Table of Contents
Why Won’t Microsoft Fix the Alarming Windows 11 Credential Leak, and How Can You Protect Yourself Now?
A security feature in Windows 11 and Windows Server 2025, called Credential Guard, has a significant flaw. This feature is meant to protect your login information. However, security researchers found a way to bypass it. Attackers can steal your system credentials, and Microsoft has stated it will not release a fix for this issue.
Understanding Credential Theft
Attackers often try to steal login details, a process known as credential dumping. They take this information from a computer’s memory. The goal is to gain control over user accounts. Once they have these credentials, they can move through a network, accessing secure files and systems. This is a common and effective method hackers use to deepen their breach into a network.
The Promise of Credential Guard
Microsoft created Credential Guard to stop this type of theft. It targets attacks against the Local Security Authority Subsystem Service (LSASS), which is where Windows stores login information. Credential Guard works by using virtualization to create a secure, isolated container for the LSASS process. This container is designed to be inaccessible, even to users with the highest system privileges. This isolation protects the login information inside, preventing it from being dumped.
How the Security Feature Fails
Despite these protections, researchers at SpecterOps discovered a method to defeat Credential Guard. Their report from October 2025 shows how an attacker can abuse a feature called Remote Credential Guard. This trick forces the system to give up an older type of credential hash known as NTLMv1. An attacker can then use this hash to recover the user’s login information. This attack works on the most secure and fully updated versions of Windows 11 and Windows Server 2025.
Microsoft was notified of the problem in August 2025. The company reproduced the attack and confirmed it works. However, in September 2025, Microsoft closed the case and marked the issue as something they would not fix. The researchers have since published a tool that demonstrates how the attack is performed.
How to Protect Your System
Since Microsoft is not providing a patch, you must take steps to protect your network. The primary weakness exploited by this attack involves an outdated protocol.
- Disable NTLMv1. This is the most direct action you can take. Modern systems do not require it, and disabling it closes the security hole used in this attack.
- Enforce NTLMv2. Ensure your environment only uses the more secure NTLMv2 protocol for authentication.
- Enable multi-factor authentication (MFA). Even if an attacker steals a credential hash, MFA provides an additional layer of security that prevents them from logging in.
- Monitor network activity. Keep a close watch for unusual authentication requests or signs of lateral movement within your network.