Citrix Endpoint Management

Device Guard device policy

Device Guard is a security feature available with Windows 10 and Windows 11. This feature enables virtualization-based security by using the Windows Hypervisor to support security services on the device. The Device Guard policy enables security features such as secure boot, UEFI lock, and virtualization.


To add or configure this policy, go to Configure > Device Policies. For more information, see Device policies.

Windows Desktop and Tablet settings

Device Policies configuration screen

  • Enable virtualization-based security: Disable or enable virtualization-based security features. Virtualization-based security uses the Windows Hypervisor to support security services.
  • Configure LSA protection: Lets you configure Credential Guard. This setting lets users turn on Credential Guard with virtualization-based security to help protect credentials on the next restart. Options are Turns off Credential Guard, Turns on Credential Guard with UEFI lock, and Turns on Credential Guard without UEFI lock. Default is Turns off Credential Guard.
  • Specify platform security level: Lets you specify the platform security level on the next restart. Options are Turns on VBS with Secure Boot and Turns on VBS with Secure Boot and direct memory access. Default is Turns on VBS with Secure Boot.

Citrix Endpoint Management queries a device to determine whether the virtualization-based security settings match the settings on the server. If the security settings match, Citrix Endpoint Management doesn’t deploy this policy to the device. If the security settings don’t match, Citrix Endpoint Management deploys the policy.

Device Guard device policy