Credential Guard
E831603
Credential Guard is a Windows security feature that uses virtualization-based isolation to protect credentials from theft by malware and other attacks.
All labels observed (3)
| Label | Occurrences |
|---|---|
| Credential Guard canonical | 2 |
| Local Security Authority Subsystem Service | 1 |
| Windows Defender Credential Guard | 1 |
How this entity was disambiguated
This entity first appeared as the object of triple T9963327 — resolving that mention is where its identity was fixed. The disambiguator weighed these candidate entities and picked the highlighted one (or “None”, minting a new entity). This is how homonymy is resolved: the same surface form can point to different entities.
NED1
Entity disambiguation (via context triple)
gpt-5-mini-2025-08-07
Target entity: Credential Guard Context triple: [Windows Security app, integratesWith, Credential Guard]
-
A.
Microsoft Defender for Identity
Microsoft Defender for Identity is a cloud-based security solution that uses on-premises Active Directory signals to detect, investigate, and respond to advanced identity-based threats in enterprise environments.
-
B.
Secure Enclave
Secure Enclave is Apple’s dedicated coprocessor for handling sensitive tasks like encryption and biometric data storage in a secure, isolated environment.
-
C.
Privileged Identity Management
Privileged Identity Management is a Microsoft security service that provides just-in-time, approval-based, and time-limited access to sensitive roles and resources to reduce the risks associated with standing administrative privileges.
-
D.
Windows NT security model
The Windows NT security model is a comprehensive, enterprise-oriented access control and authentication framework used by Windows operating systems to manage user rights, permissions, and system protection.
-
E.
System Integrity Protection
System Integrity Protection is a macOS security technology that restricts even administrative users and processes from modifying critical system files and resources to protect the operating system from malware and accidental damage.
- F. None of above. chosen
- G. Unsure - the case is ambiguous/there is not enough information to decide.
NED2
Entity disambiguation (via description)
gpt-5-mini-2025-08-07
Target entity: Credential Guard Target entity description: Credential Guard is a Windows security feature that uses virtualization-based isolation to protect credentials from theft by malware and other attacks.
-
A.
Microsoft Defender for Identity
Microsoft Defender for Identity is a cloud-based security solution that uses on-premises Active Directory signals to detect, investigate, and respond to advanced identity-based threats in enterprise environments.
-
B.
Secure Enclave
Secure Enclave is Apple’s dedicated coprocessor for handling sensitive tasks like encryption and biometric data storage in a secure, isolated environment.
-
C.
Privileged Identity Management
Privileged Identity Management is a Microsoft security service that provides just-in-time, approval-based, and time-limited access to sensitive roles and resources to reduce the risks associated with standing administrative privileges.
-
D.
Windows NT security model
The Windows NT security model is a comprehensive, enterprise-oriented access control and authentication framework used by Windows operating systems to manage user rights, permissions, and system protection.
-
E.
System Integrity Protection
System Integrity Protection is a macOS security technology that restricts even administrative users and processes from modifying critical system files and resources to protect the operating system from malware and accidental damage.
- F. None of above. chosen
Statements (47)
| Predicate | Object |
|---|---|
| instanceOf |
Windows security feature
ⓘ
credential protection technology ⓘ |
| availableInEdition |
Windows 10 Education
ⓘ
linked to:
Windows 10
Windows 10 Enterprise ⓘ
linked to:
Windows 10
Windows 11 Education ⓘ
linked to:
Windows 11
Windows 11 Enterprise ⓘ
linked to:
Windows 11
|
| category |
Windows security
ⓘ
linked to:
Windows security subsystem
identity protection ⓘ |
| componentOf |
Windows Defender Credential Guard
ⓘ
linked to:
Credential Guard
|
| configuredBy |
Group Policy
ⓘ
registry settings ⓘ |
| developedBy | Microsoft ⓘ |
| documentationURL | https://learn.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard ⓘ |
| enhances | enterprise security ⓘ |
| introducedIn |
Windows 10 Enterprise
ⓘ
linked to:
Windows 10
|
| isolates |
LSASS secrets
ⓘ
Local Security Authority Subsystem Service credentials ⓘ |
| mitigates | credential dumping tools ⓘ |
| notAvailableInEdition |
Windows 10 Home
ⓘ
linked to:
Windows 10
Windows 10 Pro (some scenarios) ⓘ |
| operatingSystem |
Windows 10
ⓘ
Windows 11 ⓘ Windows Server ⓘ |
| prevents | direct LSASS memory scraping ⓘ |
| protects |
Kerberos Ticket Granting Tickets
ⓘ
NTLM password hashes ⓘ credentials ⓘ domain credentials ⓘ |
| protectsFrom |
advanced persistent threats
ⓘ
credential theft attacks ⓘ malware ⓘ pass-the-hash attacks ⓘ pass-the-ticket attacks ⓘ |
| relatedTo |
Device Guard
ⓘ
Windows Defender Application Control ⓘ
linked to:
Device Guard
|
| requires |
64-bit architecture
ⓘ
IOMMU ⓘ Secure Boot ⓘ
linked to:
verified boot
UEFI firmware ⓘ virtualization extensions ⓘ |
| scope |
Azure AD-joined machines
ⓘ
domain-joined machines ⓘ |
| securityModel | least privilege for credential access ⓘ |
| storesSecretsIn | isolated virtualized environment ⓘ |
| usesTechnology |
Hyper-V
ⓘ
Virtual Secure Mode ⓘ virtualization-based security ⓘ |
How these facts were elicited
The pipeline generated the facts above by prompting gpt-5.1 with this entity's name + description and the instruction below.
Instruction
You are a knowledge base construction expert. Given a subject entity and a description of it, return factual statements that you know for the subject as a JSON list of dictionaries(triples), where keys must be "subject", "predicate" and "object". The number of facts may be very high, between 25 to 50 or more, for very popular subjects. For less popular subjects, the number of facts can be very low, like 5 or 10. # Requirements - If you don't know the subject at all, return an empty list. - If the subject is not a named entity, return an empty list. - Include at least one triple where predicate is "instanceOf". - Do not get too wordy. - Separate several objects into multiple triples with one object.
Input
Subject: Credential Guard Description of subject: Credential Guard is a Windows security feature that uses virtualization-based isolation to protect credentials from theft by malware and other attacks.
Referenced by (4)
Full triples — surface form annotated when it differs from this entity's canonical label.
linked to: Credential Guard
linked to: Credential Guard