Detections
Analytics

1.126 WN11-CC-000070

Information

Virtualization-based Security must be enabled on Windows 11 with the platform security level configured to Secure Boot or Secure Boot with DMA Protection.

GROUP ID: V-253369
RULE ID: SV-253369r991589

Virtualization-based Security (VBS) provides the platform for the additional security features, Credential Guard and virtualization-based protection of code integrity. Secure Boot is the minimum security level with DMA protection providing additional memory protection. DMA Protection requires a CPU that supports input/output memory management unit (IOMMU).

Solution

Virtualization-based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop.

For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA.

Configure the policy value for

Computer Configuration >> Administrative Templates >> System >> Device Guard >> 'Turn On virtualization-based Security'

to 'Enabled' with 'Secure Boot' or 'Secure Boot and DMA Protection' selected for 'Select Platform Security Level:'.

A Microsoft article on Credential Guard system requirement can be found at the following link.
https://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard-requirements

See Also

https://workbench.cisecurity.org/benchmarks/27756

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Rule-ID|SV-253369r991589_rule, STIG-ID|WN11-CC-000070, Vuln-ID|V-253369

Plugin: Windows

Control ID: b008062231c583ae8e8d36178ef4c5058269584c8df57edf9a83720f0f3668d2