Device Guard device policy

Device Guard is a Windows 10 security feature that enables virtualization-based security by using the Windows Hypervisor to support security services on the device. The Device Guard policy enables security features such as secure boot, UEFI lock, and virtualization.

Prerequisites

• Windows 10 Desktops and Tablets with an Enterprise or Education license on version 1709 (RS3)

• Device Guard enabled in Windows

  For more information on Device Guard, see https://docs.microsoft.com/en-us/windows/access-protection/credential-guard/credential-guard-manage.

To add or configure this policy, go to Configure > Device Policies. For more information, see Device policies.

Windows Desktop and Tablet settings

• Enable Virtualization Based Security: Disable or Enable virtualization based security features. Virtualization based security uses the Windows Hypervisor to support security services.
• LSA Configuration Flags: Allows you to configure Credential Guard. This setting lets users turn on Credential Guard with virtualization-based security to help protect credentials at next reboot. Options are Off, On with UEFI Lock, and On without UEFI Lock. Default is Off.
• Require Platform Security Features: Specifies the platform security level at the next reboot. Options are Off, VBS with Secure Boot, and VBS with Secure Boot and direct memory access (DMA). Default is Off.

Endpoint Management queries a device to determine if the virtualization based security settings match the settings on the server. If the security settings match, Endpoint Management doesn’t deploy this policy to the device. If the security settings don’t match, Endpoint Management deploys the policy.