Credential Guard Local Security Authority (lsass.exe) Process Isolation Crash

Dear Micheal Brown,

When enabling Virtualization-Based Security and Credential Guard, the KERNEL_SECURITY_CHECK_FAILURE you’re seeing is almost always tied to a driver that is not compatible with the LSA Isolated User Mode (IUM). Smart card middleware and custom drivers are particularly sensitive because they must run inside the isolated LSA process. The correct way to isolate incompatibilities is to enable Driver Verifier specifically against the smart card driver stack, using verifier /driver <driver.sys> /flags 0x1 /volatile to catch illegal memory or IRQL usage inside IUM. You should also review the LSA logs under Applications and Services Logs → Microsoft → Windows → Kernel-Isolation-UserMode to see which driver is faulting.

If the crashes consistently point to the smart card driver, you will need to obtain an updated build from the vendor that is signed for IUM compatibility. Microsoft’s guidance is that only drivers compiled with the proper Isolated User Mode APIs and tested under VBS can be loaded safely. Until the vendor provides a compliant driver, the only workaround is to disable Credential Guard or exclude the driver from IUM, but that reduces security. The best practice is to run Driver Verifier, capture the dump, and escalate to the vendor with the exact violation so they can rebuild the driver for VBS environments.

If my answer is useful for you, please hit Accept the answer to support me.

Thank you,

Domic.