BitLocker: Device and Memory Protection¶
Encryption protects a drive that's powered off. When the machine is running or asleep, the encryption key is in memory, and there are two ways to get it out: plug in a device that can read memory directly (a DMA attack over Thunderbolt or FireWire), or catch the machine in a sleep state where memory is still powered. The BitLocker profile closes both.
Where¶
gpedit.msc → Computer Configuration → Administrative Templates → System.
Block DMA-capable devices¶
| CIS | Setting | Path | Set to | Why |
|---|---|---|---|---|
| 18.9.24.1 | Enumeration policy for external devices incompatible with Kernel DMA Protection | System → Kernel DMA Protection | Enabled: Block All | External devices that can't prove they're safe for direct memory access are blocked entirely. Modern Thunderbolt docks work; a memory-reading attack tool doesn't. |
| 18.9.7.1.1 | Prevent installation of devices using drivers that match these device setup classes | System → Device Installation → Device Installation Restrictions | Enabled | Turns on the class block list |
| 18.9.7.1.2 | Same policy: device setup classes | Add the four IEEE 1394 (FireWire) class GUIDs (below) | FireWire has unrestricted memory access by design | |
| 18.9.7.1.3 | Same policy: Also apply to matching devices that are already installed | True (checked) | Removes FireWire controllers that are already present |
The four GUIDs to add:
{d48179be-ec20-11d1-b6b8-00c04fa372a7}
{7ebefbc0-3200-11d2-b4c2-00a0C9697d07}
{c06ff265-ae09-48f0-812c-16753d7cba83}
{6bdd1fc1-810f-11d0-bec7-08002be2092f}
No standby sleep¶
In S1 through S3 sleep, RAM stays powered and the BitLocker key stays in it. Hibernate (S4) writes memory to the encrypted disk and powers off. So: no standby.
| CIS | Setting | Path | Set to |
|---|---|---|---|
| 18.9.35.6.3 | Allow standby states (S1-S3) when sleeping (on battery) | System → Power Management → Sleep Settings | Disabled |
| 18.9.35.6.4 | Allow standby states (S1-S3) when sleeping (plugged in) | System → Power Management → Sleep Settings | Disabled |
The machine will hibernate instead of sleeping. Slower to wake, but the key isn't sitting in memory.
Apply¶
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection" /v DeviceEnumerationPolicy /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions" /v DenyDeviceClasses /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions" /v DenyDeviceClassesRetroactive /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses" /v 1 /t REG_SZ /d "{d48179be-ec20-11d1-b6b8-00c04fa372a7}" /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses" /v 2 /t REG_SZ /d "{7ebefbc0-3200-11d2-b4c2-00a0C9697d07}" /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses" /v 3 /t REG_SZ /d "{c06ff265-ae09-48f0-812c-16753d7cba83}" /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses" /v 4 /t REG_SZ /d "{6bdd1fc1-810f-11d0-bec7-08002be2092f}" /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab" /v DCSettingIndex /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab" /v ACSettingIndex /t REG_DWORD /d 0 /f
DeviceEnumerationPolicy 0 is "Block All."
Verify¶
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Kernel DMA Protection" /v DeviceEnumerationPolicy
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses"
reg query "HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab"