# Devices with critical credentials should be protected by Credential Guard

Devices shown in the output are devices where Credential Guard is not enabled or misconfigured, but contains credentials of critical accounts.

Source: https://maester.dev/docs/tests/MT.1089

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/robbevandendaele" title="Robbe Van den Daele · Original author"><img src="https://github.com/RobbeVandenDaele.png" alt="Robbe Van den Daele" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/samerde" title="Sam Erde · Co-contributor"><img src="https://github.com/SamErde.png" alt="Sam Erde" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/robbevandendaele">Robbe Van den Daele</a> with <a href="/contributors/samerde">Sam Erde</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Defender · Exposure Management · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1089
```

## Overview

Devices shown in the output are devices where Credential Guard is not enabled or misconfigured, but contains credentials of critical accounts. When critical credentials are stored on devices without Credential Guard enabled, it is easy for adversaries to steal those credentials when the device is compromised. This is because, without Credential Guard enabled, Kerberos, NTLM, and Credential Manager secrets are stored in the Local Security Authority (LSA) process called `lsass.exe`, which can be dumped with various tools like MimiKatz. With Credential Guard enabled, these secrets are protected and isolated using Virtualization-based security (VBS).

### How to fix

Investigate the related devices and the steps that need to be taken in order to enable Credential Guard. This varies depending on operating system, hardware, and device. More information on how Credential Guard works and how it can be configured can be found in [this documentation page](https://learn.microsoft.com/windows/security/identity-protection/credential-guard/).

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1089 |
| Severity | Medium |
| Suite | Maester |
| Product | Defender |
| Feature | Exposure Management |
| Area | Devices and endpoints |
| Resource type | Device |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1003.001 LSASS Memory |
| PowerShell test | [Test-MtXspmCriticalCredentialsOnNonCredGuardProtectedDevices](https://github.com/maester365/maester/blob/main/tests/maester/xspm/Test.MT.1089.ps1) |
| Services | Graph |
| Long running | Yes |

</details>

## Source

- Test: [`tests/maester/xspm/Test.MT.1089.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/xspm/Test.MT.1089.ps1)
- Documentation: [`tests/maester/xspm/Test.MT.1089.md`](https://github.com/maester365/maester/blob/main/tests/maester/xspm/Test.MT.1089.md)