Description: Turns on the infrared camera feature on supported devices, which is commonly used for facial recognition and secure sign-in.

Why It's Important: This policy enables infrared cameras to support Windows Hello for Business, allowing SHIELD to enforce secure, biometric authentication for privileged access.

Learn More

Description: [coming soon]

Why It's Important: This policy disables rear cameras, helping SHIELD reduce the risk of unauthorized image capture, data leakage, or surveillance in sensitive environments.

Learn More

Description: [coming soon]

Why It's Important: This policy disables microphones on devices, helping SHIELD prevent data leakage, and unauthorized audio capture in sensitive environments.

Learn More

Description: Allows users to change only those UEFI (firmware) settings that haven’t already been locked or configured by IT.

Why It's Important: This policy blocks local users from altering UEFI settings, ensuring SHIELD preserves secure boot, firmware integrity, and other critical protections against tampering.

Learn More

Description: This setting disables the device’s ability to boot from any external storage, including USB drives and SD cards, at the UEFI firmware level. When enforced through DFCI, Windows cannot start from removable media, blocking unauthorized operating systems, unsigned bootloaders, or malicious tools from being used to bypass SHIELD’s security controls.

Why It's Important: This policy disables booting from external media, preventing attackers from bypassing SHIELD protections with rogue USB or SD devices and ensuring startup occurs only from trusted sources.

Learn More

Description: This setting disables the device’s ability to boot from PXE or other network‑based boot sources at the UEFI firmware level. When applied through DFCI, the device will only boot from locally authorized media, preventing Windows from initiating startup over wired or wireless network adapters.

Why It's Important: This policy disables booting from network adapters, preventing attackers from bypassing local security controls and helping SHIELD ensure devices only start from trusted sources.

Learn More

Description: [coming soon]

Why It's Important: This policy enables cameras when required, allowing SHIELD to support secure features like Windows Hello for Business while keeping video access under centralized control.

Learn More

Description: This setting disables the device’s built‑in SD card interface at the firmware level using DFCI. When applied, Windows cannot detect or interact with SD card hardware, preventing users from reading, writing, or booting from removable SD storage.

Why It's Important: This policy disables SD card ports, helping SHIELD prevent data exfiltration and malware introduction through removable media.

Learn More

Description: [coming soon]

Why It's Important: This policy disables Bluetooth, helping SHIELD prevent unauthorized wireless connections that could be exploited for data exfiltration or device compromise.

Learn More

Description: [coming soon]

Why It's Important: This policy disables NFC on devices, helping SHIELD reduce the attack surface by preventing unauthorized proximity-based connections or data exchanges.

Learn More

Description: [coming soon]

Why It's Important: This policy enables required radios, ensuring SHIELD devices can securely use approved wireless functions while maintaining centralized control and monitoring.

Learn More

Description: [coming soon]

Why It's Important: Why is it important: This policy enables Wi-Fi to ensure SHIELD-managed devices can securely connect to corporate networks while remaining under centralized control.

Learn More

Description: Turns on virtualization features in the device’s firmware, allowing the computer to support advanced functions like running virtual machines or isolating certain processes for better security and performance.

Why It's Important: This policy enables CPU and I/O virtualization, allowing SHIELD to enforce virtualization-based security features like Credential Guard and Hyper-V isolation for stronger endpoint protection.

Learn More

Description: Allows the computer’s processor to run multiple tasks at the same time using separate threads, improving performance and responsiveness.

Why It's Important: This policy disables simultaneous multithreading, helping SHIELD reduce exposure to side-channel attacks that can exploit shared CPU resources.

Learn More

Description: Disables a firmware feature called WPBT (Windows Platform Binary Table), which allows Windows to load software from the device’s firmware during startup.

Why It's Important: This policy disables the Windows Platform Binary Table (WPBT), preventing SHIELD devices from loading untrusted vendor binaries at startup that could be abused for persistence or tampering.

Learn More

Description: [coming soon]

Why It's Important: This policy disables Wake on LAN, preventing attackers from remotely powering on devices and helping SHIELD reduce the risk of unauthorized access or tampering outside approved sessions.

Learn More

Description: [coming soon]

Why It's Important: This policy disables wake on power, helping SHIELD reduce unauthorized or unintended device startups that could expose systems to physical or remote attacks.

Learn More

Description: Require UEFI Memory Attributes Table.

Why It's Important: This policy enforces the presence of a UEFI Memory Attributes Table to validate memory protections required for Virtualization-Based Security (VBS). It ensures the hypervisor and operating system can accurately verify memory regions’ read, write, and execute permissions, reducing the risk of memory-based exploits and ensuring full compatibility with secure boot configurations.

Learn More