Device Guard device policy 编辑

Device Guard is a security feature available with Windows 10 and Windows 11. This feature enables virtualization-based security by using the Windows Hypervisor to support security services on the device. The Device Guard policy enables security features such as secure boot, UEFI lock, and virtualization.

Prerequisites

• Windows 10 and Windows 11 Desktops and Tablets with an Enterprise or Education license

• Device Guard enabled in Windows

  For more information on Device Guard, see https://docs.microsoft.com/en-us/windows/access-protection/credential-guard/credential-guard-manage.

To add or configure this policy, go to Configure > Device Policies. For more information, see Device policies.

Windows Desktop and Tablet settings

• Enable virtualization-based security: Disable or enable virtualization-based security features. Virtualization-based security uses the Windows Hypervisor to support security services.
• Configure LSA protection: Lets you configure Credential Guard. This setting lets users turn on Credential Guard with virtualization-based security to help protect credentials on the next restart. Options are Turns off Credential Guard, Turns on Credential Guard with UEFI lock, and Turns on Credential Guard without UEFI lock. Default is Turns off Credential Guard.
• Specify platform security level: Lets you specify the platform security level on the next restart. Options are Turns on VBS with Secure Boot and Turns on VBS with Secure Boot and direct memory access. Default is Turns on VBS with Secure Boot.

Endpoint Management queries a device to determine whether the virtualization based security settings match the settings on the server. If the security settings match, Endpoint Management doesn’t deploy this policy to the device. If the security settings don’t match, Endpoint Management deploys the policy.