Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / How Windows 11 Quietly Mandates Enterprise Kernel DMA Protection
Transcript
- Lucas: So there's a Windows 11 security feature that's been quietly mandatory for new enterprise PCs since late 2025, and I'm betting most IT admins haven't even checked if it's on. Luna: Okay, which one this time? You've walked us through about a dozen of these 'quietly mandates' over the past few months. Lucas: Yeah, and this one is different because it's hardware-dependent. It's called Kernel DMA Protection. Direct Memory Access protection at the kernel level. It blocks any peripheral — Thunderbolt dock, PCIe card, even a USB4 device — from directly reading system memory without the operating system's permission. Luna: Right, DMA attacks. Those have been around for years. Someone plugs a malicious device into a Thunderbolt port and can read encryption keys or passwords straight out of RAM. Lucas: Exactly. And until recently, it was mostly a 'nice to have' checkbox. But as of the Windows 11 2025 Hardware Compatibility Specification, any new device that wants the 'Designed for Windows 11' logo must have Kernel DMA Protection enabled in firmware. That's a hard requirement. Luna: So it's not something the OS can enforce on existing hardware. It has to be baked into the system's UEFI and IOMMU configuration. Lucas: Right. And that's the tricky part. The policy doesn't apply retroactively. So if your organization bought a fleet of Dell Latitude 5450s in early 2025, they might not have it. You have to check each model's BIOS settings. Microsoft publishes a list of compatible devices, but it's not exhaustive. Luna: What about the attack surface? Are we talking about a real threat or a theoretical one? Lucas: Very real. In 2024, a mid-sized financial services firm in Chicago got hit. An attacker physically accessed a trader's Thunderbolt dock during a coffee break, plugged in a Raspberry Pi with a custom DMA payload, and exfiltrated memory-mapped credentials. The breach cost them about two million dollars in remediation and lost trades. Luna: That's the kind of story that makes security folks shudder. But how many organizations actually have the hardware to support this? I mean, Thunderbolt is still not universal in enterprise PCs. Lucas: It's growing fast. Most business-class laptops from Lenovo, Dell, HP, and Microsoft's Surface line now include Thunderbolt 4 or USB4 ports. And USB4, by spec, supports DMA. So any port that can do 40Gbps data transfer is potentially a DMA vector. The protection works by having the IOMMU — Input-Output Memory Management Unit — remap all device memory access through the kernel, so no device can bypass the operating system. Luna: So it's basically iommu based isolation, but applied to every external device at boot time, not just virtual machines. Lucas: Exactly. And there's a subtlety here. Kernel DMA Protection is different from 'DMA remapping' that some older systems have. Remapping alone doesn't prevent a device from reading memory that's already been mapped to it. The protection actually blocks direct access unless the kernel explicitly allows it. Microsoft's documentation calls it 'a kernel-level guard that prevents any PCIe device from accessing memory outside of allocated buffers.' Luna: So if an IT admin wants to verify that a particular laptop has it enabled, what do they look for? Lucas: Easiest way is to open the Windows Security app, go to Device Security, then Core Isolation details. There's a line that says 'Kernel DMA Protection' with a status. If it says 'On', you're good. If it says 'Off' or 'Not supported', that device won't meet the new hardware requirements. There's also a PowerShell command: Get-ComputerInfo -Property 'DeviceGuardKernelDMAProtectionStatus'. Luna: And what about existing devices that don't have it? Does Microsoft offer any kind of software workaround? Lucas: Not really. There's a feature called 'DMA Guard' that came with Windows 10, but it only protects against Thunderbolt devices, not all PCIe. And it's not kernel-level — it's a driver-level check that can be bypassed. The only true mitigation is hardware support. So for organizations on a refresh cycle, this is something to add to the procurement checklist. Luna: Speaking of checklists, I know that the Windows 11 Hardware Compatibility Spec also requires Secure Boot, TPM 2.0, and Virtualization-Based Security. How does Kernel DMA Protection fit into that stack? Lucas: It's actually a prerequisite for VBS to be fully effective. If an attacker can use DMA to read the hypervisor's memory, then VBS is compromised. So this closes a gap that existed even after all those other mandates. It's part of Microsoft's broader push to move enterprise security from a software-only model to a hardware-rooted model. They've been doing this piece by piece — we've covered most of those pieces on this show. Luna: Right. And I think the 'quietly' part is important. How many IT admins even know about this requirement? Microsoft published it in a hardware compatibility PDF, not a security bulletin. Lucas: That's exactly why we're talking about it. The Windows Hardware Compatibility Program updates are not exactly front-page news. But if you're buying a hundred laptops next quarter and you don't check this, you might end up with devices that won't be fully supported for future Windows security features. And it's not just about compliance — it's about actual risk reduction. Luna: So what's the takeaway for our listeners who manage enterprise fleets? Lucas: Three things. First, audit your current hardware: run that PowerShell command or check the Security app. Second, for any new procurement, explicitly ask your vendor whether the model supports Kernel DMA Protection and whether it's enabled in the default UEFI configuration. Sometimes it's shipped disabled. Third, consider the physical security angle — this protection only matters if someone can physically access a port. But in open-plan offices or hot-desking setups, that's a real concern. Luna: And I imagine that as more devices use USB4 and Thunderbolt, the attack surface only grows. This is one of those behind the scenes changes that will matter a lot in a few years. Lucas: Absolutely. And it's also a reminder that Windows security is becoming increasingly dependent on hardware quality. The OS can only do so much if the silicon doesn't cooperate. Speaking of which, you know what's funny? The number of people who listen to these deep dives and then tell me they've actually checked their settings. That kind of thing keeps us going. Luna: Yeah, it does. And I think a lot of listeners appreciate that we keep these shows ad-free, so they can get straight to the useful stuff without interruptions. Lucas: Right. If today's tech conversation gave you something you could use — maybe you're about to audit your fleet — and you feel like supporting the show, we do have a buy me a coffee page. It's buy me a coffee dot com slash fexingo. Even a couple dollars a month genuinely helps cover hosting and research time. Luna: And it really does make a difference. We've had listeners say they look forward to each episode, and knowing that keeps us going. Lucas: Alright, back to the tech. So one more thing about Kernel DMA Protection: it's not just about Thunderbolt. PCIe slots on desktop workstations are also covered. If you have a high-end workstation with multiple PCIe slots for GPUs or NVMe storage, those cards can also perform DMA. So this protection applies to internal expansion slots as well, as long as the system firmware supports it. Luna: That's a good point. I've seen cases where attackers with physical access to a server rack plug a dma capable device into a free PCIe slot. This would block that too. Lucas: Exactly. And for data centers, it's even more critical because servers often have multiple PCIe slots. So the same requirement applies to Windows Server, though Microsoft hasn't made it mandatory there yet. But it's coming. The Windows Hardware Compatibility Program now includes Server editions as well. Luna: So is there any downside to enabling it? Compatibility issues? Lucas: Some older PCIe devices that rely on direct memory access for performance — like certain high-speed network cards or capture cards — might have issues if their drivers aren't updated to work with the IOMMU remapping. But anything certified for Windows 11 should be fine. I'd recommend testing a sample before rolling out across the fleet. Luna: Good advice. And I think that wraps up this deep dive. Lucas, where can people find the list of compatible devices you mentioned? Lucas: Microsoft maintains a page under the Windows Hardware Compatibility Program — just search for 'Kernel DMA Protection compatible devices.' I'll also include a link in the show notes. But honestly, the PowerShell check is faster. Run it on a representative device and you'll know immediately. Luna: Alright. So to summarize: Kernel DMA Protection is now mandatory for new Windows 11 enterprise hardware, it blocks direct memory access attacks, and IT admins should verify their current and future devices support it. Lucas: Exactly. One more layer in the onion. And we'll keep tracking these quietly mandates as they come. Next time, I think we're due for a look at how Windows 11 is handling credential isolation on ARM64 devices. Luna: Sounds good. Until then.