Windows10 credential protection features introduced and used

Cryptographic Protection in Windows 10
Credential Protection, as its name suggests, is primarily used to protect user credentials in Windows 10. Prior to Windows 10, the keys used by the operating system were stored in the LSA (local security authority); in Windows 10, the credential protection feature created an isolated virtual container to store credentials that were not directly accessible by the operating system. .

When hacking into the early Windows operating system, you can directly access the user credentials stored in the local memory by the algorithm. The operating system itself does not have much protection. In Windows 10 with credential protection enabled, credentials are stored in a virtual container. Starting with Windows 10 1511, credentials stored with the Credential Manager (including domain credentials) can also be placed under the protection of credential protection. This way, even if the system is compromised, the credentials cannot be easily taken.
In general, the credential protection feature in Windows 10 effectively protects a variety of user credential hashes, which greatly enhances the security level of the operating system.
Certificate Protection System Requirements
However, not all Windows 10 supports credential protection, which requires operating system versions and hardware:
Windows 10 Enterprise Edition only
Supports UEFI 2.3.1 Or higher and secure boot
support 64-bit virtualization (Intel VT-x or AMD-V and secondary address translation)
TPM 2.0 firmware
Enable credential protection
1 press Windows + X – Execute gpedit.msc on the fly to open the local group policy.
2Browse to the computer configuration – Administrative Template – System – Device Guard, double-click to open virtualization-based security.
3 Click "Enabled" to enable credential protection.
4 In the "Select platform security level" box, select "Safe Boot" or "Safe Boot and DMA Protection".

After you enable it, you can check whether the credential protection function is working properly in the System Summary of the msinfo32.exe tool: