Active Directory Replication or Kerberos Authentication Failures on Windows Virtual Machines with Credential Guard Enabled

Products

• VMware vSphere ESX 8.x
• VMware vSphere ESX 7.x

Issue/Introduction

When managing Windows Domain Controllers or domain-joined servers running as virtual machines on VMware ESXi, you may encounter the following issues:

• Active Directory Replication Failures: repadmin /showrepl or dcdiag reports RPC server unavailable or Kerberos authentication timeouts between sites.
• Authentication Prompts: Users or services encounter unexpected credential prompts or "Wrong principal in request" errors despite correct SPN configurations.
• Logon Failures: Systems fail to process GPO updates or access cross-site resources, often returning Kerberos error KDC_ERR_S_PRINCIPAL_UNKNOWN or similar.

Environment

vSphere 7.x

vSphere 8.x

Cause

Windows Defender Credential Guard uses virtualization-based security (VBS) to isolate secrets, such as NTLM password hashes and Kerberos Ticket Granting Tickets (TGTs). This feature is enabled by default in Windows 11 (22H2 and newer) and Windows Server 2022/2025.

In certain virtualized network environments (e.g., cross-site links with specific firewall or NSX configurations), the isolation provided by Credential Guard can interfere with legacy RPC calls or specific Kerberos delegation flows required for AD replication.

Resolution

To resolve these connectivity and replication issues, you must explicitly disable Credential Guard within the Guest OS or at the virtual machine hardware level.

Step 1: Verify Credential Guard Status

1. Log in to the affected Windows VM.
2. Open System Information (msinfo32.exe).
3. Locate Device Guard Services Running. If it lists Credential Guard, the feature is active.

Step 2: Disable Credential Guard via Registry

Apply the following registry changes to disable the feature within the Guest OS:

1. Open regedit.exe as Administrator.
2. Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa and set LsaCfgFlags to 0 (DWORD).
3. Navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard and set LsaCfgFlags to 0 (DWORD).
4. Restart the virtual machine for changes to take effect.

⚠️ IMPORTANT: Modifying the registry can cause system instability if performed incorrectly. Always take a snapshot of the VM before proceeding and checking with Microsoft

Step 3: (Optional) Disable VBS at the VM Level

If the issue persists, you may need to disable Virtualization-Based Security (VBS) in the vSphere settings:

1. Right-click the VM in the vSphere Client and select Edit Settings.
2. Go to the VM Options tab.
3. Expand VBS Options and uncheck Enable Virtualization Based Security.
4. Click OK and restart the VM.

Additional Information

References

• Kerberos Authentication failure in Windows 11/Server 2022
• Credential Guard initialization on Windows 2022/2025