In Citrix Endpoint Management
In All products
Product Documentation
In Citrix Endpoint Management
In All products
View PDF

Device Guard device policy

August 26, 2019
Contributed by:  C

Device Guard is a Windows 10 security feature that enables virtualization-based security by using the Windows Hypervisor to support security services on the device. The Device Guard policy enables security features such as secure boot, UEFI lock, and virtualization.

Prerequisites

To add or configure this policy, go to Configure > Device Policies. For more information, see Device policies.

Windows Desktop and Tablet settings

Device Policies configuration screen

  • Enable Virtualization Based Security: Disable or Enable virtualization based security features. Virtualization based security uses the Windows Hypervisor to support security services.
  • LSA Configuration Flags: Allows you to configure Credential Guard. This setting lets users turn on Credential Guard with virtualization-based security to help protect credentials at next reboot. Options are Off, On with UEFI Lock, and On without UEFI Lock. Default is Off.
  • Require Platform Security Features: Specifies the platform security level at the next reboot. Options are Off, VBS with Secure Boot, and VBS with Secure Boot and direct memory access (DMA). Default is Off.

Endpoint Management queries a device to determine if the virtualization based security settings match the settings on the server. If the security settings match, Endpoint Management doesn’t deploy this policy to the device. If the security settings don’t match, Endpoint Management deploys the policy.

Device Guard device policy

August 26, 2019
Contributed by:  C

In this article

Edit this article