Documentation · Policy appendix
Drive encryption
Every setting of the “Drive encryption” package with its effect, value and recommending sources.
since 0.9.8.11
Purpose
This page lists every setting of the “Drive encryption” package: what it does, which value Setup Foundry sets and who recommends it. It is generated from the catalog and never edited by hand.
1 settings.
Notes
Disable new DMA devices when this computer is locked
When the DWORD value is set to 1, it enables a BitLocker Group Policy that restricts direct memory access (DMA) through hot-pluggable PCI ports. Windows blocks DMA through these ports and postpones enumeration of newly attached PCI devices until a user signs in.
- Technical:
- Policy:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\DisableExternalDMAUnderLock = 1 (REG_DWORD)
- Policy:
- Switch in the app: Policies › Drive encryption
- In detail: Disable new DMA devices when this computer is locked
- Source: Microsoft Learn: Configure BitLocker – Disable new DMA devices when this computer is locked
- Recommended by: Windows 11 v25H2 Security Baseline