Windows 10: system guard and firmware protection

Is system guard is one of the features of firmware protection, does enabling firmware protection enables system guard and disabling firmware protection will disable system guard, or firmware protection ON/OFF has no effect on system guard

:)

 

How to turn on "Firmware Protection" of Windows Security System Guard?

Happy Chinese New Year and thanks for your reply, Shafeeq!

So I shall provide some information to your questions:

1. There are no issues prior, hardware and software wise. In fact, I restore my computer using factory image and straight away turning on the "Virtualisation-based security" feature in Group Policy. It has to be noted that there is no "firmware protection"
   prior to turning on the "virtualised-based security" feature. After enabling that feature, then the "firmware protection" option appeared and it can no longer be turned on as I "need permission from an administrator". I have tuned my local account to have
   highest permission by making myself a member of all possible user category afterward, but still it would't allow me to turn the feature on. I suspect either my hardware is not supporting the feature, although I have 8th Gen Intel processors with vPro and a
   TPM 2.0 chipset, or that certain Group Policy option is not enabled yet, and I didn't know which one.
2. I am the sole administrator and I did log into the "super"-administrator account and it still wouldn't be allowed to turned on, with the same reason I "need permission from administrator".
3. Yea, I have Kaspersky Internet Security (KIS) installed but there is no documentation of conflict between KIS and System Guard.
4. Even on a private network it still has the same problem.

I also tried out the method you mentioned, but still to no avail.. Any other suggestions? I seriously appreciate your help.

Thanks again,

Alex Goh.

 

How to turn on "Firmware Protection" of Windows Security System Guard?

Hi Chun,

Thank you for writing to Microsoft Community Forums.

In order to get clarity on this issue and assist you with appropriate troubleshooting steps, please reply with the answers to the questions below.

1. Are you aware of any changes made to this computer prior to the issue?
2. Are you logged in with an administrator user account?
3. Have you installed any third-party antivirus/firewall protection?
4. Is the computer connected to any Domain network?

Meanwhile, try enabling Firmware Protection from Registry and check if this helps.

NOTE: This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added
protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, please refer this link:
How to back up and restore the registry in Windows.

Step 1: Click on the Start Menu and search for
Regedit and hit Enter.

Step 2: Go to the following registry key from the left pane.

HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ DeviceGuard \ Scenarios \ HypervisorEnforcedCodeIntegrity \ Enabled

Step 3: On the left pane, find
Enabled key and change its value from 1 to 0.

Step 4: Close the Registry Editor, restart the computer once or twice, and check for the issue.

Give it a shot and let us know of any changes.

Hope it helps.

 

Credential Guard lab companion

Source: Credential Guard lab companion Datacenter and Private Cloud Security Blog


See also:

• Enable or Disable Credential Guard in Windows 10 Windows 10 Security System Tutorials
• Verify if Credential Guard is Enabled or Disabled in Windows 10 Windows 10 Security System Tutorials