diff --git a/windows/security/operating-system-security/data-protection/bitlocker/includes/allow-standard-user-encryption.md b/windows/security/operating-system-security/data-protection/bitlocker/includes/allow-standard-user-encryption.md index 45e5397263..6ad7132b5e 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/includes/allow-standard-user-encryption.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/includes/allow-standard-user-encryption.md @@ -7,13 +7,13 @@ ms.topic: include ### Allow Standard User Encryption -With this policy you can enforce the *RequireDeviceEncryption* policy for scenarios where policy is pushed while current logged-on user is non-admin/standard user. +With this policy you can enforce the [*RequireDeviceEncryption*](../policy-settings.md?tabs=os#require-device-encryption) policy for scenarios where policy is applied while current logged-on user is non-admin/standard user. -*AllowStandardUserEncryption* policy is tied to [Allow warning for other disk encryption](#allow-warning-for-other-disk-encryption) policy being disabled (value `0`). +*AllowStandardUserEncryption* policy is tied to [Allow warning for other disk encryption](../policy-settings.md?tabs=os#allow-warning-for-other-disk-encryption) policy being disabled (value `0`). If *AllowWarningForOtherDiskEncryption* isn't set, or is set to `1`, *RequireDeviceEncryption* policy doesn't try to encrypt drive(s) if a standard user is logged-on. | | Path | |--|--| | **CSP** | `./Device/Vendor/MSFT/BitLocker/`[AllowStandardUserEncryption](/windows/client-management/mdm/bitlocker-csp#allowstandarduserencryption)| -| **GPO** | Not available | \ No newline at end of file +| **GPO** | Not available | diff --git a/windows/security/operating-system-security/data-protection/bitlocker/includes/disable-new-dma-devices-when-this-computer-is-locked.md b/windows/security/operating-system-security/data-protection/bitlocker/includes/disable-new-dma-devices-when-this-computer-is-locked.md index 467908e39a..f1835f9603 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/includes/disable-new-dma-devices-when-this-computer-is-locked.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/includes/disable-new-dma-devices-when-this-computer-is-locked.md @@ -7,7 +7,7 @@ ms.topic: include ### Disable new DMA devices when this computer is locked -This policy setting allows you to block direct memory access (DMA) for all Thunderbolt hot pluggable PCI downstream ports until a user logs into Windows. Once a user logs in, Windows will enumerate the PCI devices connected to the host Thunderbolt PCI ports. Every time the user locks the machine, DMA will be blocked on hot plug Thunderbolt PCI ports with no children devices, until the user logs in again. Devices which were already enumerated when the machine was unlocked will continue to function until unplugged or the system is rebooted or hibernated. This policy setting is only enforced when BitLocker or device encryption is enabled. Note: Some PCs may not be compatible with this policy if the system firmware enables DMA for newly attached Thunderbolt devices before exposing the new devices to Windows. +This policy allows blocking direct memory access (DMA) for all Thunderbolt hot pluggable PCI downstream ports until a user logs into Windows. Once a user logs in, Windows will enumerate the PCI devices connected to the host Thunderbolt PCI ports. Every time the user locks the machine, DMA will be blocked on hot plug Thunderbolt PCI ports with no children devices, until the user logs in again. Devices which were already enumerated when the machine was unlocked will continue to function until unplugged or the system is rebooted or hibernated. This policy setting is only enforced when BitLocker or device encryption is enabled. Note: Some PCs may not be compatible with this policy if the system firmware enables DMA for newly attached Thunderbolt devices before exposing the new devices to Windows. | | Path | |--|--|