Citrix Endpoint Management

Device Guard device policy

September 9, 2021

Contributed by:

C K

Device Guard is a security feature available with Windows 10 and Windows 11. This feature enables virtualization-based security by using the Windows Hypervisor to support security services on the device. The Device Guard policy enables security features such as secure boot, UEFI lock, and virtualization.

Prerequisites

Windows 10 and Windows 11 Desktops and Tablets with an Enterprise or Education license
Device Guard enabled in Windows

For more information on Device Guard, see https://docs.microsoft.com/en-us/windows/access-protection/credential-guard/credential-guard-manage.

To add or configure this policy, go to Configure > Device Policies. For more information, see Device policies.

Windows Desktop and Tablet settings

Device Policies configuration screen

Enable virtualization-based security: Disable or enable virtualization-based security features. Virtualization-based security uses the Windows Hypervisor to support security services.
Configure LSA protection: Lets you configure Credential Guard. This setting lets users turn on Credential Guard with virtualization-based security to help protect credentials on the next restart. Options are Turns off Credential Guard, Turns on Credential Guard with UEFI lock, and Turns on Credential Guard without UEFI lock. Default is Turns off Credential Guard.
Specify platform security level: Lets you specify the platform security level on the next restart. Options are Turns on VBS with Secure Boot and Turns on VBS with Secure Boot and direct memory access. Default is Turns on VBS with Secure Boot.

Endpoint Management queries a device to determine whether the virtualization based security settings match the settings on the server. If the security settings match, Endpoint Management doesn’t deploy this policy to the device. If the security settings don’t match, Endpoint Management deploys the policy.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Device Guard device policy

September 9, 2021

Contributed by:

C K

September 9, 2021

Contributed by:

C K

Device Guard device policy

Prerequisites

Windows Desktop and Tablet settings

In this article