Windows 10: Will "Un-allowed DMA-capable bus/devices detected" issue with Windows Home Device...

Hi All,I have found that I can't enable Windows Device Encryption on my desktop due to the following issue""Un-allowed DMA-capable bus/devices detected". There is a registry workaround, but I think this may leave the machine open to a DMA attack, If I upgrade to Pro and use BitLocker would I encounter the same issue? If not, is this because BitLocker works differently, or because it just lets users take the risk?Thanks for any help.

:)

 

Un-allowed DMA capable bus/device(s) detected

My problem is how can I find out which device on my laptop is Un-allowed DMA capable. I tried disabling my USB devices and unplugging laptop from docking station. My colleague has same laptop model and he is not having same issue as I do.

System Information

 

Un-allowed DMA capable bus/device(s) detected

Hello

My problem is how can I find out which device on my laptop is Un-allowed DMA capable. I tried disabling my USB devices and unplugging laptop from docking station. My colleague has same laptop model and he is not having same issue as I do.

System Information

OS Name Microsoft Windows 10 Enterprise

Version 10.0.16299 Build 16299

Other OS Description Not Available

OS Manufacturer Microsoft Corporation

System Name NB-SOKRE

System Manufacturer LENOVO

System Model 20L7S02M00

System Type x64-based PC

System SKU LENOVO_MT_20L7_BU_Think_FM_ThinkPad T480s

Processor Intel(R) Core(TM) i7-8650U CPU @ 1.90GHz, 2112 Mhz, 4 Core(s), 8 Logical Processor(s)

BIOS Version/Date LENOVO N22ET37W (1.14 ), 22.5.2018.

SMBIOS Version 3.0

Embedded Controller Version 1.08

BIOS Mode UEFI

BaseBoard Manufacturer LENOVO

BaseBoard Model Not Available

BaseBoard Name Base Board

Platform Role Mobile

Secure Boot State On

PCR7 Configuration Bound

Windows Directory C:\Windows

System Directory C:\Windows\system32

Boot Device \Device\HarddiskVolume1

Locale United States

Hardware Abstraction Layer Version = "10.0.16299.371"

User Name 3PRO\kkljucaric

Time Zone Central European Daylight Time

Installed Physical Memory (RAM) 16,0 GB

Total Physical Memory 15,8 GB

Available Physical Memory 7,02 GB

Total Virtual Memory 18,2 GB

Available Virtual Memory 5,31 GB

Page File Space 2,38 GB

Page File C:\pagefile.sys

Virtualization-based security Running

Virtualization-based security Required Security Properties Base Virtualization Support, Secure Boot, DMA Protection

Virtualization-based security Available Security Properties Base Virtualization Support, Secure Boot, DMA Protection, Secure Memory Overwrite, UEFI Code Readonly, SMM Security Mitigations 1.0

Virtualization-based security Services Configured Credential Guard

Virtualization-based security Services Running Credential Guard

Windows Defender Device Guard Code Integrity Policy Audit

Windows Defender Device Guard user mode Code Integrity Audit

Device Encryption Support Reasons for failed automatic device encryption: Un-allowed DMA capable bus/device(s) detected

A hypervisor has been detected. Features required for Hyper-V will not be displayed.

 

Un-allowed DMA capable bus/device(s) detected

Microsoft provides this documentation about this message.

Both the blacklist and whitelist are in your registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DmaSecurity. I’m not aware of an automated process to check this, though creating one should be pretty easy.

A typical candidate that exists on most systems is “PCI-to-PCI Bridge”. Curiously, “PCI Express Root Complex” is both in AllowedBuses and UnallowedBuses.