Detections
Analytics
18.8.7.1.5 Ensure 'Prevent installation of devices using drivers that match these device setup classes: Also apply to matching devices that are already installed.' is set to 'True' (checked)
Information
This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for device drivers that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device.If you enable this policy setting, Windows is prevented from installing or updating device drivers whose device setup class GUIDs appear in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.
If you disable or do not configure this policy setting, Windows can install and update devices as allowed or prevented by other policy settings.
The recommended state for this setting is: True (checked).
Rationale:
A BitLocker-protected computer may be vulnerable to Direct Memory Access (DMA) attacks when the computer is turned on or is in the Standby power state - this includes when the workstation is locked.
BitLocker with TPM-only authentication lets a computer enter the power-on state without any pre-boot authentication. Therefore, an attacker may be able to perform DMA attacks.
This issue is documented in Microsoft Knowledge Base article 2516445: Blocking the SBP-2 driver and Thunderbolt controllers to reduce 1394 DMA and Thunderbolt DMA threats to BitLocker.
Impact:
Existing devices (that match the device setup classes specified) that were previously installed prior to the hardening will be disabled or removed.
Solution
To establish the recommended configuration, set the following Device Configuration Policy to Enabled, and check the Also apply to matching devices that are already installed. checkbox:To access the Device Configuration Policy from the Intune Home page:
Click Devices
Click Configuration profiles
Click Create profile
Select the platform (Windows 10 and later)
Select the profile (Administrative Templates)
Click Create
Enter a Name
Click Next
Configure the following Setting
Path: Computer Configuration/System/Device Installation/Device Installation Restrictions
Setting Name: Prevent installation of devices using drivers that match these device setup classes
Configuration: Also apply to matching devices that are already installed. (checked)
Select OK
Continue through the Wizard to complete the creation of the profile (profile assignments, applicability etc.)
Note: More than one configuration setting from each of the Configuration profiles (ex: Administrative Templates, Custom etc.) can be added to each Device Configuration Policy.
Note 2: This recommendation can also be set using the Endpoint protection profile using Windows Encryption settings.
Default Value:
False (unchecked). (Pre-existing devices matching the device setup classes will not be disabled or removed.)
See Also
Item Details
Plugin: Windows
Control ID: 6cca2c969e65d4d9bee1cba4bb086a69722b00fa3605a80cb6eb5914eb2088b2