BitLocker: Device and Memory Protection¶

Encryption protects a drive that's powered off. When the machine is running or asleep, the encryption key is in memory, and there are two ways to get it out: plug in a device that can read memory directly (a DMA attack over Thunderbolt or FireWire), or catch the machine in a sleep state where memory is still powered. The BitLocker profile closes both.

Where¶

gpedit.msc → Computer Configuration → Administrative Templates → System.

Block DMA-capable devices¶

CIS	Setting	Path	Set to	Why
18.9.24.1	Enumeration policy for external devices incompatible with Kernel DMA Protection	System → Kernel DMA Protection	Enabled: Block All	External devices that can't prove they're safe for direct memory access are blocked entirely. Modern Thunderbolt docks work; a memory-reading attack tool doesn't.
18.9.7.1.1	Prevent installation of devices using drivers that match these device setup classes	System → Device Installation → Device Installation Restrictions	Enabled	Turns on the class block list
18.9.7.1.2	Same policy: device setup classes	Add the four IEEE 1394 (FireWire) class GUIDs (below)	FireWire has unrestricted memory access by design
18.9.7.1.3	Same policy: Also apply to matching devices that are already installed	True (checked)	Removes FireWire controllers that are already present

The four GUIDs to add:

{d48179be-ec20-11d1-b6b8-00c04fa372a7}
{7ebefbc0-3200-11d2-b4c2-00a0C9697d07}
{c06ff265-ae09-48f0-812c-16753d7cba83}
{6bdd1fc1-810f-11d0-bec7-08002be2092f}

No standby sleep¶

In S1 through S3 sleep, RAM stays powered and the BitLocker key stays in it. Hibernate (S4) writes memory to the encrypted disk and powers off. So: no standby.

CIS	Setting	Path	Set to
18.9.35.6.3	Allow standby states (S1-S3) when sleeping (on battery)	System → Power Management → Sleep Settings	Disabled
18.9.35.6.4	Allow standby states (S1-S3) when sleeping (plugged in)	System → Power Management → Sleep Settings	Disabled

The machine will hibernate instead of sleeping. Slower to wake, but the key isn't sitting in memory.

Apply¶

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection" /v DeviceEnumerationPolicy /t REG_DWORD /d 0 /f

One worked example; the rest are in the table. Type each reg add yourself (the syntax is on The Command Line) and read it back with reg query "<key>" /v <name> before moving on:

Key	Value	Type	Data
`HKLM\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection`	`DeviceEnumerationPolicy`	REG_DWORD	`0`
`HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions`	`DenyDeviceClasses`	REG_DWORD	`1`
`HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions`	`DenyDeviceClassesRetroactive`	REG_DWORD	`1`
`HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses`	`1`	REG_SZ	`"{d48179be-ec20-11d1-b6b8-00c04fa372a7}"`
`HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses`	`2`	REG_SZ	`"{7ebefbc0-3200-11d2-b4c2-00a0C9697d07}"`
`HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses`	`3`	REG_SZ	`"{c06ff265-ae09-48f0-812c-16753d7cba83}"`
`HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses`	`4`	REG_SZ	`"{6bdd1fc1-810f-11d0-bec7-08002be2092f}"`
`HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab`	`DCSettingIndex`	REG_DWORD	`0`
`HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab`	`ACSettingIndex`	REG_DWORD	`0`

DeviceEnumerationPolicy 0 is "Block All."

Verify¶

reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection" /v DeviceEnumerationPolicy
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses"
reg query "HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab"

Try it¶

Set the DMA and device installation values and read them back.
Find the device setup class GUIDs the benchmark names and match each to a device type.

Build it¶

Finish bitlocker.bat with these rows and a reg query of the FVE key.

Next¶

Windows Update