deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-12 13:27:23 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity
windows-itpro-docs/windows/client-management/mdm/policy-csp-deviceguard.md
nimishasatapathy f14f6cad56 Updated
2021-08-11 14:02:14 +05:30

8.1 KiB
Raw Blame History

title, description, ms.author, ms.topic, ms.prod, ms.technology, author, ms.localizationpriority, ms.date, ms.reviewer, manager
title description ms.author ms.topic ms.prod ms.technology author ms.localizationpriority ms.date ms.reviewer manager
Policy CSP - DeviceGuard Learn how to use the Policy CSP - DeviceGuard setting to allow the IT admin to configure the launch of System Guard. dansimp article w10 windows manikadhiman medium 09/27/2019 dansimp

Policy CSP - DeviceGuard

DeviceGuard policies

DeviceGuard/ConfigureSystemGuardLaunch
DeviceGuard/EnableVirtualizationBasedSecurity
DeviceGuard/LsaCfgFlags
DeviceGuard/RequirePlatformSecurityFeatures

DeviceGuard/ConfigureSystemGuardLaunch

Windows Edition Supported?
Home cross mark
Pro cross mark
Business cross mark
Enterprise check mark5
Education check mark5

Scope:

[!div class = "checklist"]

  • Device

This policy allows the IT admin to configure the launch of System Guard.

Secure Launch configuration:

  • 0 - Unmanaged, configurable by Administrative user
  • 1 - Enables Secure Launch if supported by hardware
  • 2 - Disables Secure Launch.

For more information about System Guard, see Introducing Windows Defender System Guard runtime attestation and How a hardware-based root of trust helps protect Windows 10.

ADMX Info:

  • GP Friendly name: Turn On Virtualization Based Security
  • GP name: VirtualizationBasedSecurity
  • GP element: SystemGuardDrop
  • GP path: System/Device Guard
  • GP ADMX file name: DeviceGuard.admx

DeviceGuard/EnableVirtualizationBasedSecurity

Windows Edition Supported?
Home cross mark
Pro cross mark
Business cross mark
Enterprise check mark3
Education check mark3

Scope:

[!div class = "checklist"]

  • Device

Added in Windows 10, version 1709. Turns on virtualization based security(VBS) at the next reboot. virtualization based security uses the Windows Hypervisor to provide support for security services. Value type is integer.

ADMX Info:

  • GP Friendly name: Turn On Virtualization Based Security
  • GP name: VirtualizationBasedSecurity
  • GP path: System/Device Guard
  • GP ADMX file name: DeviceGuard.admx

The following list shows the supported values:

  • 0 (default) - disable virtualization based security.
  • 1 - enable virtualization based security.

DeviceGuard/LsaCfgFlags

Windows Edition Supported?
Home cross mark
Pro cross mark
Business cross mark
Enterprise check mark3
Education check mark3

Scope:

[!div class = "checklist"]

  • Device

Added in Windows 10, version 1709. This setting lets users turn on Credential Guard with virtualization-based security to help protect credentials at next reboot. Value type is integer.

ADMX Info:

  • GP Friendly name: Turn On Virtualization Based Security
  • GP name: VirtualizationBasedSecurity
  • GP element: CredentialIsolationDrop
  • GP path: System/Device Guard
  • GP ADMX file name: DeviceGuard.admx

The following list shows the supported values:

  • 0 (default) - (Disabled) Turns off Credential Guard remotely if configured previously without UEFI Lock.
  • 1 - (Enabled with UEFI lock) Turns on Credential Guard with UEFI lock.
  • 2 - (Enabled without lock) Turns on Credential Guard without UEFI lock.

DeviceGuard/RequirePlatformSecurityFeatures

Windows Edition Supported?
Home cross mark
Pro cross mark
Business cross mark
Enterprise check mark3
Education check mark3

Scope:

[!div class = "checklist"]

  • Device

Added in Windows 10, version 1709. Specifies the platform security level at the next reboot. Value type is integer.

ADMX Info:

  • GP Friendly name: Turn On Virtualization Based Security
  • GP name: VirtualizationBasedSecurity
  • GP element: RequirePlatformSecurityFeaturesDrop
  • GP path: System/Device Guard
  • GP ADMX file name: DeviceGuard.admx

The following list shows the supported values:

  • 1 (default) - Turns on VBS with Secure Boot.
  • 3 - Turns on VBS with Secure Boot and direct memory access (DMA). DMA requires hardware support.

Footnotes:

  • 1 - Available in Windows 10, version 1607.
  • 2 - Available in Windows 10, version 1703.
  • 3 - Available in Windows 10, version 1709.
  • 4 - Available in Windows 10, version 1803.
  • 5 - Available in Windows 10, version 1809.
  • 6 - Available in Windows 10, version 1903.
  • 7 - Available in Windows 10, version 1909.
  • 8 - Available in Windows 10, version 2004.