Disable Credential Guard through the same management path that enabled it. On an unmanaged PC without UEFI lock, set both documented LsaCfgFlags registry values to 0 and restart. If an organization manages the PC, change its Intune or Group Policy setting instead. With UEFI lock, registry edits alone will not work: use Microsoft’s firmware procedure, which requires someone at the device to confirm a prompt.
Before you disable Credential Guard
Credential Guard uses virtualization-based security to isolate secrets. Turning it off removes that protection, so leave it enabled unless you have a concrete compatibility or administrative reason and accept the security tradeoff. Microsoft identifies virtualization-based security (VBS) and Secure Boot as requirements for Credential Guard, and recommends TPM. UEFI lock adds protection against an attacker disabling the feature with a registry change. See Microsoft’s Credential Guard overview and requirements.
As an Amazon Associate I earn from qualifying purchases.
Windows 11 version 22H2 and later can enable Credential Guard by default on qualifying devices, unless it was explicitly configured off. Eligibility depends on licensing and hardware and software requirements. If you did not enable it yourself, first check whether an organization’s policy or Windows default is responsible.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose the right disable method
| How it is configured | What to do | Can it be changed remotely? |
|---|---|---|
| Intune or another MDM, without UEFI lock | Set the controlling policy to Disabled; restart Windows. | Typically, through the management service. |
| Group Policy, without UEFI lock | Disable the applicable policy; restart Windows. | Yes, if the organization manages and applies the policy remotely. |
| Local registry, no controlling policy and no UEFI lock | Set both documented registry values to DWORD 0; restart. |
Possible with administrative access. |
| UEFI lock | Follow Microsoft’s firmware-variable removal procedure and confirm the prompt at the device. | No; physical confirmation is required. |
| Hyper-V virtual machine | Use Microsoft’s host-side Hyper-V PowerShell method. | From the Hyper-V host, subject to its access and configuration. |
Microsoft says to disable the same policy or configuration that enabled Credential Guard. Its Credential Guard configuration guidance covers these paths. For a managed PC, ask the administrator which policy applies before making local changes; central policy may override or conflict with them.
#1 Best Overall
- 1.1 GHz (boost up to 2.4GHz) Intel Celeron N5030 Quad-Core
Disable it through Intune or MDM
For Intune, Microsoft documents a Settings Catalog policy under Device Guard. Set Credential Guard to Disabled, apply the policy, and restart the PC. Alternatively, the DeviceGuard Policy CSP uses LsaCfgFlags value 0. Follow the organization’s normal policy deployment process.
See Microsoft’s configuration instructions and DeviceGuard Policy CSP reference for the applicable policy details.
Rank #2
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
Disable it through Group Policy
On a locally managed PC, open Local Group Policy Editor and go to Computer Configuration > Administrative Templates > System > Device Guard > Turn On Virtualization Based Security. Set the policy to Disabled, apply the change, and restart Windows.
If a domain Group Policy manages the PC, change the applicable domain policy rather than relying on a local edit. Microsoft’s Credential Guard configuration guidance describes the Group Policy path.
Rank #3
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
Disable it with registry values
Use this method only when the PC is not controlled by a policy you need to change and UEFI lock is not enabled. Editing the registry changes system security configuration. Back up the relevant settings first, and get organizational approval on a managed device.
- Open Registry Editor with administrative privileges, or use an equivalent elevated administrative process.
- At
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsa, setLsaCfgFlagsto DWORD0. - At
HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsDeviceGuard, setLsaCfgFlagsto DWORD0. - Restart Windows for the change to take effect.
Set the values to zero rather than deleting them; Microsoft warns that deleting them may not disable Credential Guard. If a policy controls the setting, change that policy instead. Registry edits do not remove UEFI lock.
Rank #4
- EFFORTLESS EVERYDAY PERFORMANCE: Powered by Intel Celeron N4020 processor and Windows 11 Home system, delivering reliable, low-power efficiency for daily tasks like document editing, email, online classes, and web browsing
- 15.6-INCH FULL HD DISPLAY: Enjoy immersive visuals on the 15.6" FHD (1920x1080) anti-glare screen with micro-edge bezels. Delivers clear details and comfortable viewing for long study sessions, working on spreadsheets, and video playback
- RESPONSIVE MULTITASKING & STORAGE: Built with 4GB LPDDR4 RAM and 128GB eMMC storage for smooth daily essential use. Expand your storage by up to 1TB via the integrated TF card slot to easily store movies, photos, and working files
- ADVANCED CONNECTIVITY: Outfitted with 2x Full-Featured Type-C ports for data transfer, fast charging, and dual-monitor output, alongside 2x USB 3.2 Gen1 ports and a 3.5mm audio jack for complete peripheral compatibility
- LIGHTWEIGHT & SILENT OPERATION: Slim and portable for effortless travel or commuting. Features a 1MP HD webcam for remote meetings, 38Wh battery with 45W Type-C fast charging, and a fanless silent design for peaceful work environments.
If UEFI lock is enabled
Do not treat the registry method as sufficient. With UEFI lock, the setting is persisted in EFI firmware variables. Microsoft’s procedure uses a boot-sequence change and SecConfig.efi; after restart, a prompt appears before Windows boots, and someone physically at the device must confirm the firmware change. That requirement makes this method unsuitable for a remote-only change.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Because the procedure depends on exact commands and firmware steps, follow Microsoft’s current instructions for disabling Credential Guard with UEFI lock rather than adapting commands from another configuration. If remote disablement is a requirement for future administration, Microsoft says to choose the enabled-without-lock option when configuring Credential Guard.
Best Value
- 【Efficient Performance】 Powered by Intel Core i3 processor (2 cores, 4 threads, up to 3.4GHz) with 12GB RAM and 256GB SSD. Handles multitasking, office software, online classes, and HD video streaming smoothly. Integrated Intel UHD Graphics 620
- Backlit Keyboard & Complete Package】Comes with a cool backlit keyboard. Comes with awebcam, dual stereo speakers (8Ω/1.0W each), DC charger, and user manual – ready for late-night studying, online classes, video conferencing, and daily productivity
- 【Vibrant Display】 15.6-inch Full HD (1920x1080) anti-glare screen with 16:9 aspect ratio delivers crisp images and vivid colors – perfect for studying, watching lectures, or entertainment. Thin-bezel design maximizes viewing area
- 【Fast Connectivity & Expansion】 Equipped with WiFi 6 (802.11ax) and Bluetooth 5.2 for stable, high-speed wireless. Features 3 x USB 3.0, HDMI 2.1, Type-C (supports PD3.0 fast charging), and a TF card slot expandable up to 2TB – easily connect external monitors, mice, drives, or expand storage for all your files
- 【Long Battery Life & Portable】 Built-in 11.55V 5000mAh/57.75Wh high-capacity battery delivers approximately 7 hours of mixed-use battery life – enough for a full day of classes and assignments. Lightweight at just 1.63kg (3.6 lbs) and 19.5mm thin, plus a compact packing size – easily slips into a backpack for campus, library, or coffee shop
Disable it in a Hyper-V virtual machine
For a Hyper-V virtual machine, Microsoft documents a host-side PowerShell method using Set-VMSecurity with -VirtualizationBasedSecurityOptOut $true. This is specific to Hyper-V; do not assume the same command applies to another hypervisor or a cloud VM service. Consult Microsoft’s virtual-machine configuration guidance for the exact usage and context.
Restart and verify the result
Restart after changing the applicable policy or registry configuration. Microsoft recommends checking Credential Guard status with System Information, PowerShell, or Event Viewer. The exact PowerShell command and event identifiers depend on Microsoft’s current guidance, so use the linked instructions rather than guessing. Microsoft specifically does not recommend using the presence or absence of LsaIso.exe in Task Manager as the verification method.
Quick Recap
If disabling does not take effect
- The setting returns after restart: an Intune/MDM or Group Policy configuration may still be applying it. Change the controlling policy and allow it to refresh.
- Registry values are zero but Credential Guard remains enabled: confirm that UEFI lock is not enabled. If it is, use the firmware procedure; ordinary registry changes are insufficient.
- You cannot complete the UEFI prompt: someone must be physically present to confirm it before Windows boots.
- You are trying to fix an application issue: disabling Credential Guard is not a guaranteed performance improvement or compatibility fix. Identify the affected app or workload and check its vendor documentation before removing this protection.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
