This tutorial will show you how to enable or disable Microsoft Defender System Guard Secure Launch for firmware protection in Windows 10 and Windows 11 Secured-core PCs.
Microsoft has worked with OEM partners to offer a special category of devices called Secured-core PCs. The devices ship with additional security measures enabled at the firmware layer, or device core, that underpins Windows. Secured-core PCs help prevent malware attacks and minimize firmware vulnerabilities by launching into a clean and trusted state at startup with a hardware-enforced root of trust. Virtualization-based security comes enabled by default. And with built-in hypervisor protected code integrity (HVCI) shielding system memory, Secured-core PCs ensure that all executables are signed by known and approved authorities only. Secured-core PCs also protect against physical threats such as drive-by Direct Memory Access (DMA) attacks.
In Secured-core PCs, Microsoft Defender System Guard Secure Launch protects bootup with a technology known as the Dynamic Root of Trust for Measurement (DRTM). With DRTM, the system initially follows the normal UEFI Secure Boot process. However, before launching, the system enters a hardware-controlled trusted state that forces the CPU(s) down a hardware-secured code path. If a malware rootkit/bootkit has bypassed UEFI Secure Boot and resides in memory, DRTM will prevent it from accessing secrets and critical code protected by the virtualization-based security environment. Firmware Attack Surface Reduction technology can be used instead of DRTM on supporting devices such as Microsoft Surface.
References:
How System Guard helps protect Windows
Learn how System Guard reorganizes the existing Windows system integrity features under one roof.
learn.microsoft.com
System Guard Secure Launch and SMM protection
Explains how to configure System Guard Secure Launch and System Management Mode (SMM protection) to improve the startup security of Windows devices.
learn.microsoft.com
Device Security in the Windows Security App - Microsoft Support
Learn how to access Windows device security settings in Windows Security to help protect your device from malicious software.
support.microsoft.com
You must be signed as an administrator to enable or disable System Guard Secure Launch for firmware protection.
Contents
- Option One: Enable or Disable System Guard Secure Launch for Firmware Protection in Windows Security
- Option Two: Enable or Disable System Guard Secure Launch for Firmware Protection using REG file
1 Open Windows Security.
2 Click/tap on Device security. (see screenshot below)
3 Click/tap on the Core isolation details link under Core isolation. (see screenshot below)
4 Turn on (default) or off Firmware protection for what you want. (see screenshot below)
If the Firmware protection setting is grayed out with a This setting is managed by your administrator message, change the Managed DWORD value to 0 instead of 1 in the registry key below, then close and reopen Windows Security.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard
5 If prompted by UAC, click/tap on Yes to approve.
6 Restart the computer to apply. (see screenshots below)
1 Do step 2 (enable) or step 3 (disable) below for what you would like to do.
2 Enable System Guard Secure Launch for Firmware Protection
This is the default setting.
A) Click/tap on the Download button below to download the REG file below, and go to step 4 below.
Enable_System_Guard_Secure_Launch_for_firmware_protection.reg
Download
(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard]
"Enabled"=dword:000000013 Disable System Guard Secure Launch for Firmware Protection
A) Click/tap on the Download button below to download the file below, and go to step 4 below.
Disable_System_Guard_Secure_Launch_for_firmware_protection.reg
Download
(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard]
"Enabled"=dword:000000004 Save the .reg file to your desktop.
5 Double click/tap on the downloaded .reg file to merge it.
6 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.
7 Restart the computer to apply.
8 You can now delete the downloaded .reg file if you like.
That's it,
Shawn Brink
Last edited:
