diff --git a/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md b/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md index 1404209dea..10b4f41000 100644 --- a/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md +++ b/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md @@ -1,15 +1,11 @@ --- title: How a Windows Defender System Guard helps protect Windows 10 description: Windows Defender System Guard reorganizes the existing Windows 10 system integrity features under one roof. Learn how it works. -ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.reviewer: manager: aaroncz ms.author: vinpa search.appverid: met150 ms.prod: windows-client -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft ms.date: 03/01/2019 @@ -87,7 +83,15 @@ After the system boots, Windows Defender System Guard signs and seals these meas ## System requirements for System Guard -|For Intel® vPro™ processors starting with Intel® Coffeelake, Whiskeylake, or later silicon|Description| +This feature is available for the following processors: + +- Intel® vPro™ processors starting with Intel® Coffeelake, Whiskeylake, or later silicon +- AMD® processors starting with Zen2 or later silicon +- Qualcomm® processors with SD850 or later chipsets + +### Requirements for Intel® vPro™ processors starting with Intel® Coffeelake, Whiskeylake, or later silicon + +|Name|Description| |--------|-----------| |64-bit CPU|A 64-bit computer with minimum four cores (logical processors) is required for hypervisor and virtualization-based security (VBS). For more information about Hyper-V, see [Hyper-V on Windows Server 2016](/windows-server/virtualization/hyper-v/hyper-v-on-windows-server) or [Introduction to Hyper-V on Windows 10](/virtualization/hyper-v-on-windows/about/). For more information about hypervisor, see [Hypervisor Specifications](/virtualization/hyper-v-on-windows/reference/tlfs).| |Trusted Platform Module (TPM) 2.0|Platforms must support a discrete TPM 2.0. Integrated/firmware TPMs aren't supported, except Intel chips that support Platform Trust Technology (PTT), which is a type of integrated hardware TPM that meets the TPM 2.0 spec.| @@ -101,7 +105,9 @@ After the system boots, Windows Defender System Guard signs and seals these meas |Platform firmware|Platform firmware must carry all code required to execute an Intel® Trusted Execution Technology secure launch: | |Platform firmware update|System firmware is recommended to be updated via UpdateCapsule in Windows Update. | -|For AMD® processors starting with Zen2 or later silicon|Description| +### Requirements for AMD® processors starting with Zen2 or later silicon + +|Name|Description| |--------|-----------| |64-bit CPU|A 64-bit computer with minimum four cores (logical processors) is required for hypervisor and virtualization-based security (VBS). For more information about Hyper-V, see [Hyper-V on Windows Server 2016](/windows-server/virtualization/hyper-v/hyper-v-on-windows-server) or [Introduction to Hyper-V on Windows 10](/virtualization/hyper-v-on-windows/about/). For more information about hypervisor, see [Hypervisor Specifications](/virtualization/hyper-v-on-windows/reference/tlfs).| |Trusted Platform Module (TPM) 2.0|Platforms must support a discrete TPM 2.0 OR Microsoft Pluton TPM.| @@ -113,7 +119,9 @@ After the system boots, Windows Defender System Guard signs and seals these meas |Platform firmware|Platform firmware must carry all code required to execute Secure Launch:
Platform must have AMD® Secure Processor Firmware Anti-Rollback protection enabled
Platform must have AMD® Memory Guard enabled.| |Platform firmware update|System firmware is recommended to be updated via UpdateCapsule in Windows Update. | -|For Qualcomm® processors with SD850 or later chipsets|Description| +### Requirements for Qualcomm® processors with SD850 or later chipsets + +|Name|Description| |--------|-----------| |Monitor Mode Communication|All Monitor Mode communication buffers must be implemented in either EfiRuntimeServicesData (recommended), data sections of EfiRuntimeServicesCode as described by the Memory Attributes Table, EfiACPIMemoryNVS, or EfiReservedMemoryType memory types| |Monitor Mode Page Tables|All Monitor Mode page tables must: |