deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-18 00:07:23 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity
windows-itpro-docs/windows/client-management/mdm/policy-csp-dmaguard.md

4.0 KiB
Raw Blame History

title, description, ms.author, ms.topic, ms.prod, ms.technology, author, ms.localizationpriority, ms.date, ms.reviewer, manager
title description ms.author ms.topic ms.prod ms.technology author ms.localizationpriority ms.date ms.reviewer manager
Policy CSP - DmaGuard Learn how to use the Policy CSP - DmaGuard setting to provide additional security against external DMA capable devices. dansimp article w10 windows manikadhiman medium 09/27/2019 dansimp

Policy CSP - DmaGuard

DmaGuard policies

DmaGuard/DeviceEnumerationPolicy

DmaGuard/DeviceEnumerationPolicy

Windows Edition Supported?
Home cross mark
Pro check mark5
Business check mark5
Enterprise check mark5
Education check mark5

Scope:

[!div class = "checklist"]

  • Device

This policy is intended to provide additional security against external DMA capable devices. It allows for more control over the enumeration of external DMA capable devices incompatible with DMA Remapping/device memory isolation and sandboxing.

Device memory sandboxing allows the OS to leverage the I/O Memory Management Unit (IOMMU) of a device to block unallowed I/O, or memory access, by the peripheral. In other words, the OS assigns a certain memory range to the peripheral. If the peripheral attempts to read/write to memory outside of the assigned range, the OS blocks it.

This policy only takes effect when Kernel DMA Protection is supported and enabled by the system firmware. Kernel DMA Protection is a platform feature that cannot be controlled via policy or by end user. It has to be supported by the system at the time of manufacturing. To check if the system supports Kernel DMA Protection, please check the Kernel DMA Protection field in the Summary page of MSINFO32.exe.

Note

This policy does not apply to 1394/Firewire, PCMCIA, CardBus, or ExpressCard devices.

Supported values:

0 - Block all (Most restrictive): Devices with DMA remapping compatible drivers will be allowed to enumerate at any time. Devices with DMA remapping incompatible drivers will never be allowed to start and perform DMA at any time.

1 - Only after log in/screen unlock (Default): Devices with DMA remapping compatible drivers will be allowed to enumerate at any time. Devices with DMA remapping incompatible drivers will only be enumerated after the user unlocks the screen

2 - Allow all (Least restrictive): All external DMA capable PCIe devices will be enumerated at any time

ADMX Info:

  • GP English name: Enumeration policy for external devices incompatible with Kernel DMA Protection
  • GP name: DmaGuardEnumerationPolicy
  • GP path: System/Kernel DMA Protection
  • GP ADMX file name: dmaguard.admx

Footnotes:

  • 1 - Available in Windows 10, version 1607.
  • 2 - Available in Windows 10, version 1703.
  • 3 - Available in Windows 10, version 1709.
  • 4 - Available in Windows 10, version 1803.
  • 5 - Available in Windows 10, version 1809.
  • 6 - Available in Windows 10, version 1903.
  • 7 - Available in Windows 10, version 1909.
  • 8 - Available in Windows 10, version 2004.