> ## Content Index
> Fetch the complete content index at: https://www.filipkonopik.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# PowerShell: Check Credential Guard Status
- URL: https://www.filipkonopik.com/powershell-check-credential-guard-status/
- Published: 2026-07-26T16:57:20.000Z
- Updated: 2026-08-06T05:39:29.000Z
- Author: Filip Konopík
- Tags: Security Hardware

Need to check whether Credential Guard is running - to confirm protection against credential theft attacks like Pass-the-Hash? This one-liner checks it directly.

Prerequisites:

- Privileges: None
- Module: Built-in, no import needed

Quick Command:

```powershell
(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning -contains 1
```

Example Output:

```powershell
False
```

📦

****Want all of them at once?**  
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.

[Get the Complete Bundle for $39](https://gum.co/u/oczvkqdc?ref=filipkonopik.com)

How It Works:

- SecurityServicesRunning is an array that can contain multiple values at once - 1 specifically means Credential Guard is running, while 2 means HVCI (Hypervisor-protected Code Integrity) is running instead.
- contains 1 checks whether that array includes the value 1, returning a clean True/False instead of an array you'd have to interpret manually.
- Credential Guard protects NTLM password hashes and Kerberos tickets by isolating them in a virtualized, protected memory space - even malware with admin-level access can't reach them.

Pro Tip:

For the full raw output (both configured and running services, not just Credential Guard) without the True/False simplification:

```powershell
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard
```