Disable new DMA devices when this computer is locked
When the DWORD value is set to `1`, it enables a BitLocker Group Policy that restricts direct memory access (DMA) through hot-pluggable PCI ports.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\FVE\DisableExternalDMAUnderLock
When the DWORD value is set to 1, it enables a BitLocker Group Policy that restricts direct memory access (DMA) through hot-pluggable PCI ports. Windows blocks DMA through these ports and postpones enumeration of newly attached PCI devices until a user signs in.
Whenever the computer is subsequently locked, Windows blocks DMA on hot-plug Thunderbolt PCI ports that have no enumerated child devices. A device newly connected to such a port is not enumerated until the next user sign-in or unlock.
Devices that Windows already enumerated while the computer was unlocked continue to operate until they are disconnected or the system is restarted or hibernated.
Notes
Security
The policy helps mitigate drive-by DMA attacks involving external DMA-capable PCI devices. Without an applicable protection mechanism, a physically connected device might directly read or modify system memory without using the processor or passing through normal Windows access checks.
Enforcement requires BitLocker or Windows device encryption to be enabled. The policy does not itself encrypt drives or protect data against unrelated access methods.
Possible side effects
Correct operation depends on compatible system firmware and device drivers. If the firmware handles the Bus Master Enable bit incorrectly for an internal device, or a driver cannot handle that bit being locked by the operating system, internal or external devices might not work before sign-in or might continue to malfunction afterward. Microsoft identifies network adapters, audio devices, pointing devices, and touchpads among the device classes that can be affected.
Notes
This policy isn't compatible with Kernel DMA Protection. On systems that support Kernel DMA Protection, Microsoft identifies that feature as the stronger and more granular protection. It uses the system IOMMU and takes each device driver's DMA-remapping support into account.
Microsoft documentation
Microsoft Learn: Configure BitLocker – Disable new DMA devices when this computer is locked
Microsoft Learn: Devices aren't working before sign-in
Microsoft Learn: Kernel DMA Protection