diff --git a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md index 9eda4d82c8..943481d23b 100644 --- a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md +++ b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md @@ -28,15 +28,21 @@ For information about enabling Credential Guard, see [Protect derived domain cre ## Windows feature requirements for virtualization-based security -In addition to the hardware requirements found in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard), you must enable certain operating system features before you can enable VBS: Microsoft Hyper-V and isolated user mode (shown in Figure 1). +In addition to the hardware requirements found in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard), you must enable certain operating system features before you can enable VBS: + +- With Windows 10, version 1607 or Windows Server 2016:
+Hyper-V Hypervisor (shown in Figure 1). + +- With an earlier version of Windows 10, or Windows Server 2016 Technical Preview 5 or earlier:
+Hyper-V Hypervisor and Isolated User Mode (not shown). > **Note**  You can configure these features manually by using Windows PowerShell or Deployment Image Servicing and Management. For specific information about these methods, see [Protect derived domain credentials with Credential Guard](credential-guard.md).   ![Turn Windows features on or off](images/dg-fig1-enableos.png) -Figure 1. Enable operating system features for VBS +Figure 1. Enable operating system feature for VBS -After you enable these features, you can configure any additional hardware-based security features you want. The following sections provide more information: +After you enable the feature or features, you can configure any additional hardware-based security features you want. The following sections provide more information: - [Enable Unified Extensible Firmware Interface Secure Boot](#enable-unified-extensible-firmware-interface-secure-boot) - [Enable virtualization-based security for kernel-mode code integrity](#enable-virtualization-based-security-for-kernel-mode-code-integrity) @@ -44,7 +50,7 @@ After you enable these features, you can configure any additional hardware-based Before you begin this process, verify that the target device meets the hardware requirements for UEFI Secure Boot that are laid out in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). There are two options to configure UEFI Secure Boot: manual configuration of the appropriate registry keys and Group Policy deployment. Complete the following steps to manually configure UEFI Secure Boot on a computer running Windows 10. -> **Note**  There are two platform security levels for Secure Boot: stand-alone Secure Boot and Secure Boot with DMA protection. DMA protection provides additional memory protection but will be enabled only on systems whose processors include input/output memory management units (IOMMUs). Protection against driver-based attacks is provided only on systems that have IOMMUs and that have DMA protection enabled. +> **Note**  There are two platform security levels for Secure Boot: stand-alone Secure Boot and Secure Boot with DMA protection. DMA protection provides additional memory protection but will be enabled only on systems whose processors include input/output memory management units (IOMMUs). Protection against driver-based attacks is provided only on systems that have IOMMUs and that have DMA protection enabled. For more information about how IOMMUs help protect against DMA attacks, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats). 1. Navigate to the **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard** registry subkey. @@ -52,9 +58,9 @@ Before you begin this process, verify that the target device meets the hardware 3. Set the **RequirePlatformSecurityFeatures DWORD** value as appropriate: - - Set this value to **1** to enable the **Secure Boot** option. - - - Set this value to **2** to enable the **Secure Boot with DMA Protection** option. + | **With Windows 10, version 1607,
or Windows Server 2016** | **With an earlier version of Windows 10,
or Windows Server 2016 Technical Preview 5 or earlier** | + | ---------------- | ---------------- | + | **1** enables the **Secure Boot** option
**3** enables the **Secure Boot and DMA protection** option | **1** enables the **Secure Boot** option
**2** enables the **Secure Boot and DMA protection** option | 4. Restart the client computer. @@ -80,11 +86,11 @@ Unfortunately, it would be time consuming to perform these steps manually on eve Figure 6. Enable VBS -5. Select the **Enabled** option, and then select **Secure Boot and DMA Protection** from the **Select Platform Security Level** list. +5. Select the **Enabled** button, and then select **Secure Boot and DMA Protection** from the **Select Platform Security Level** list. ![Group Policy, Turn On Virtualization Based Security](images/device-guard-gp.png) - Figure 7. Enable Secure Boot + Figure 7. Enable Secure Boot (in Windows 10, version 1607) > **Note**  Device Guard Secure Boot is maximized when combined with DMA protection. If your hardware contains the IOMMUs required for DMA protection, be sure to select the **Secure Boot and DMA Protection** platform security level. If your hardware does not contain IOMMUs, there are several mitigations provided by leveraging Secure Boot without DMA Protection. @@ -102,7 +108,11 @@ Before you begin this process, verify that the desired computer meets the hardwa **To configure virtualization-based protection of KMCI manually:** -1. Navigate to the **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard** registry subkey. +1. Navigate to the appropriate registry subkey: + + - With Windows 10, version 1607, or Windows Server 2016:
**HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios** + + - With an earlier version of Windows 10, or Windows Server 2016 Technical Preview 5 or earlier:
**HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard** 2. Set the **HypervisorEnforcedCodeIntegrity DWORD** value to **1**. @@ -130,11 +140,15 @@ It would be time consuming to perform these steps manually on every protected co Figure 3. Enable VBS -5. Select the **Enabled** option, and then select the **Enable Virtualization Based Protection of Code Integrity** check box. +5. Select the **Enabled** button, and then for **Virtualization Based Protection of Code Integrity**, select the appropriate option: + + - With Windows 10, version 1607 or Windows Server 2016, choose an enabled option:
For an initial deployment or test deployment, we recommend **Enabled without UEFI lock**.
When your deployment is stable in your environment, we recommend changing to **Enabled with UEFI lock**. This option helps protect the registry from tampering, either through malware or by an unauthorized person. + + - With earlier versions of Windows 10, or Windows Server 2016 Technical Preview 5 or earlier:
Select the **Enable Virtualization Based Protection of Code Integrity** check box. ![Group Policy, Turn On Virtualization Based Security](images/dg-fig7-enablevbsofkmci.png) - Figure 4. Enable VBS of KMCI + Figure 4. Enable VBS of KMCI (in Windows 10, version 1607) 6. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. With this setting configured, the VBS of the KMCI will take effect upon restart. @@ -176,7 +190,12 @@ Table 1. Win32\_DeviceGuard properties

  • 1. If present, hypervisor support is available.

  • 2. If present, Secure Boot is available.

  • 3. If present, DMA protection is available.

    • - +

  • 4. If present, Secure Memory Overwrite is available.

    • +

  • 5. If present, NX protections are available.

    • +

  • 6. If present, SMM mitigations are available.

    • + +

    Note: 4, 5, and 6 were added as of Windows 10, version 1607.

    + InstanceIdentifier @@ -188,10 +207,15 @@ Table 1. Win32\_DeviceGuard properties This field describes the required security properties to enable virtualization-based security. +

  • 1. If present, hypervisor support is needed.

    • +

  • 2. If present, Secure Boot is needed.

    • +

  • 3. If present, DMA protection is needed.

    • +

  • 4. If present, Secure Memory Overwrite is needed.

    • +

  • 5. If present, NX protections are needed.

    • +

  • 6. If present, SMM mitigations are needed.

    • + +

    Note: 4, 5, and 6 were added as of Windows 10, version 1607.

    + SecurityServicesConfigured diff --git a/windows/keep-secure/images/device-guard-gp.png b/windows/keep-secure/images/device-guard-gp.png index 0c2c1c9d4f..c6713c2bf3 100644 Binary files a/windows/keep-secure/images/device-guard-gp.png and b/windows/keep-secure/images/device-guard-gp.png differ diff --git a/windows/keep-secure/images/dg-fig1-enableos.png b/windows/keep-secure/images/dg-fig1-enableos.png index cefb124344..a114c520de 100644 Binary files a/windows/keep-secure/images/dg-fig1-enableos.png and b/windows/keep-secure/images/dg-fig1-enableos.png differ diff --git a/windows/keep-secure/images/dg-fig11-dgproperties.png b/windows/keep-secure/images/dg-fig11-dgproperties.png index ce16705d0f..3c93b2b948 100644 Binary files a/windows/keep-secure/images/dg-fig11-dgproperties.png and b/windows/keep-secure/images/dg-fig11-dgproperties.png differ diff --git a/windows/keep-secure/images/dg-fig7-enablevbsofkmci.png b/windows/keep-secure/images/dg-fig7-enablevbsofkmci.png index bf0d55dd7f..5672f1c1f0 100644 Binary files a/windows/keep-secure/images/dg-fig7-enablevbsofkmci.png and b/windows/keep-secure/images/dg-fig7-enablevbsofkmci.png differ