How to turn on firmware protection? I have Hyper-V enabled. There is no third party antivirus installed. Please help me
asked Jul 27, 2021 at 3:48
-
2You have disabled (more than likely) the diagnosis data or you are connected to a AD domain and a group policy is actually being applied to your machine– RamhoundJul 27, 2021 at 4:12
-
1If your not sure what setting you disabled to caused the “this setting is managed …” my advice would be to perform a Windows Reset. If that still doesn’t work report the behavior as a bug. You can edit your question to include the vital information necessary to answer your question– RamhoundJul 27, 2021 at 4:20
-
@Ramhound please give me the solution– incidious worksJul 27, 2021 at 5:15
-
Reset your installation and enable everything when prompted during the OBOE– RamhoundJul 27, 2021 at 11:07
-
@Ramhound does not work..Shows same– incidious worksJul 27, 2021 at 15:33
|
Show 9 more comments
1 Answer
I have the same issue in Windows 11 Pro 22H2 and my guess is that the feature either can't be enabled because all prerequisites aren't met or because of malware; the "Firmware protection" feature is called "System Guard Secure Launch" by Microsoft at https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection and lists the system requirements in vague terms as "all the baseline requirements for System Guard, Device Guard, Credential Guard, and Virtualization Based Security".
The "Firmware protection" option doesn't even appear until using the Local Group Policy Editor (gpedit.msc) to enable the "Turn On Virtualization Security" policy. After a reboot, even with the "Secure Launch Configuration" option of that policy set to "Enabled", the corresponding registry key at Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard\Enabled set to "1", and the "System Information" app (msinfo32.exe) showing "Secure Launch" as being "Configured" ("Virtualization-based security Services Configured") under "System Summary", the "Firmware protection" option is still shown as being off.
If I reset the policy to "Not Configured" and the registry key Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard\Managed to "0" (which presumably corresponds to the yellow "This setting is managed by your system administrator." message), after a reboot, the "Firmware protection" toggle simply disappears again indicating that Windows wouldn't normally even offer the option to toggle the setting.
