to harden a computer system against malware. However, the key benefits of Windows 10 involve these deep security features. While helping Windows Enterprise customers deploy and realize the benefits of Windows 10, I've observed there's still a lot of confusion regarding the security features of the operating system.

Ad guard windows