16 KiB
title, description, keywords, ms.prod, ms.mktglfcycl, author
| title | description | keywords | ms.prod | ms.mktglfcycl | author |
|---|---|---|---|---|---|
| Deploy Device Guard - enable virtualization-based security (Windows 10) | This article describes how to enable virtualization-based security, one of the main features that are part of Device Guard in Windows 10. | virtualization, security, malware | w10 | deploy | brianlic-msft |
Deploy Device Guard: enable virtualization-based security
Applies to
- Windows 10
- Windows Server 2016
Hardware-based security features, also called virtualization-based security or VBS, make up a large part of Device Guard security offerings. VBS reinforces the most important feature of Device Guard: configurable code integrity. There are three steps to configure hardware-based security features in Device Guard:
-
Verify that hardware and firmware requirements are met. Verify that your client computers possess the necessary hardware and firmware to run these features. A list of requirements for hardware-based security features is available in Hardware, firmware, and software requirements for Device Guard.
-
Enable the necessary Windows features. There are several ways to enable the Windows features required for hardware-based security. For details, see the following section, Windows feature requirements for virtualization-based security.
-
Enable additional features as desired. When the necessary Windows features have been enabled, you can enable additional hardware-based security features as desired. For more information, see the following sections in this topic:
For information about enabling Credential Guard, see Protect derived domain credentials with Credential Guard.
Windows feature requirements for virtualization-based security
In addition to the hardware requirements found in Hardware, firmware, and software requirements for Device Guard, you must enable certain operating system features before you can enable VBS: Microsoft Hyper-V and isolated user mode (shown in Figure 1).
Note
You can configure these features manually by using Windows PowerShell or Deployment Image Servicing and Management. For specific information about these methods, see Protect derived domain credentials with Credential Guard.
Figure 1. Enable operating system features for VBS
After you enable these features, you can configure any additional hardware-based security features you want. The following sections provide more information:
- Enable Unified Extensible Firmware Interface Secure Boot
- Enable virtualization-based security for kernel-mode code integrity
Enable Unified Extensible Firmware Interface Secure Boot
Before you begin this process, verify that the target device meets the hardware requirements for UEFI Secure Boot that are laid out in Hardware, firmware, and software requirements for Device Guard. There are two options to configure UEFI Secure Boot: manual configuration of the appropriate registry keys and Group Policy deployment. Complete the following steps to manually configure UEFI Secure Boot on a computer running Windows 10.
Note
There are two platform security levels for Secure Boot: stand-alone Secure Boot and Secure Boot with DMA protection. DMA protection provides additional memory protection but will be enabled only on systems whose processors include input/output memory management units (IOMMUs). Protection against driver-based attacks is provided only on systems that have IOMMUs and that have DMA protection enabled.
-
Navigate to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard registry subkey.
-
Set the EnableVirtualizationBasedSecurity DWORD value to 1.
-
Set the RequirePlatformSecurityFeatures DWORD value as appropriate:
-
Set this value to 1 to enable the Secure Boot option.
-
Set this value to 2 to enable the Secure Boot with DMA Protection option.
-
-
Restart the client computer.
Unfortunately, it would be time consuming to perform these steps manually on every protected computer in your enterprise. Group Policy offers a much simpler way to deploy UEFI Secure Boot to your organization. This example creates a test organizational unit (OU) called DG Enabled PCs. If you want, you can instead link the policy to an existing OU, and then scope the GPO by using appropriately named computer security groups.
Note
We recommend that you test-enable this feature on a group of test computers before you deploy it to users' computers.
Use Group Policy to deploy Secure Boot
-
To create a new GPO, right-click the OU to which you want to link the GPO, and then click Create a GPO in this domain, and Link it here.
Figure 5. Create a new OU-linked GPO
-
Give the new GPO a name, for example, Contoso Secure Boot GPO Test, or any name you prefer. Ideally, the name will align with your existing GPO naming convention.
-
Open the Group Policy Management Editor: right-click the new GPO, and then click Edit.
-
Within the selected GPO, navigate to Computer Configuration\Administrative Templates\System\Device Guard. Right-click Turn On Virtualization Based Security, and then click Edit.
Figure 6. Enable VBS
-
Select the Enabled option, and then select Secure Boot and DMA Protection from the Select Platform Security Level list.
Figure 7. Enable Secure Boot
Note
Device Guard Secure Boot is maximized when combined with DMA protection. If your hardware contains the IOMMUs required for DMA protection, be sure to select the Secure Boot and DMA Protection platform security level. If your hardware does not contain IOMMUs, there are several mitigations provided by leveraging Secure Boot without DMA Protection.
-
Close the Group Policy Management Editor, and then restart the Windows 10 test computer. After you configure this setting, UEFI Secure Boot will be enabled upon restart.
-
Check the test computer’s event log for Device Guard GPOs.
Processed Device Guard policies are logged in event viewer at Applications and Services Logs\Microsoft\Windows\DeviceGuard-GPEXT\Operational. When the Turn On Virtualization Based Security policy is successfully processed, event ID 7000 is logged, which contains the selected settings within the policy.
Enable virtualization-based security for kernel-mode code integrity
Before you begin this process, verify that the desired computer meets the hardware requirements for VBS found in Hardware, firmware, and software requirements for Device Guard, and enable the Windows features discussed in the Windows feature requirements for virtualization-based security section. When validated, you can enable virtualization-based protection of KMCI in one of two ways: manual configuration of the appropriate registry subkeys and Group Policy deployment.
Note
All drivers on the system must be compatible with virtualization-based protection of code integrity; otherwise, your system may fail. We recommend that you enable this feature on a group of test computers before you enable it on users' computers.
To configure virtualization-based protection of KMCI manually:
-
Navigate to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard registry subkey.
-
Set the HypervisorEnforcedCodeIntegrity DWORD value to 1.
-
Restart the client computer.
It would be time consuming to perform these steps manually on every protected computer in your enterprise. Instead, use Group Policy to deploy virtualization-based protection of KMCI. This example creates a test OU called DG Enabled PCs, which you will use to link the GPO. If you prefer to link the policy to an existing OU rather than create a test OU and scope the policy by using appropriately named computer security groups, that is another option.
Note
We recommend that you test-enable this feature on a group of test computers before you deploy it to users' computers. If untested, there is a possibility that this feature can cause system instability and ultimately cause the client operating system to fail.
To use Group Policy to configure VBS of KMCI:
-
Create a new GPO: Right-click the OU to which you want to link the GPO, and then click Create a GPO in this domain, and Link it here.
Figure 2. Create a new OU-linked GPO
-
Give the new GPO a name, for example, Contoso VBS CI Protection GPO Test, or any name you prefer. Ideally, the name will align with your existing GPO naming convention.
-
Open the Group Policy Management Editor: Right-click the new GPO, and then click Edit.
-
Within the selected GPO, navigate to Computer Configuration\Administrative Templates\System\Device Guard. Right-click Turn On Virtualization Based Security, and then click Edit.
Figure 3. Enable VBS
-
Select the Enabled option, and then select the Enable Virtualization Based Protection of Code Integrity check box.
Figure 4. Enable VBS of KMCI
-
Close the Group Policy Management Editor, and then restart the Windows 10 test computer. With this setting configured, the VBS of the KMCI will take effect upon restart.
-
Check the test client event log for Device Guard GPOs.
Processed Device Guard policies are logged in event viewer under Applications and Services Logs\Microsoft\Windows\DeviceGuard-GPEXT\Operational. When the Turn On Virtualization Based Security policy has been successfully processed, event ID 7000 is logged, which contains the selected settings within the policy.
Validate enabled Device Guard hardware-based security features
Windows 10 and Windows Server 2016 and later have a WMI class for Device Guard–related properties and features: Win32_DeviceGuard. This class can be queried from an elevated Windows PowerShell session by using the following command:
Get-CimInstance –ClassName Win32_DeviceGuard –Namespace root\Microsoft\Windows\DeviceGuard
Note
The Win32_DeviceGuard WMI class is only available on the Enterprise edition of Windows 10.
The output of this command provides details of the available hardware-based security features as well as those features that are currently enabled. For detailed information about what each property means, refer to Table 1.
Table 1. Win32_DeviceGuard properties
| Properties | Description | Valid values |
|---|---|---|
| AvailableSecurityProperties | This field helps to enumerate and report state on the relevant security properties for Device Guard. |
|
| InstanceIdentifier | A string that is unique to a particular device. | Determined by WMI. |
| RequiredSecurityProperties | This field describes the required security properties to enable virtualization-based security. |
|
| SecurityServicesConfigured | This field indicates whether the Credential Guard or HVCI service has been configured. |
|
| SecurityServicesRunning | This field indicates whether the Credential Guard or HVCI service is running. |
|
| Version | This field lists the version of this WMI class. | The only valid value now is 1.0. |
| VirtualizationBasedSecurityStatus | This field indicates whether VBS is enabled and running. |
|
| PSComputerName | This field lists the computer name. | All valid values for computer name. |
Another method to determine the available and enabled Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Device Guard properties are displayed at the bottom of the System Summary section, as shown in Figure 11.
Figure 11. Device Guard properties in the System Summary