Microsoft Credential Guard prerequisites for Windows virtual machines
search cancel

Microsoft Credential Guard prerequisites for Windows virtual machines

book

Article ID: 447325

calendar_today

Updated On:

Products

VMware vCenter Server VMware vSphere ESXi

Issue/Introduction

This article provides the VMware-side prerequisites and configuration steps required to enable Microsoft Credential Guard on Windows virtual machines

Environment

  • VMware vSphere ESXi 9.x
  • VMware vSphere ESXi 8.x
  • VMware vSphere ESXi 7.x
  • Guest OS :
    • Windows 10
    • Windows Server 2016 and newer.

Cause

Microsoft Credential Guard will fail to initialize if the underlying host hardware or virtual machine settings do not support Virtualization-Based Security (VBS). The platform layer must expose specific hardware-assisted capabilities to allow the guest operating system to isolate security parameters.

Resolution

To support Credential Guard, Virtualization-Based Security (VBS) must be enabled at the virtual machine level. 

Host Hardware Requirements:

  • Ensure the physical hosts run VMware ESXi 6.7 or newer for Intel processors and 7.0 Update 2 or newer for AMD processors.
  • Confirm that Input-Output Memory Management Unit (IOMMU) support, such as Intel VT-d or AMD-Vi, is active within the physical system BIOS or UEFI.
    • Note : Engage the respective hardware vendor for guidelines on physical BIOS modifications.

Virtual Machine Configuration:

  • Hardware Version: Use VM Hardware Version 14 or later.

  • Firmware: Must be set to EFI.

  • Secure Boot: Must be Enabled.

  • VBS Setting: Virtualization-Based Security (VBS) must be enabled at the virtual machine level.
    • Note : Checking the "Enable Virtualization Based Security" box in VM > Edit > Settings > VM Options, automatically enables Nested Virtualization (Expose hardware-assisted virtualization to the guest OS) and vIOMMU for that VM. 

  • CPU Virtualization: Ensure Expose hardware-assisted virtualization to the guest OS is enabled.

Implementation Steps:

  1. Power off the target virtual machine.

  2. In the vSphere Client, right-click the VM and select Edit Settings.

  3. Navigate to VM Options > Select the Enable check box for Virtualization Based Security.

  4. Navigate to Virtual hardware > Expand CPU Options > Select the check box for "Expose hardware-assisted virtualization to the guest OS".

  5. Select OK and save the configuration.

  6. Power on the virtual machine.

Additional Information

Powered by Wolken Software