Windows-itpro-docs: Kernel DMA Protection for Thunderbolt™ 3 - Where is the "Memory Access Protection" option ?

[PierrickV]

Hello,

I can't found the Memory access protection option in Core Isolation.

The documentation has the following picture:

However, this option does not appear in my Windows installation :

I tried to find this option on several recent and fully updated Windows 10 computers without success.

In System Information, Kernel DMA Protection is off on the computer I'm playing with

Regards,

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: b9b83e95-63de-87c5-929c-d5f25e33d124
• Version Independent ID: 743ead3f-b4a5-1589-6577-e1d12aaa1b92
• Content: Kernel DMA Protection for Thunderbolt™ 3 (Windows 10) - Microsoft 365 Security
• Content Source: windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md
• Product: w10
• Technology: windows
• GitHub Login: @DulceMontemayor
• Microsoft Alias: dansimp

[RAJU2529]

@PierrickV. First install the certified and verified device driver to thunderblot 3.
then enable dma protection in GPO.
You must enable UEFI or secure boot in bios.
you need windows 10 professional or enterprise 64bit 1903 or 1909 edition OS.

please change the language as English in your computer and take and post the corresponding screenshots

[beerisgood]

@RAJU2529
So DMA protection doesn't work without thunderbolt driver? Does windows doesn't install that by default ?

[RAJU2529]

@PierrickV . I think you must install the certified driver , download from the system manufacturer .

[beerisgood]

@RAJU2529 your quote go to wrong person again ;)

Also I never see any company which provide such a driver. Any infos?
Also where did you read that the driver is necessary?

[RAJU2529]

@PierrickV . I have seen the asus company , which provides thunderbolt 3 certified driver for laptop.
Driver is necessary , because the driver is modified such way that , compatible with dma protection and also depends upon the Intel Processor model with highend chipset

[PierrickV]

@beerisgood

Documentation about Windows DMA protection that I am aware of:

• Kernel DMA Protection for Thunderbolt™ 3 : https://docs.microsoft.com/en-us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt#frequently-asked-questions
• BitLocker Countermeasures : https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-countermeasures
• Policy CSP - DmaGuard : https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-dmaguard#dmaguard-deviceenumerationpolicy

[MaratMussabekov]

Dear @PierrickV,
In System Information, Kernel DMA Protection is off on the computer I'm playing with - it means you need to enable Intel Thunderbolt Security in BIOS, as it is described here (second article that you provided)

Thank you

[mypil]

@PierrickV - Thank you for submitting feedback.

From our understanding, the issue you raised has been answered by MaratMussabekov so we will close this issue.

Thank you for your contribution to make the docs better! Much appreciated!

[PierrickV]

So I finally found one computer that had the protection enabled (sorry it's in french, I don't own the computer).

The computer has the following configuration :

• Secureboot on
• VT-d on
• Admin password on the BIOS/UEFI
• Intel Thunderbolt Security set to User Authorization in BIOS settings
• (+ it's a very recent computer?)

Thank you @RAJU2529 for your help

@MaratMussabekov : Thunderbolt is off on the computer that has the protection enabled (did you mean "intel thunderbolt sercurity set to user authorization in bios settings" ?)

[MaratMussabekov]

Hello @PierrickV,
yes, sorry for being unclear
Thank you

[umair-mirza]

You can also go to the System Information and check if the Kernel DMA Protection is ON or OFF.

Here's a quick step-by-step guide on how to check it and how to enable it if it's OFF.