{"id":450863,"date":"2026-09-25T07:00:00","date_gmt":"2026-09-25T01:30:00","guid":{"rendered":"https:\/\/www.guidingtech.com\/?p=450863"},"modified":"2026-09-28T07:04:42","modified_gmt":"2026-09-28T01:34:42","slug":"how-to-disable-credential-guard-windows-11","status":"publish","type":"post","link":"https:\/\/www.guidingtech.com\/how-to-disable-credential-guard-windows-11\/","title":{"rendered":"How to Disable Credential Guard (Windows 11)\u00a0"},"content":{"rendered":"\n

On paper, Credential Guard should increase security on network- or corporation-managed devices. However, if you happen to have Windows 11 Enterprise or Education and are using it for personal use, you might find it limiting virtualization software options. Here\u2019s how to disable Credential Guard (Windows 11 version).<\/p>\n\n\n\n

How to Check if Credential Guard Is Active<\/h2>\n\n\n\n

In most cases, Windows 11 devices running on the Enterprise or Education edition will have the feature running by default. Microsoft has force-enabled it on applicable devices back with version 22H2, and you should\u2019ve been prompted to update past it.<\/p>\n\n\n\n

You can check if the feature is active through the System Information utility.<\/p>\n\n\n\n

Step 1.<\/strong> In the Run utility, open \u201cmsinfo32.\u201d<\/p>\n\n\n\n

\"How<\/figure>\n\n\n\n

Step 2.<\/strong> In the System Summary, look for the entries under \u201cVirtualization-based security,\u201d such as \u201cVirtualization-based security Services Configured\u201d and \u201cVirtualization-based security Services Running.\u201d<\/p>\n\n\n\n

\"How<\/figure>\n\n\n\n

Step 3.<\/strong> If Credential Guard is configured, it should appear under \u201cVirtualization-based security Services Configured.\u201d<\/p>\n\n\n\n

If Credential Guard doesn\u2019t appear and you have Windows 11 Enterprise or Education, the feature may not be enabled, or the device may not meet its hardware and software requirements.<\/p>\n\n\n\n

Part 1 \u2013 Disable Credential Guard (Windows 11) via Group Policy for non-UEFI Lock<\/h2>\n\n\n\n

The Group Policy option should be the easiest and can even be used to apply the change to multiple managed computers. This only applies if the UEFI lock wasn\u2019t enabled when turning on Credential Guard for the first time (or if the setting was turned on in BIOS before).<\/p>\n\n\n\n

Step 1.<\/strong> Open the Run utility and run \u201cgpedit.msc\u201d<\/p>\n\n\n\n

Step 2.<\/strong> Go to the following address:<\/p>\n\n\n\n

Computer Configuration\\Administrative Templates\\System\\Device Guard<\/p>\n\n\n\n

Step 3.<\/strong> Open the \u201cDevice Guard\u201d folder and the \u201cTurn on Virtualization-Based Security Policy\u201d setting.<\/p>\n\n\n\n

Step 4.<\/strong> Select \u201cDisabled\u201d and click \u201cApply\u201d and \u201cOK.\u201d<\/p>\n\n\n\n

Step 5.<\/strong> Exit the utility and restart the PC.<\/p>\n\n\n\n

If Credential Guard was enabled without UEFI lock and isn’t being controlled by Group Policy, you can disable it through the registry.<\/p>\n\n\n\n

Step 1.<\/strong> Open the Registry Editor.<\/p>\n\n\n\n

Step 2.<\/strong> Go to the following registry key and set the LsaCfgFlags value to 0:
HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa<\/p>\n\n\n\n

Step 3.<\/strong> Set the flag to 0.<\/p>\n\n\n\n

Step 4.<\/strong> Go to the following registry key and set the LsaCfgFlags value to 0:
HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceGuard<\/p>\n\n\n\n

Step 5.<\/strong> Set that value to 0 as well.<\/p>\n\n\n\n

Step 6.<\/strong> Exit the Registry Editor and restart the PC.<\/p>\n\n\n\n

If Group Policy is controlling Credential Guard, registry changes may be overridden by the policy. Microsoft recommends setting these registry values to 0 instead of deleting them.<\/p>\n\n\n\n

\"How<\/figure>\n\n\n\n

Part 2 \u2013 Disabling Credential Guard With UEFI Lock<\/h2>\n\n\n\n

If the UEFI lock was enabled, you\u2019ll need to follow the first option, and then remove the lock as well through Command Prompt. This requires physical presence at the PC because you must confirm the change at boot using a function key.<\/p>\n\n\n\n

Step 1.<\/strong> Open the Command Prompt with administrator access.<\/p>\n\n\n\n

Step 2.<\/strong> Run the following commands one by one:<\/p>\n\n\n\n

mountvol X: \/s
copy %WINDIR%\\System32\\SecConfig.efi X:\\EFI\\Microsoft\\Boot\\SecConfig.efi \/Y
bcdedit \/create {0cb3b571-2f2e-4343-a879-d86a476d7215} \/d \u201cDebugTool\u201d \/application osloader
bcdedit \/set {0cb3b571-2f2e-4343-a879-d86a476d7215} path \u201c\\EFI\\Microsoft\\Boot\\SecConfig.efi\u201d
bcdedit \/set {bootmgr} bootsequence {0cb3b571-2f2e-4343-a879-d86a476d7215}
bcdedit \/set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO
bcdedit \/set {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X:
mountvol X: \/d<\/p>\n\n\n\n

Step 3.<\/strong> Restart the PC. Before Windows starts, a prompt will appear to notify you that UEFI was modified and ask you to confirm the change. Follow the on-screen instructions and press the required function key to confirm.<\/p>\n\n\t\t\t

\n\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t

Was this helpful?<\/h3>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\n\t\t\t
\n\t\t\t\t\n \n \n
\n\t\t\t\t\n \n \n
\n\t\t\t\t\t
\n\t\t\t\t\t\t