Drive encryption

Purpose

This page lists every setting of the “Drive encryption” package: what it does, which value Setup Foundry sets and who recommends it. It is generated from the catalog and never edited by hand.

1 settings.

Notes

Disable new DMA devices when this computer is locked

When the DWORD value is set to 1, it enables a BitLocker Group Policy that restricts direct memory access (DMA) through hot-pluggable PCI ports. Windows blocks DMA through these ports and postpones enumeration of newly attached PCI devices until a user signs in.

• Technical:
  • Policy: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\DisableExternalDMAUnderLock = 1 (REG_DWORD)
• Switch in the app: Policies › Drive encryption
• In detail: Disable new DMA devices when this computer is locked
• Source: Microsoft Learn: Configure BitLocker – Disable new DMA devices when this computer is locked
• Recommended by: Windows 11 v25H2 Security Baseline

See also

• Policy reference
• Kernel protection
• Windows Update