---
title: Platform - Kernal & Virtualization
slug: platform-kernal-and-virtualization
docTags: 
createdAt: 2026-10-15T01:16:41.357Z
---

# Enterprise

***

## ESM Security Setting - System Guard Policy

**Description**: \[coming soon]

**Why It's Important**: \[coming soon]

**Learn More**

- \[coming soon]

***

# Privileged

***

## PSM Security Setting - System Guard Launch Policy

**Description**: Secure Launch configuration: 0 - Unmanaged, configurable by Administrative user, 1 - Enables Secure Launch if supported by hardware, 2 - Disables Secure Launch.

**Why It's Important**: This policy enables System Guard Secure Launch when supported by the device’s hardware. Secure Launch helps protect the system’s boot process from firmware-level attacks by using hardware-based verification to ensure only trusted, signed components are loaded. It establishes a trusted computing base at startup, preventing malicious code from compromising the boot environment or the hypervisor.

**Learn More**

- [DeviceGuard Policy CSP | Configure System Guide Launch](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deviceguard?WT.mc_id=Portal-fx#configuresystemguardlaunch)

***

## PSM Device Guard Settings - Enable Virtualization Based Security

**Description**: Turns On Virtualization Based Security (VBS).

**Why It's Important**: This policy enables Virtualization-Based Security (VBS), which uses the Windows hypervisor to isolate critical security processes from the operating system. VBS helps protect credentials, kernel memory, and system integrity from malware and advanced attacks by running sensitive operations in a secure, hardware-backed environment.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Platform Security Features Policy

**Description**: Select Platform Security Level: 1 - Turns on VBS with Secure Boot, 3 - Turns on VBS with Secure Boot and DMA. DMA requires hardware support.

**Why It's Important**: This policy enforces platform-level hardware security by enabling Secure Boot and DMA protection alongside VBS. Secure Boot ensures only trusted firmware and operating system components load during startup, while DMA protection blocks unauthorized devices from accessing system memory. Together, they provide robust protection against firmware-level and memory-based attacks.

**Learn More**

- \[coming soon]

***

## PSM Security Setting - Hypervisor Enforced Code Integrity Policy

**Description**: Hypervisor-Protected Code Integrity: 0 - Turns off Hypervisor-Protected Code Integrity remotely if configured previously without UEFI Lock, 1 - Turns on Hypervisor-Protected Code Integrity with UEFI lock, 2 - Turns on Hypervisor-Protected Code Integrity without UEFI lock.

**Why It's Important**: This policy enables Hypervisor-Enforced Code Integrity (HVCI) with a UEFI lock, ensuring that only trusted and signed code runs in kernel mode. By enforcing integrity through virtualization, it prevents rootkits, kernel exploits, and unauthorized drivers from executing, providing strong system-level protection even against sophisticated attacks.

**Learn More**

- \[coming soon]