# Automatically disable devices to save power and mitigate DMA attack in Windows 7

Some OEM include energy saving apps that can switch off certain devices such as webcam or optical drive. Is there any brand-agnostic app out there that can do it? If the list of disabled device is customizable, it would be useful too for mitigating DMA attack (disabling Firewire, PCMCIA, SDIO, Thunderbolt, etc). Even better if it can recognize lock/logoff event, to mimic OSX behavior in mitigating the DMA attack.

-
I think one of the main problems such a software would face is that a lot of drivers require a reboot when they are re-enabled. – Robert Jun 15 '12 at 19:20
Ah, didn't thought about that. But perhaps if we can choose the device list it will be OK? Most webcam and optical drives don't require reboot on disabling or enabling. – Martheen Cahya Paulo Jun 16 '12 at 4:31

You can disable hardware devices via commandline
I am not sure that merely disabling a device is sufficient to mitigate the DMA attack

Microsoft provides devcon as a command line device management tool

## Get It

1. Obtain the Windows Driver Kit (WDK) 7.1.0 from Microsoft.
2. Extract the ISO to a temporary file.
3. Expand the windows installer file “”WDK\setuptools_x64fre.msi“” to a temp directory.
4. devcon is located in “drive:\your\temp\folder\WinDDK\7600.16385.win7_wdk.100208-1538\tools\devcon\amd64\".

## Use It

1. Find the device you want to manage. Ex: devcon find * | find "DVD"
2. Disable the device ID returned. Ex: devcon disable PCI\VEN_1102

## Automate It

1. Collect the IDs for all devices you wish to disable
2. Add the commands to disable the devices to a simple batch file
3. Call the batch file from a logoff script.
4. Reverse the commands and add them to another batch file.
5. Call this batch file from a logon script.

Note: it may be possible to do this using only powershell but I wasn't able to find the correct calls. The closest I found was get-wmiobject Win32_PNPEntity

-
+1, I was expecting a ready to use app, but maybe I would just code this myself. Thanks for the new devcon version, previously I found the XP version and I thought it was discontinued. I will select this as the answer if no one can come up with a ready to use app. – Martheen Cahya Paulo Jun 23 '12 at 5:21
About the DMA attack, would it still be possible even if all DMA-capable external ports are disabled? – Martheen Cahya Paulo Jun 23 '12 at 5:22

Microsoft supplies Power management profiles that allow one to run with the most suitable profile.

It is possible to further extend Power management by third-party products :

Aerofoil extends Vista and Windows 7 notebook battery life by :

• Allowing you to manually disable Aero Glass.
• Optionally managing Aero Glass user interface.
• Optionally managing sound muting.
• Optionally managing your chosen power plans.
• Optionally managing Windows Sidebar.
• Optionally showing a quick hibernate button.
• Changing icon colour to show whether on battery or AC.

Power Plan Assistant for Windows 7 is capable of much much more than automatic switching of power plans. (Donationware - without donation it requires weekly reinstallation.)

-
-1, I need to disable device – Martheen Cahya Paulo Jun 23 '12 at 5:18
Power management of Microsoft is very sophisticated and allows one to control the status of devices when on battery or mains power. It is certainly much more powerful and automatic than using devcon from a batch file. Down-voting answers you haven't researched out is not a good idea. – harrymc Jun 23 '12 at 5:24
I have tried those application. I already mentioned optical drives and webcam, Power management don't touch those, and several OEM include custom apps to disable them automatically, that's the main reason I'm interested to brand-agnostic solution. And my other interest is in completely disabling device to mitigate DMA attack, that require the port to not respond to anything, instead of standing by and spring up to life when a device is connected. – Martheen Cahya Paulo Jun 23 '12 at 5:36
The products I mentioned above extend Power management beyond Microsoft. However, their doc doesn't specifically mention optical drives and webcams, so one would need to install and see. – harrymc Jun 23 '12 at 6:31
Does you computer contain documents of worldwide importance ? The level of effort required to mount the attack that you describe is on the level of a national intelligence agency, and believe me that there are much easier attack vectors than DMA. – harrymc Jun 23 '12 at 9:12