From dc63e23408a55038ee5a223fc6fd5ba9db6d2eb2 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 14 Oct 2021 18:24:39 -0700 Subject: [PATCH] Add blank lines for consistent layout --- ...nable-virtualization-based-protection-of-code-integrity.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md index d75271bcad..a19ca85753 100644 --- a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md @@ -54,8 +54,11 @@ Enabling in Intune requires using the Code Integrity node in the [AppLocker CSP] ### Enable HVCI using Group Policy 1. Use Group Policy Editor (gpedit.msc) to either edit an existing GPO or create a new one. + 2. Navigate to **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard**. + 3. Double-click **Turn on Virtualization Based Security**. + 4. Click **Enabled** and under **Virtualization Based Protection of Code Integrity**, select **Enabled with UEFI lock** to ensure HVCI cannot be disabled remotely or select **Enabled without UEFI lock**. ![Enable HVCI using Group Policy.](../images/enable-hvci-gp.png) @@ -301,6 +304,7 @@ reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorE ``` 1. Restart the device. + 1. To confirm HVCI has been successfully disabled, open System Information and check **Virtualization-based security Services Running**, which should now have no value displayed. ## HVCI deployment in virtual machines