How to Disable Credential Guard in Windows 11

To disable Credential Guard in Windows 11 on a PC you manage yourself, set the LsaCfgFlags registry value to 0 under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa and HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard, then restart. If Group Policy turned it on or it was enabled with a UEFI lock, use the matching method below instead. You don’t need to disable Hyper-V.

This lowers your protection against credential theft. Turn it off only to fix a confirmed compatibility problem on a PC you manage. On a work or school PC, ask IT first.

Check What Is Running First

Credential Guard uses virtualization-based security (VBS) to isolate sign-in secrets so malware can’t steal them. Microsoft’s Credential Guard overview says it turns on by default on Windows 11 22H2 and later for Enterprise and Education devices that meet the hardware requirements. Some Pro devices that once ran an eligible license keep it on too. Check whether it is running before you change anything.

1. Search Start for msinfo32.exe and open System Information.
2. Select System Summary and find Virtualization-based Security Services Running. Check whether it includes Credential Guard. Record the result before changing anything.
3. If Credential Guard isn’t listed, it isn’t running and isn’t causing your problem. Look at the app’s exact error message instead.

For a more precise read-only check, open Windows PowerShell as administrator and run:

(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning

Microsoft’s Credential Guard configuration guide explains how to read this value: 1 means Credential Guard is running and 2 means Memory integrity is running. If you see both, both are running; a 2 on its own means Credential Guard is off.

Separate Credential Guard From Other Protections

VBS is the isolated environment used by several security features. Memory Integrity protects kernel code and is a separate feature from Credential Guard. Microsoft’s VBS explanation describes that relationship. Switching off Memory Integrity alone is not a reliable Credential Guard procedure.

Removing Hyper-V or stopping the Windows hypervisor affects other features too. Our Windows 11 Hyper-V guide explains that feature. Turning off firmware virtualization, clearing the TPM or disabling Secure Boot isn’t part of disabling Credential Guard.

Prepare and Choose One Method

• Confirm the need. Check the application vendor’s current guidance for your exact version. Record the error and test case so you can compare afterward.
• Save work and make a backup. Record the settings you plan to change. For Registry Editor, select each relevant key and use File > Export to save its backup, following Microsoft’s registry backup guide. Note whether each value existed and its original value.
• Identify the controlling configuration. Ask the administrator whether Intune, domain/local Group Policy, or UEFI lock is involved. Choose its corresponding route below rather than stacking every method.

Registry Method: No UEFI Lock and No Group Policy

Microsoft’s Credential Guard configuration guide has you set two REG_DWORD values named LsaCfgFlags to 0. Use this method only when Credential Guard was not turned on with a UEFI lock or by Group Policy:

1. Open Start, search regedit.exe, and open Registry Editor as an administrator. Back up the keys before editing.
2. Locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa. Set LsaCfgFlags to 0; if absent, create that named DWORD (32-bit) value.
3. Do the same at HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard. Create the DeviceGuard key if absent. Change only the specified value.
4. Close Registry Editor, save outstanding work, and restart. Repeat the running-state check above.

Set the values to 0; deleting them isn’t the same thing. If Registry Editor says access is denied, the PC is probably managed, so ask your IT administrator.

Group Policy or Intune

If Group Policy enabled Credential Guard without UEFI lock, Microsoft documents disabling Turn On Virtualization Based Security at Computer Configuration > Administrative Templates > System > Device Guard. If your PC has the Local Group Policy Editor, press Windows + R, enter gpedit.msc, open that setting, select Disabled > OK, then restart and check the status again.

This policy controls VBS as a whole, so it can switch off other protections too. On a domain, the administrator must change the controlling GPO, because a local edit may not apply. Don’t install an unofficial Group Policy Editor to get around a missing one.

For Intune-managed devices, ask the administrator to change the assigned Credential Guard configuration. Microsoft’s DeviceGuard policy reference defines LsaCfgFlags = 0 for disabling it without a previous UEFI lock, 1 for enabling with lock, and 2 for enabling without lock.

If Credential Guard Has a UEFI Lock

A UEFI lock persists in firmware. Have the administrator follow Microsoft’s Disable Credential Guard with UEFI lock procedure, including physical startup confirmation. Ordinary registry changes cannot clear this lock. Do not substitute generic boot-edit commands.

Verify the Change and Retest the Application

After restarting, run the System Information or PowerShell check again. Credential Guard should no longer be listed as running. Then retest the app that failed; if the error remains, Credential Guard probably wasn’t the cause.

If Credential Guard returns, recheck management policy and the lock state with the administrator. A registry value or a missing LsaIso.exe process alone doesn’t show which settings actually control the PC.

Restore Protection When the Exception Ends

Restore the approved configuration through the same management method, restart, and confirm Credential Guard is running again. Use the enabled-without-lock setting unless your administrator wants a UEFI lock, so you don’t add one by accident.

For registry recovery, Microsoft’s backup guide uses File > Import to restore an exported backup. An import merges saved values; it does not undo every later addition. Use the recorded before-state and the administrator’s approved enablement settings to finish recovery.

Frequently Asked Questions

Why might it affect Wi-Fi, VPN, or saved sign-ins?

Microsoft’s known-issues guide explains that some older authentication setups lose single sign-on or saved-credential behavior. It recommends compatible alternatives, such as certificate-based network authentication.

Can I allow just one application?

Microsoft does not provide a per-application or per-protocol Credential Guard exception. Turning it off reduces protection for stored domain credentials, so resolve the specific compatibility issue where possible.

Will turning it off fix every virtualization error?

No. Credential Guard, Memory Integrity, VBS, and the optional Hyper-V role describe different parts of the configuration. Check which feature the error message points to before changing anything else.