[REQ-PAW-011] Harden DMA and Physical Security for PAWs

Target Scope

  • Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration. (For Domain Controllers, refer to REQ-DC-158; for Tier 2 Client Workstations and Member Servers, refer to REQ-END-017).
  • Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise.

Implementation Details

  • Priority: High
  • GPO Paths / Registry Locations:
    • GPO Paths:
      • Computer Configuration\Administrative Templates\System\Power Management\Sleep Settings
      • Computer Configuration\Administrative Templates\System\Device Installation\Device Installation Restrictions
      • Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption
      • Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives
      • Computer Configuration\Administrative Templates\System\Kernel DMA Protection
    • Registry Locations:
      • HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab
        • ACSettingIndex = 0 (REG_DWORD, Disables standby plugged in)
        • DCSettingIndex = 0 (REG_DWORD, Disables standby on battery)
      • HKLM\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51
        • ACSettingIndex = 1 (REG_DWORD, Require password when computer wakes plugged in)
        • DCSettingIndex = 1 (REG_DWORD, Require password when computer wakes on battery)
      • HKLM\SOFTWARE\Policies\Microsoft\FVE
        • DisableExternalDMAUnderLock = 1 (REG_DWORD)
        • RDVDenyCrossOrg = 0 (REG_DWORD)
      • HKLM\System\CurrentControlSet\Policies\Microsoft\FVE
        • RDVDenyWriteAccess = 1 (REG_DWORD)
      • HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions
        • DenyDeviceClasses = 1 (REG_DWORD)
        • DenyDeviceClassesRetroactive = 1 (REG_DWORD)
        • DenyDeviceIDs = 1 (REG_DWORD)
        • DenyDeviceIDsRetroactive = 1 (REG_DWORD)
      • HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses
        • 1 = {d48179be-ec20-11d1-b6b8-00c04fa372a7} (REG_SZ, SBP-2 device setup class)
        • 2 = {6bdd1fc1-810f-11d0-bec7-08002be2092f} (REG_SZ, IEEE 1394 host controller setup class)
      • HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs
        • 1 = PCI\CC_0C0A (REG_SZ, Blocks Thunderbolt 1, 2, and 3 controllers)
        • 2 = PCI\CC_0C0010 (REG_SZ, Blocks IEEE 1394 OHCI compliant Firewire controllers)
        • 3 = PCI\CC_0607 (REG_SZ, Blocks PCI CardBus bridges)
        • 4 = PCI\CC_0605 (REG_SZ, Blocks PCI-to-PCMCIA bridges)
      • HKLM\SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection
        • DeviceEnumerationPolicy = 0 (REG_DWORD, Block all)

Rationale

Privileged Access Workstations (PAWs) represent Tier 0 boundary systems. Because they handle the highest levels of domain authorization, physical threat vectors must be mitigated to the absolute maximum threshold:

  1. Direct Memory Access (DMA) Defenses: External interfaces (e.g., Thunderbolt, USB4, PCIe ExpressCard, FireWire) allow attached devices to bypass the OS kernel and read physical RAM contents directly via high-speed buses. Attackers use physical DMA exploitation devices (such as PCILeech) to dump memory-resident Kerberos TGT tickets, NTLM hashes, and LSA secrets:
    • Device Setup Class Blocking: Disabling the SBP-2 setup class ({d48179be-ec20-11d1-b6b8-00c04fa372a7}) and the IEEE 1394 host controller class ({6bdd1fc1-810f-11d0-bec7-08002be2092f}) prevents Windows from binding drivers to FireWire storage and controllers.
    • Hardware ID Blocking: Explicitly blocking hardware IDs PCI\CC_0C0A (Thunderbolt), PCI\CC_0C0010 (1394 OHCI FireWire), PCI\CC_0607 (CardBus), and PCI\CC_0605 (PCMCIA) halts driver installation for unauthorized high-speed expansion buses at the PCI enumeration layer.
    • BitLocker DMA Under Lock: Enforcing DisableExternalDMAUnderLock blocks DMA device operations whenever the PAW workstation is locked, closing the physical window for drive-by attacks on unattended stations.
    • Tightened Enumeration Policy on PAWs: While standard enterprise endpoints might permit external DMA after user authentication, PAWs enforce a strict Block all policy (DeviceEnumerationPolicy = 0). External peripherals whose drivers do not natively support DMA-remapping isolation are permanently prevented from accessing system memory.
  2. Cold Boot Exploits & RAM Decay: Dynamic RAM retains memory contents for seconds or minutes following power loss, especially when cooled with aerosol duster or liquid nitrogen. In standard standby states (S1-S3), the RAM chips remain continuously powered and active. If a PAW is stolen or accessed while in standby, BitLocker master keys and volatile credentials can be read directly from memory. Disabling standby states forces the system to either remain active or transition to Hibernation (S4)/Shutdown, where RAM contents are encrypted on the BitLocker volume and protected by the TPM 2.0 PCR baseline. Enforcing a password on resume guarantees re-authentication upon wake.
  3. USB Exfiltration Protection: Restricting write access on removable drives (RDVDenyWriteAccess) ensures administrative materials, directory backups, or sensitive credentials cannot be copied to unencrypted USB media. Setting RDVDenyCrossOrg = 0 prevents cross-organization removable storage exemptions.

Legacy Impact & Compatibility

  • Standby and Resume: Standby states (S1-S3) are disabled. PAWs will hibernate when closed or idle. Resuming from hibernation requires a full TPM validation, Secure Boot check, and pre-boot PIN verification, which adds a few seconds during startup.
  • External Device Blocking: External expansion devices requiring direct DMA (such as external GPUs, specialized expansion chassis, legacy docks, or FireWire adapters) are blocked. Administrators must connect certified peripherals that support IOMMU DMA remapping or use native motherboard connections.
  • Removable Storage Restrictions: Administrative files cannot be written to unencrypted USB flash drives. File distribution must proceed through authorized internal administrative shares or dedicated deployment infrastructure.

Implementation Steps

Option A: Group Policy Object (GPO) Configuration (Preferred)

  1. Open the Group Policy Management Console (gpmc.msc).
  2. Edit the PAW GPO (e.g., GPO_Hardening_PAW).
  3. Configure the following settings:

1. Power Management (Disable Standby & Require Wake Password)

Navigate to: Computer Configuration\Administrative Templates\System\Power Management\Sleep Settings

  • Policy: Allow standby states (S1-S3) when sleeping (plugged in) -> Disabled
  • Policy: Allow standby states (S1-S3) when sleeping (on battery) -> Disabled
  • Policy: Require a password when a computer wakes (plugged in) -> Enabled
  • Policy: Require a password when a computer wakes (on battery) -> Enabled

2. BitLocker Removable Storage & DMA

Navigate to: Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption

  • Policy: Disable new DMA devices when this computer is locked -> Enabled

Navigate to: Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives

  • Policy: Deny write access to removable drives not protected by BitLocker -> Enabled
    • Check Do not allow write access to devices configured in another organization -> Disabled (value 0 / False)

3. Device Installation Restrictions (Block SBP-2, 1394, Thunderbolt, and PCI Bridges)

Navigate to: Computer Configuration\Administrative Templates\System\Device Installation\Device Installation Restrictions

  • Policy: Prevent installation of devices using drivers that match these device setup classes -> Enabled
    • Click Show... and enter:
      • {d48179be-ec20-11d1-b6b8-00c04fa372a7}
      • {6bdd1fc1-810f-11d0-bec7-08002be2092f}
    • Check Also apply to matching devices that are already installed -> Enabled (value 1 / True)
  • Policy: Prevent installation of devices that match any of these device IDs -> Enabled
    • Click Show... and enter:
      • PCI\CC_0C0A
      • PCI\CC_0C0010
      • PCI\CC_0607
      • PCI\CC_0605
    • Check Also apply to matching devices that are already installed -> Enabled (value 1 / True)

4. Kernel DMA Protection (Block All)

Navigate to: Computer Configuration\Administrative Templates\System\Kernel DMA Protection

  • Policy: Enable Kernel DMA Protection -> Enabled
    • Enumeration policy: Set to Block all (value 0)

Option B: PowerShell & Registry Configuration (Remediation / Non-GPO)

Run the following scripts locally on the PAW to apply DMA, Sleep, Device Restriction, and BitLocker USB registry parameters.

Download Script: Set-PawDMAPhysicalSecurity.ps1

# Set-PawDMAPhysicalSecurity.ps1
# Description: Hardens local registry keys on PAWs to mitigate DMA attacks, disable standby sleep states, enforce wake password, restrict device classes/IDs, and block unencrypted USB writing.

Write-Host "Applying PAW DMA and physical security hardening..." -ForegroundColor Cyan

# 1. Disable Standby Sleep States (S1-S3)
$SleepPath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab"
if (-not (Test-Path $SleepPath)) {
    New-Item -Path $SleepPath -Force | Out-Null
}
Set-ItemProperty -Path $SleepPath -Name "ACSettingIndex" -Value 0 -Type DWord
Set-ItemProperty -Path $SleepPath -Name "DCSettingIndex" -Value 0 -Type DWord
Write-Host "[+] Standby sleep states (S1-S3) disabled." -ForegroundColor Green

# 2. Configure Wake Password Requirement
$WakePath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51"
if (-not (Test-Path $WakePath)) {
    New-Item -Path $WakePath -Force | Out-Null
}
Set-ItemProperty -Path $WakePath -Name "ACSettingIndex" -Value 1 -Type DWord
Set-ItemProperty -Path $WakePath -Name "DCSettingIndex" -Value 1 -Type DWord
Write-Host "[+] Wake password requirement enforced." -ForegroundColor Green

# 3. BitLocker DMA and Removable Storage Settings
$FvePath = "HKLM:\SOFTWARE\Policies\Microsoft\FVE"
if (-not (Test-Path $FvePath)) {
    New-Item -Path $FvePath -Force | Out-Null
}
Set-ItemProperty -Path $FvePath -Name "DisableExternalDMAUnderLock" -Value 1 -Type DWord
Set-ItemProperty -Path $FvePath -Name "RDVDenyCrossOrg" -Value 0 -Type DWord

$FvePolicyPath = "HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE"
if (-not (Test-Path $FvePolicyPath)) {
    New-Item -Path $FvePolicyPath -Force | Out-Null
}
Set-ItemProperty -Path $FvePolicyPath -Name "RDVDenyWriteAccess" -Value 1 -Type DWord
Write-Host "[+] BitLocker DMA under lock and unencrypted USB write blocks configured." -ForegroundColor Green

# 4. Device Installation Restrictions (Classes and Hardware IDs)
$RestrictPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions"
if (-not (Test-Path $RestrictPath)) {
    New-Item -Path $RestrictPath -Force | Out-Null
}
Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceClasses" -Value 1 -Type DWord
Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceClassesRetroactive" -Value 1 -Type DWord
Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceIDs" -Value 1 -Type DWord
Set-ItemProperty -Path $RestrictPath -Name "DenyDeviceIDsRetroactive" -Value 1 -Type DWord

$DenyClassPath = Join-Path $RestrictPath "DenyDeviceClasses"
if (-not (Test-Path $DenyClassPath)) {
    New-Item -Path $DenyClassPath -Force | Out-Null
}
Set-ItemProperty -Path $DenyClassPath -Name "1" -Value "{d48179be-ec20-11d1-b6b8-00c04fa372a7}" -Type String
Set-ItemProperty -Path $DenyClassPath -Name "2" -Value "{6bdd1fc1-810f-11d0-bec7-08002be2092f}" -Type String

$DenyIdPath = Join-Path $RestrictPath "DenyDeviceIDs"
if (-not (Test-Path $DenyIdPath)) {
    New-Item -Path $DenyIdPath -Force | Out-Null
}
Set-ItemProperty -Path $DenyIdPath -Name "1" -Value "PCI\CC_0C0A" -Type String
Set-ItemProperty -Path $DenyIdPath -Name "2" -Value "PCI\CC_0C0010" -Type String
Set-ItemProperty -Path $DenyIdPath -Name "3" -Value "PCI\CC_0607" -Type String
Set-ItemProperty -Path $DenyIdPath -Name "4" -Value "PCI\CC_0605" -Type String
Write-Host "[+] Device installation blocks for SBP-2, 1394 host controllers, Thunderbolt, and PCI bridges enabled." -ForegroundColor Green

# 5. Kernel DMA Protection (Block all external DMA permanently for PAWs)
$KDmaPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection"
if (-not (Test-Path $KDmaPath)) {
    New-Item -Path $KDmaPath -Force | Out-Null
}
Set-ItemProperty -Path $KDmaPath -Name "DeviceEnumerationPolicy" -Value 0 -Type DWord
Write-Host "[+] Kernel DMA Protection DeviceEnumerationPolicy set to 0 (Block all)." -ForegroundColor Green

Write-Host "PAW DMA and physical security settings applied successfully." -ForegroundColor Green

To audit local PAW DMA and physical security configuration: Download Script: Test-PawDMAPhysicalSecurity.ps1

# Test-PawDMAPhysicalSecurity.ps1
# Description: Audits local registry configuration for standby settings, wake password, DMA protection under lock, USB restrictions, and blocked device classes/IDs on PAWs.

Write-Host "--- Auditing PAW DMA and Physical Security ---" -ForegroundColor Cyan
$isCompliant = $true

# 1. Audit Standby Settings
$SleepPath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\abfc2519-3608-4c2a-94ea-171b0ed546ab"
$AcSleep = Get-ItemProperty -Path $SleepPath -Name "ACSettingIndex" -ErrorAction SilentlyContinue
$DcSleep = Get-ItemProperty -Path $SleepPath -Name "DCSettingIndex" -ErrorAction SilentlyContinue

$AcSleepVal = if ($AcSleep) { $AcSleep.ACSettingIndex } else { 1 }
$DcSleepVal = if ($DcSleep) { $DcSleep.DCSettingIndex } else { 1 }

$AcSleepColor = if ($AcSleepVal -eq 0) { "Green" } else { $isCompliant = $false; "Red" }
$DcSleepColor = if ($DcSleepVal -eq 0) { "Green" } else { $isCompliant = $false; "Red" }

Write-Host "    - Standby Sleep State (Plugged In) Setting: $($AcSleepVal) (Required = 0 [Disabled])" -ForegroundColor $AcSleepColor
Write-Host "    - Standby Sleep State (On Battery) Setting: $($DcSleepVal) (Required = 0 [Disabled])" -ForegroundColor $DcSleepColor

# 2. Audit Wake Password Requirement
$WakePath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51"
$AcWake = Get-ItemProperty -Path $WakePath -Name "ACSettingIndex" -ErrorAction SilentlyContinue
$DcWake = Get-ItemProperty -Path $WakePath -Name "DCSettingIndex" -ErrorAction SilentlyContinue

$AcWakeVal = if ($AcWake) { $AcWake.ACSettingIndex } else { 0 }
$DcWakeVal = if ($DcWake) { $DcWake.DCSettingIndex } else { 0 }

$AcWakeColor = if ($AcWakeVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" }
$DcWakeColor = if ($DcWakeVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" }

Write-Host "    - Wake Password Required (Plugged In): $($AcWakeVal) (Required = 1 [Enabled])" -ForegroundColor $AcWakeColor
Write-Host "    - Wake Password Required (On Battery): $($DcWakeVal) (Required = 1 [Enabled])" -ForegroundColor $DcWakeColor

# 3. Audit BitLocker Settings
$FvePath = "HKLM:\SOFTWARE\Policies\Microsoft\FVE"
$DmaLock = Get-ItemProperty -Path $FvePath -Name "DisableExternalDMAUnderLock" -ErrorAction SilentlyContinue
$DmaLockVal = if ($DmaLock) { $DmaLock.DisableExternalDMAUnderLock } else { 0 }
$DmaLockColor = if ($DmaLockVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" }

$CrossOrg = Get-ItemProperty -Path $FvePath -Name "RDVDenyCrossOrg" -ErrorAction SilentlyContinue
$CrossOrgVal = if ($CrossOrg) { $CrossOrg.RDVDenyCrossOrg } else { 1 }
$CrossOrgColor = if ($CrossOrgVal -eq 0) { "Green" } else { $isCompliant = $false; "Red" }

$FvePolicyPath = "HKLM:\System\CurrentControlSet\Policies\Microsoft\FVE"
$UsbWrite = Get-ItemProperty -Path $FvePolicyPath -Name "RDVDenyWriteAccess" -ErrorAction SilentlyContinue
$UsbWriteVal = if ($UsbWrite) { $UsbWrite.RDVDenyWriteAccess } else { 0 }
$UsbWriteColor = if ($UsbWriteVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" }

Write-Host "    - Disable DMA Under Lock: $($DmaLockVal) (Required = 1)" -ForegroundColor $DmaLockColor
Write-Host "    - USB Deny Cross Org Removable Drives: $($CrossOrgVal) (Required = 0)" -ForegroundColor $CrossOrgColor
Write-Host "    - USB Unencrypted Write Block: $($UsbWriteVal) (Required = 1)" -ForegroundColor $UsbWriteColor

# 4. Audit Device Restriction Settings
$RestrictPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions"
$DenyDev = Get-ItemProperty -Path $RestrictPath -Name "DenyDeviceClasses" -ErrorAction SilentlyContinue
$DenyDevVal = if ($DenyDev) { $DenyDev.DenyDeviceClasses } else { 0 }
$DenyDevColor = if ($DenyDevVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" }

$DenyId = Get-ItemProperty -Path $RestrictPath -Name "DenyDeviceIDs" -ErrorAction SilentlyContinue
$DenyIdVal = if ($DenyId) { $DenyId.DenyDeviceIDs } else { 0 }
$DenyIdColor = if ($DenyIdVal -eq 1) { "Green" } else { $isCompliant = $false; "Red" }

Write-Host "    - Prevent Device Setup Class Installation: $($DenyDevVal) (Required = 1)" -ForegroundColor $DenyDevColor
Write-Host "    - Prevent Device ID Installation: $($DenyIdVal) (Required = 1)" -ForegroundColor $DenyIdColor

$DenyClassPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses"
$Sbp2 = Get-ItemProperty -Path $DenyClassPath -Name "1" -ErrorAction SilentlyContinue
$Sbp2Val = if ($Sbp2) { $Sbp2."1" } else { "" }
$Sbp2Color = if ($Sbp2Val -eq "{d48179be-ec20-11d1-b6b8-00c04fa372a7}") { "Green" } else { $isCompliant = $false; "Red" }

$Host1394 = Get-ItemProperty -Path $DenyClassPath -Name "2" -ErrorAction SilentlyContinue
$Host1394Val = if ($Host1394) { $Host1394."2" } else { "" }
$Host1394Color = if ($Host1394Val -eq "{6bdd1fc1-810f-11d0-bec7-08002be2092f}") { "Green" } else { $isCompliant = $false; "Red" }

Write-Host "    - Blocked SBP-2 Setup Class: '$($Sbp2Val)' (Required = '{d48179be-ec20-11d1-b6b8-00c04fa372a7}')" -ForegroundColor $Sbp2Color
Write-Host "    - Blocked 1394 Host Setup Class: '$($Host1394Val)' (Required = '{6bdd1fc1-810f-11d0-bec7-08002be2092f}')" -ForegroundColor $Host1394Color

$DenyIdPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs"
$DId1 = Get-ItemProperty -Path $DenyIdPath -Name "1" -ErrorAction SilentlyContinue
$DId1Val = if ($DId1) { $DId1."1" } else { "" }
$DId1Color = if ($DId1Val -eq "PCI\CC_0C0A") { "Green" } else { $isCompliant = $false; "Red" }

$DId2 = Get-ItemProperty -Path $DenyIdPath -Name "2" -ErrorAction SilentlyContinue
$DId2Val = if ($DId2) { $DId2."2" } else { "" }
$DId2Color = if ($DId2Val -eq "PCI\CC_0C0010") { "Green" } else { $isCompliant = $false; "Red" }

$DId3 = Get-ItemProperty -Path $DenyIdPath -Name "3" -ErrorAction SilentlyContinue
$DId3Val = if ($DId3) { $DId3."3" } else { "" }
$DId3Color = if ($DId3Val -eq "PCI\CC_0607") { "Green" } else { $isCompliant = $false; "Red" }

$DId4 = Get-ItemProperty -Path $DenyIdPath -Name "4" -ErrorAction SilentlyContinue
$DId4Val = if ($DId4) { $DId4."4" } else { "" }
$DId4Color = if ($DId4Val -eq "PCI\CC_0605") { "Green" } else { $isCompliant = $false; "Red" }

Write-Host "    - Blocked Device ID PCI\CC_0C0A: '$($DId1Val)' (Required = 'PCI\CC_0C0A')" -ForegroundColor $DId1Color
Write-Host "    - Blocked Device ID PCI\CC_0C0010: '$($DId2Val)' (Required = 'PCI\CC_0C0010')" -ForegroundColor $DId2Color
Write-Host "    - Blocked Device ID PCI\CC_0607: '$($DId3Val)' (Required = 'PCI\CC_0607')" -ForegroundColor $DId3Color
Write-Host "    - Blocked Device ID PCI\CC_0605: '$($DId4Val)' (Required = 'PCI\CC_0605')" -ForegroundColor $DId4Color

# 5. Audit Kernel DMA Protection Setting (Stricter for PAWs)
$KDmaPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\KernelDMAProtection"
$EnumPol = Get-ItemProperty -Path $KDmaPath -Name "DeviceEnumerationPolicy" -ErrorAction SilentlyContinue
$EnumPolVal = if ($EnumPol) { $EnumPol.DeviceEnumerationPolicy } else { 2 }
$EnumPolColor = if ($EnumPolVal -eq 0) { "Green" } else { $isCompliant = $false; "Red" }

Write-Host "    - Kernel DMA Protection Policy: $($EnumPolVal) (Required = 0 [Block all])" -ForegroundColor $EnumPolColor

# 6. Final Compliance Assessment
if ($isCompliant) {
    Write-Host "[+] Audit Result: SECURE - PAW DMA and physical security controls are fully compliant." -ForegroundColor Green
} else {
    Write-Host "[-] Audit Result: VULNERABLE - One or more PAW DMA or physical security settings do not meet baseline requirements." -ForegroundColor Red
}

Sources & Compliance References

  • CIS Microsoft Windows 10/11 Benchmark: Section 18.2.1 (BitLocker Drive Encryption), Section 18.8.19.1 (Kernel DMA Protection), Section 18.8.21.3 (Device Installation Restrictions)
  • ANSSI AD Hardening Guide: Recommendation R3 & R58 (Privileged Access Workstations hardware interface security and storage encryption)
  • NIST SP 800-207: Zero Trust Architecture - Physical Host Boundary Integrity

results matching ""

    No results matching ""