PowerShell: Check Credential Guard Status
Need to check whether Credential Guard is running - to confirm protection against credential theft attacks like Pass-the-Hash? This one-liner checks it directly.
Prerequisites:
- Privileges: None
- Module: Built-in, no import needed
Quick Command:
(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning -contains 1Example Output:
False📦
Want all of them at once?
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
How It Works:
- SecurityServicesRunning is an array that can contain multiple values at once - 1 specifically means Credential Guard is running, while 2 means HVCI (Hypervisor-protected Code Integrity) is running instead.
- contains 1 checks whether that array includes the value 1, returning a clean True/False instead of an array you'd have to interpret manually.
- Credential Guard protects NTLM password hashes and Kerberos tickets by isolating them in a virtualized, protected memory space - even malware with admin-level access can't reach them.
Pro Tip:
For the full raw output (both configured and running services, not just Credential Guard) without the True/False simplification:
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard