1

My processor is supposed to support virtualization:

cpu.inf:5f63e534115a322c:IntelPPM_Inst.NT:10.0.17134.765:ACPI\GenuineIntel_-_Intel64
ACPI\GENUINEINTEL_-_INTEL64_FAMILY_6_MODEL_37_-_INTEL(R)_CORE(TM)_I5_CPU_______M_540__@_2.53GHZ\_1

As I understand it, in Windows 10 I can't run VirtualBox because Windows 10 uses something called the Windows Defender Credential Manager which is a secure VM for separating credential management (related to Keybreos and NTLM) from the physical hardware that Windows 10 is running them.

While it sounds like a really good idea from a security standpoint, it also seems to be preventing me from running virtual machines on my laptop in VirtualBox.

While Hyper-V is an option it has some limitations that VirtualBox does not when working with Vagrant.

It can be disabled / enabled according to this.

Virtualization Based Security

2

The feature you named does not exist. What you're actually asking about is Windows Defender Credential Guard. This feature moves your passwords and derived credentials for Kerberos and NTLM used to communicate with services on the network into a separate secure virtual machine (VSM).

The point of the feature is to make it more difficult for attackers to steal credentials and move around an enterprise network. If this feature is turned off an attacker can easily grab these credentials and potentially elevate their privileges on the network.

Since this feature is not on by default and only applies in Active Directory-based networks it's likely it was your administrator(s) that turned it on. If that's the case you should be asking them if it's unsafe to turn it off.

  • If it doesn't exist, and it's on a separate VM, then why do I have to turn that off to get my virtualization to work? I'd think that I would have to be connected to the VPN to get to it then... – leeand00 May 28 at 22:40
  • Look, I'm not arguing with you, I'm just trying to understand why. – leeand00 May 28 at 22:46
  • 1
    All I was saying was you got the name mixed up, sorry if that wasn't clear. The feature provides you security by moving creds into a private VM no one can touch. It does this by relying on the Hyper-V hypervisor. VirtualBox has its own hypervisor. You can't have two, and only the Hyper-V HV provides the security guarantees Cred Guard needs. So, it's important to security. Your admins can say how important. – Steve May 29 at 2:14
-2

If your question is "Is there a security risk if I disable this" then the answer is probably not. This functionality of Windows is meant to protect your Windows' admin password.

It brings your real hashed password on a layer on top of the OS, meaning the OS can't access it directly and making it unstealable for viruses. That can be very useful in case of an active controller domain, the server used by companies to allow employees to connect not on local computer but rather on a distant server.

It may also protect you from physical password attacks like KonBoot, but I'm not sure about this one.

To sum up, if you are not the administrator of a shared computer nor is the system administrator of a domain you totally can disable this Windows Defender thing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.