Citrix Endpoint Management

Device Guard device policy

August 26, 2019

Contributed by:

Device Guard is a Windows 10 security feature that enables virtualization-based security by using the Windows Hypervisor to support security services on the device. The Device Guard policy enables security features such as secure boot, UEFI lock, and virtualization.

Prerequisites

Windows 10 Desktops and Tablets with an Enterprise or Education license on version 1709 (RS3)
Device Guard enabled in Windows

For more information on Device Guard, see https://docs.microsoft.com/en-us/windows/access-protection/credential-guard/credential-guard-manage.

To add or configure this policy, go to Configure > Device Policies. For more information, see Device policies.

Windows Desktop and Tablet settings

Device Policies configuration screen

Enable Virtualization Based Security: Disable or Enable virtualization based security features. Virtualization based security uses the Windows Hypervisor to support security services.
LSA Configuration Flags: Allows you to configure Credential Guard. This setting lets users turn on Credential Guard with virtualization-based security to help protect credentials at next reboot. Options are Off, On with UEFI Lock, and On without UEFI Lock. Default is Off.
Require Platform Security Features: Specifies the platform security level at the next reboot. Options are Off, VBS with Secure Boot, and VBS with Secure Boot and direct memory access (DMA). Default is Off.

Endpoint Management queries a device to determine if the virtualization based security settings match the settings on the server. If the security settings match, Endpoint Management doesn’t deploy this policy to the device. If the security settings don’t match, Endpoint Management deploys the policy.

The official version of this content is in English. Some of the Citrix documentation content is machine translated for your convenience only. Citrix has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Citrix product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Citrix, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Citrix will not be held responsible for any damage or issues that may arise from using machine-translated content.

Device Guard device policy

August 26, 2019

Contributed by:

August 26, 2019

Contributed by:

Device Guard device policy

Prerequisites

Windows Desktop and Tablet settings

In this article