Forum Discussion
Kernal DMA Protection in dell inspiron 14 5405
You don't need Kernel DMA Protection for Device Guard.
What you need is:
- 64-bit CPU
- SLAT
- IOMMU (Intel-VT-D or AMD-Vi)
- TPM 2.0
- SMM Protection (Firmware)
- UEFI Memory Reporting
- MOR2
- HVCI compatible drivers
That said, I'm not sure if your AMD CPU even supports Device Guard. It should support virtualization, and I'm not firm with AMD CPUs for enterprise usage. According to AMD they support all Secure-Core-PC features (among those Device Guard) with their AMD Pro series of processort:
https://www.amd.com/en/technologies/pro-security
Also Credential Guard needs Windows 10 Enterprise. You cannot use it with Windows 10 Pro. You can still use Device Guard (though you may have to do some pre-configuration on a different Windows 10 Enterprise installation) and you can use VBS with or without HVCI.
To answer your other questions more directly:
- kernel DMA protection is an additional hardware feature and protects especially from DMA-device security issues (PCIe, Thunderbolt,...). It needs support from your hardware (CPU, Mainboard, Firmware) to work and is not tied to device guard or credential guard. It needs VBS to work correctly, but it is not needed for VBS.
- coreinfo gives you wrong information because when you run a hypervisor some queries are not returned correctly from the CPU. Make sure you run coreinfo in and administrative prompt, but even then, all the virtualization informations are not reliable when virtualization is running.
- I'm not sure if you really want device guard (a collection of features that prevents code from running on your machine) or if you just want VBS.
SecurityServicesRunning : {1, 2}
This means that credential guard (1) and HVCI (2) is running too.
So you already have VBS, Credential Guard and HVCI running correctly.
Be aware that credential guard only protects domain credentials! It does not protect any other credentials, like for example, local accounts. So if you want to use CG, make sure that you use only domain accounts and block any creation or usage of local accounts.
