Let's go ahead and configure Credential Guard.
We're going to do this using a Group Policy so that we can
enforce Credential Guard across the domain.
So within my domain controller,
I'm going to go ahead and create a new Group Policy,
and I will call this Credential Guard, and I'm going
to go ahead and edit the policy.
Right, so within the policy, we need to navigate to Computer Configuration,
Policies, Administrative Templates, System,
and we will select Device Guard.
Now within this setting,
all of the Credential Guard configuration is done within the
Virtualization Based Security configuration.
When you open this configuration,
you'll notice that you've got a number of different settings,
so the first thing that we are going to do is enable the setting.
Next, we need to select our secure Platform Security Level.
Now we can enforce just Secure Boot,
or we can leverage Secure Boot with DMA Protection,
so I'll go ahead and select the second one.
And under Virtualization Based Protection of Code Integrity,
I would like to enable this, leveraging the UEFI lock.
Now this Virtualization Based Protection of Code Integrity actually
enables the Hypervisor‑protected Code Integrity,
for short the HVCI.
That is one of the features that's supported on Windows Server 2022.
Remember that the HVCI protects modifications to control Flow Guard, it
ensures that other trusted processes like Credential Guard,
for example, has a valid certificate.
And also modern device drivers must have an extended‑validation Certificate,
and they should support HVCI.
So this is a good setting to remember to turn on,
especially for Windows Server 2022.
And by the way, it's also supported in Windows 10 and Windows 11.
The next setting that we have is the actual Credential Guard Configuration.
So here we have a number of options,
and I'm going to go ahead and also enable it, leveraging the UEFI lock.
And the last setting that we have is the Secure Launch Configuration.
Secure Launch Configuration is leveraging System Guard,
essentially what this component does is it improves the
startup security of the operating system.
It is also supported on Windows 10 and Windows 11.
Dropping the configuration down, we can either turn it on or off,
so I'm going to go ahead and enable this.
Now one thing to point out is that the reason why I have
leveraged the UEFI locks on Virtualization Based Protection and
Credential Guard is because this ensures that those settings
cannot be turned off remotely.
So with this configuration in place, I'm going to go ahead and click on OK,
and now I've got my Credential Guard Group Policy.
I can now link this group policy to an OU that I would like to apply it.
Remember that even though you may have the group policy,
the hardware requirements still need to be met, so you might find
that if you do not have the hardware requirements,
Credential Guard would not fully be enabled. So keep that in mind as you deploy Credential Guard.