An administrator needs to enable Windows Defender Credential Guard to comply with company policy. The new VM configurations include: Legacy BIOS 4 vCPUs 8 GB RAM Windows Server 2019 What must be changed in order to properly enable Windows Defender Credential Guard?

Windows Defender Credential Guard is a Virtualization-Based Security (VBS) feature that isolates secrets to protect them from theft. A fundamental prerequisite for enabling VBS and Credential Guard on a guest virtual machine is the use of UEFI firmware. The current VM configuration specifies Legacy BIOS, which does not provide the necessary security architecture, such as Secure Boot, that VBS relies upon to create and protect the isolated LSA process. Therefore, the VM's firmware must be changed from Legacy BIOS to UEFI, and Secure Boot must be enabled to meet the requirements for Credential Guard.

A. Update vCPU to 8. VBS requires a minimum of 2 vCPUs. The existing configuration of 4 vCPUs is sufficient and does not need to be changed.
C. Use Windows Server 2022. Windows Server 2019 is a fully supported operating system for Windows Defender Credential Guard. An upgrade is not necessary.
D. Update Memory to 16GB. While VBS consumes a small amount of system memory, 8 GB of RAM is adequate for a Windows Server VM. There is no specific 16 GB requirement.

1. Nutanix AHV Administration Guide (AOS 6.5): In the "Security Management" section, under "Virtualization-Based Security (VBS) for Guest VMs," the guide states, "To enable VBS on a guest VM, ensure that the guest VM has UEFI firmware." This confirms the primary requirement for enabling features like Credential Guard on Nutanix AHV.

2. Microsoft Docs, "Manage Windows Defender Credential Guard": In the section "Hardware and software requirements," the documentation explicitly lists "UEFI, version 2.3.1 or later, with Secure Boot" as a mandatory firmware requirement. This applies to both physical and virtual machines.

3. Nutanix University, Nutanix Hybrid Cloud Fundamentals Course: The "AHV Virtual Machine Management" module explains that advanced security features, including vTPM and VBS, are only available for VMs configured with UEFI firmware, not Legacy BIOS.