Citrix Endpoint Management

Device Health Attestation device policy

March 6, 2024

Contributed by:

K C

In Citrix Endpoint Management, you can require Windows 10 and Windows 11 devices to report the state of their health. To report their health state, devices send specific data and runtime information to the Health Attestation Service (HAS) for analysis. The HAS creates and returns a Health Attestation Certificate that the device then sends to Citrix Endpoint Management. Citrix Endpoint Management uses the contents of the Health Attestation Certificate to deploy automatic actions that you have set up.

The data verified by the HAS are:

AIK Present
BitLocker Status
Boot Debugging Enabled
Boot Manager Rev List Version
Code Integrity Enabled
Code Integrity Rev List Version
Apple Deployment Program Policy
ELAM Driver Loaded
Issued At
Kernel Debugging Enabled
PCR
Reset Count
Restart Count
Safe Mode Enabled
SBCP Hash
Secure Boot Enabled
Test Signing Enabled
VSM Enabled
WinPE Enabled

For more information, refer to the Microsoft Device HealthAttestation CSP page.

You can configure DHA by using Microsoft Cloud or an on-premises Windows DHA server, as follows:

To configure DHA by using Microsoft Cloud: Add a Device Health Attestation policy and configure it as described in this article.
To configure DHA by using an on-premises Windows DHA server: Configure a DHA server. Then, add a Device Health Attestation policy and configure it as described in this article.

To configure a DHA server, you install the DHA server role on a machine running Windows Server 2016 Technical Preview 5 or later. For instructions, see Configure an on-premises Device Heath Attestation server.

To add or configure this policy, go to Configure > Device Policies. For more information, see Device policies.

Windows Desktop/Tablet settings

If you configure DHA by using Microsoft Cloud

Enable Device Health Attestation: Select whether to require Device Health Attestation. The default is Off.

If you configure DHA by using an on-premises Windows DHA server

Enable Device Health Attestation: Set to On.
Configure On-prem Health Attestation Service: Set to On.
On-prem DHA Service FQDN: Type the fully qualified domain name of the DHA server that you set up.
On-prem DHA API version: Select the version of the DHA service installed on the DHA server.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Device Health Attestation device policy

March 6, 2024

Contributed by:

K C

March 6, 2024

Contributed by:

K C

Device Health Attestation device policy

Windows Desktop/Tablet settings

If you configure DHA by using Microsoft Cloud

If you configure DHA by using an on-premises Windows DHA server

In this article