🧱🪟💻ES - DMA Guard
A Thunderbolt port is a straw into system memory. This blocks an untrusted plugged-in device from sipping through it while the screen is locked.
What this policy is about 🧱
Direct Memory Access is a feature, not a bug: fast peripherals like Thunderbolt docks and PCIe cards talk straight to system memory without bothering the CPU. The problem is that a malicious device does exactly the same thing, reading RAM directly and skipping every OS-level control. That is how attacks like Thunderspy pull BitLocker keys and secrets out of a locked laptop in minutes: plug in, read memory, walk away.
This policy sets the DMA Guard Device Enumeration Policy to Block all, the most restrictive option. Newly plugged-in DMA-capable peripherals that do not support memory remapping are refused DMA until the machine is unlocked by a real user, so a device plugged into an unattended, locked laptop gets nothing.
The threat is not a file or a download; it is the physical hole in the side of the laptop. DMA Guard treats an untrusted peripheral as guilty until a signed-in human vouches for it, which is exactly backwards from how ports normally behave, and exactly right for a device left on a train.
Why this matters 🕵️
A locked screen feels safe, but DMA bypasses it entirely: the attacker never touches the login prompt, they read the memory sitting behind it. For a laptop that leaves the building, that memory can contain the BitLocker key, session tokens, and whatever was open when it locked. Blocking external DMA turns "give me five minutes alone with the device" from a full compromise into a dead end.
It pairs naturally with disk encryption: BitLocker protects data at rest, DMA Guard protects the keys and secrets while the machine is running but locked. One without the other leaves a gap.
🛠️ Configuration
Where: Intune admin center → Devices → Configuration → Create → Windows → Settings catalog → DMA Guard.
| Setting | Value |
|---|---|
| Device Enumeration Policy | Block all (Most restrictive) |
| Assignment, include | All devices |
| Assignment, exclude | 🛡️🪟💻👈🔓⚙️Group - DMA Guard Allowed |
Block all is what refuses DMA to non-remapping peripherals on a locked device. It is the whole control.
Caveats ⚠️
It needs Kernel DMA Protection to bite. The strong protection depends on hardware and firmware support (a recent UEFI machine with IOMMU/VT-d and DMA remapping). On older hardware without it, the setting applies but the underlying guarantee is weaker. Check msinfo32 for "Kernel DMA Protection: On" when validating a device model.
Some legitimate peripherals lack remapping. Certain docks, external GPUs, and capture cards do not support DMA remapping and will stop working under Block all. That is the DMA Guard Allow inverse and its exception group, for the documented device that genuinely needs it, not a blanket loosening.
It is one half of the physical-security story. DMA Guard assumes the disk is already encrypted. Without BitLocker, an attacker skips the memory attack and just reads the drive. Deploy both.
License and reversibility. Included in Business Premium. Clean-revert on its own, though the exception path is the paired inverse rather than plain unassignment.
🔗 Related
- 🧱🪟💻🔓ES - DMA Guard - Allow: the paired inverse that reopens DMA for a documented exception group.
- 🛡️🪟💻👈🔓⚙️Group - DMA Guard Allowed: the group the inverse is assigned to.
No gift horses at the Thunderbolt port. If a plugged-in device wants your memory, it can wait until a human signs in. 🧱