How to Stop Credential Theft on Your Windows PC

Why Credential Theft Targets Windows Users

Every day, attackers use phishing emails, malicious downloads, and memory-scraping tools to steal usernames and passwords from Windows PCs. Once they have your credentials, they can access your email, bank accounts, cloud storage, and corporate systems — often without triggering any obvious alarm.

Windows stores credentials in several places: the browser's built-in password manager, the Windows Credential Manager, LSASS memory, and cached domain credentials. Each of these is a potential target. The good news is that a handful of practical steps can dramatically reduce your exposure.

Step 1: Enable Windows Credential Guard

Credential Guard isolates LSASS (Local Security Authority Subsystem Service) in a virtualization-based security container, making it much harder for tools like Mimikatz to dump password hashes from memory.

To check whether Credential Guard is active, open PowerShell as Administrator and run:

Get-ComputerInfo | Select-Object -Property DeviceGuard*

Look for DeviceGuardSecurityServicesRunning — if it includes CredentialGuard, you are protected. If not, enable it through Group Policy:

Note: Credential Guard requires Windows 11 Enterprise or Pro (64-bit), a UEFI firmware with Secure Boot, and hardware virtualization support.

Step 2: Audit and Clean Up Windows Credential Manager

Windows Credential Manager stores saved passwords for websites, network shares, and applications. Attackers who gain local access can read these entries.

To review what is stored:

You can also list all stored credentials from the command line:

cmdkey /list

To delete a specific entry:

cmdkey /delete:<target-name>

Keep only the credentials you actively use and understand.

Step 3: Use a Dedicated Password Manager

Browser-built-in password managers (Chrome, Edge, Firefox) store credentials in files that are readable by any process running under your user account. A dedicated password manager like Bitwarden or KeePass encrypts your vault with a master password and keeps it separate from the browser's storage.

Why this matters

If you switch to a dedicated password manager, disable the browser's built-in save-password feature:

Step 4: Enable Multi-Factor Authentication Everywhere

Even if an attacker steals your password, multi-factor authentication (MFA) stops them from logging in. Enable MFA on:

Use an authenticator app (Microsoft Authenticator, Google Authenticator) rather than SMS codes — SIM-swapping attacks can intercept text messages.

Step 5: Restrict NTLM and Cached Domain Credentials

On domain-joined PCs, Windows caches the last 10 domain logons by default so you can log in when the domain controller is unreachable. These cached hashes are stored in the registry and can be cracked offline.

To reduce the cache size to 1 (the minimum that still allows offline login):

You can also disable NTLM authentication entirely if your environment supports Kerberos:

Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options → Network security: Restrict NTLM: NTLM authentication in this domain → Deny all

Test carefully in a lab environment before applying this to production systems.

Step 6: Keep Windows and Drivers Updated

Many credential-theft exploits target unpatched vulnerabilities in Windows components. Run Windows Update regularly and check for driver updates through Device Manager or your hardware manufacturer's site.

To check your current patch status quickly:

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

This lists the 10 most recently installed patches with their dates.

Step 7: Run a Full Diagnostic to Spot Hidden Threats

Credential-stealing malware often runs silently in the background, hiding in startup entries, scheduled tasks, or browser extensions. A thorough diagnostic can surface these threats before they cause damage.

DiagnoseMyPc makes this easy: upload a screenshot of suspicious behavior, paste the output of a PowerShell command, or run the optional Windows scan tool to collect system data automatically. DiagnoseMyPc analyzes the results and flags unusual startup items, suspicious processes, and misconfigured security settings — giving you a clear action list instead of raw log files.

The free plan includes 5 analyses per month, which is enough to run a check after any suspicious event and again after you have applied fixes.

Putting It All Together

Credential theft succeeds when attackers find an easy path — an unpatched system, a saved password in the browser, or an account without MFA. Closing these gaps does not require advanced expertise:

If you are unsure whether your PC is already compromised, start with a diagnostic. DiagnoseMyPc can analyze your system configuration and highlight the security gaps that matter most, so you can fix the right things first.