Description: [coming soon]

Why It's Important: [coming soon]

Learn More

Description: Secure Launch configuration: 0 - Unmanaged, configurable by Administrative user, 1 - Enables Secure Launch if supported by hardware, 2 - Disables Secure Launch.

Why It's Important: This policy enables System Guard Secure Launch when supported by the device’s hardware. Secure Launch helps protect the system’s boot process from firmware-level attacks by using hardware-based verification to ensure only trusted, signed components are loaded. It establishes a trusted computing base at startup, preventing malicious code from compromising the boot environment or the hypervisor.

Learn More

Description: Turns On Virtualization Based Security (VBS).

Why It's Important: This policy enables Virtualization-Based Security (VBS), which uses the Windows hypervisor to isolate critical security processes from the operating system. VBS helps protect credentials, kernel memory, and system integrity from malware and advanced attacks by running sensitive operations in a secure, hardware-backed environment.

Learn More

Description: Select Platform Security Level: 1 - Turns on VBS with Secure Boot, 3 - Turns on VBS with Secure Boot and DMA. DMA requires hardware support.

Why It's Important: This policy enforces platform-level hardware security by enabling Secure Boot and DMA protection alongside VBS. Secure Boot ensures only trusted firmware and operating system components load during startup, while DMA protection blocks unauthorized devices from accessing system memory. Together, they provide robust protection against firmware-level and memory-based attacks.

Learn More

Description: Hypervisor-Protected Code Integrity: 0 - Turns off Hypervisor-Protected Code Integrity remotely if configured previously without UEFI Lock, 1 - Turns on Hypervisor-Protected Code Integrity with UEFI lock, 2 - Turns on Hypervisor-Protected Code Integrity without UEFI lock.

Why It's Important: This policy enables Hypervisor-Enforced Code Integrity (HVCI) with a UEFI lock, ensuring that only trusted and signed code runs in kernel mode. By enforcing integrity through virtualization, it prevents rootkits, kernel exploits, and unauthorized drivers from executing, providing strong system-level protection even against sophisticated attacks.

Learn More