Fine Tuning with Group Policies

As an alternative to WAC, you can control the functions of the Secured-core server through group policies. The options are found in the Group Policy Management Editor under Computer Configuration | Policies | Administrative Templates | System | Device Guard . Use the Turn on Virtualization Based Security setting when you get there.

If you enable this setting, four drop-down boxes in the options area control the details (Figure 2). The first option for the platform security level enables Secure Boot with or without DMA protection. Not Configured means that the group policy will not change the HVCI status already in place on a target machine. Enabled without lock is equivalent to the state that you can enable in WAC. HVCI is enabled in this case and can also be disabled again with a group policy. The Enabled with UEFI lock option links the HVCI status to the target's local UEFI, if compatible. In this case, the function can no longer be disabled remotely, whether by WAC or by group policy.

Figure 2: Group policies centrally control the functions of the Secured-core server.

The memory attributes table checkbox ensures that VBS and HVCI are only used on systems with a compatible UEFI. Microsoft otherwise warns about crashes, data loss, or incompatibility when you install physical expansion cards. Credential Guard is not one of the six core functions of the Secured-core server, but it uses VBS as a basis for protecting credentials. The options are identical to those of HVCI. Credential Guard can also be connected to a local UEFI. Finally, the Secure Boot configuration option controls whether or not system monitoring should be enabled.

In Computer Configuration | Policies | Administrative Templates | System | Kernel DMA Protection you find Enumeration policy for external devices incompatible with Kernel DMA Protection . This setting decides whether the target system generally blocks or allows devices whose drivers do not support DMA remapping. By default, the third option specifies that these devices only work as long as a user is logged in and the screen is not locked.

Conclusions

Secured-core server uses all the security features of modern hardware and virtualization infrastructures. Provided UEFI and device drivers are suitable, the setup involves just a few steps. Secured-core server reduces the attack surface of Windows Server 2022 at no additional cost and with the least possible overhead.

The Author

Christian Knermann is Head of IT-Management at Fraunhofer UMSICHT, a German research institute. He's written freelance about computing technology since 2006.