How to Configure BitLocker Kernel DMA Protection in Windows 11 Using PowerShell

Direct Memory Access (DMA) attacks represent a severe physical security risk to enterprise laptops and portable workstations. By connecting malicious high-speed peripheral devices via Thunderbolt, USB4, or external PCIe expansion slots, a physical attacker can bypass operating system authentication and read unencrypted system RAM directly—extracting BitLocker volume encryption keys, passwords, and sensitive process data. Windows 11 incorporates Kernel DMA Protection (Memory Access Protection) to defend against these drive-by hardware attacks. Configuring and validating Kernel DMA Protection and BitLocker DMA policies via PowerShell ensures robust physical endpoint defense.

How Kernel DMA Protection Works

Traditional operating systems allow high-performance peripherals to read and write directly to physical memory via DMA to maximize data transfer rates. However, unconstrained DMA access enables rogue PCIe devices to read memory addresses without CPU intervention.

Kernel DMA Protection utilizes the system’s Input-Output Memory Management Unit (IOMMU)—known as Intel VT-d or AMD IOMMU—to isolate peripheral hardware into virtual memory sandboxes. When an external Thunderbolt or USB4 accessory is plugged into the workstation, the kernel restricts its memory access strictly to designated DMA buffer pools. Untrusted devices cannot read system memory containing cryptographic keys or LSASS caches unless authorized by the logged-in user.

Hardware and Software Prerequisites

• Windows 11 Pro, Enterprise, or Education edition.
• Motherboard firmware supporting native Kernel DMA Protection (PCI Express native control enabled).
• Intel 8th Generation Core or newer, or AMD Ryzen 3000 series or newer processor with IOMMU enabled in UEFI/BIOS.
• BitLocker Drive Encryption enabled on the system boot volume.
• An elevated PowerShell session running as Administrator.

Verifying Kernel DMA Protection Support via PowerShell

Before configuring BitLocker DMA policies, confirm that your workstation hardware and firmware support native Kernel DMA Protection. Open an elevated PowerShell prompt and query the system information:

# Query Device Guard security properties for DMA protection
$dg = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard
if ($dg.AvailableSecurityProperties -contains 3) {
    Write-Host "Kernel DMA Protection hardware/firmware support: AVAILABLE" -ForegroundColor Green
} else {
    Write-Host "Kernel DMA Protection support: NOT AVAILABLE in BIOS/firmware" -ForegroundColor Red
}

Alternatively, inspect the system summary via msinfo32 or CIM classes:

Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object Name, HypervisorPresent

In the graphical System Information utility (msinfo32.exe), verify that the line item Kernel DMA Protection displays On.

Configuring BitLocker DMA Protection Policy via PowerShell

For systems that lack native pre-boot DMA hardware protection, BitLocker can be configured to block external DMA ports until a user logs in and unlocks the operating system. You can enforce this policy using the Windows Registry via PowerShell:

# Registry path for BitLocker system policies
$Path = "HKLM:\SOFTWARE\Policies\Microsoft\FVE"

if (-not (Test-Path $Path)) {
    New-Item -Path $Path -Force | Out-Null
}

# Disable external DMA ports when the device is locked or pre-boot
Set-ItemProperty -Path $Path -Name "DisableExternalDMAUnderLock" -Value 1 -Type DWord

Setting DisableExternalDMAUnderLock to 1 ensures that Thunderbolt peripherals cannot establish DMA connections while the device is locked or at the Windows logon screen.

Auditing Thunderbolt and USB4 Device Authorization

To view connected Thunderbolt accessories and their current DMA security level, query the NetAdapter or PCI devices in PowerShell:

Get-PnpDevice -Class "System" | Where-Object { $_.FriendlyName -like "*Thunderbolt*" -or $_.FriendlyName -like "*PCI Express Upstream*" } | Select-Object FriendlyName, Status, InstanceId | Format-Table -AutoSize

In Windows 11, Thunderbolt device approval settings are managed in firmware and enforced through the hypervisor, ensuring that unauthenticated dongles are isolated to safe DMA regions.

Enforcing Protection Across Group Policy and Intune

In domain-managed corporate environments, administrators should enforce Kernel DMA Protection using Central Group Policy Objects (GPO):

• GPO Path: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives
• Policy Setting: Enable Disable new DMA devices when this computer is locked.
• MDM / Intune Setting: Configure DeviceLock/PreventExternalDeviceAccessWhileLocked in the Endpoint Protection configuration profile.

Operational Considerations and Peripheral Compatibility

• Thunderbolt Docks and Monitors: Certified Thunderbolt 3 and 4 docks remain fully functional with Kernel DMA Protection enabled; the operating system allocates authorized DMA memory buffers upon connection.
• Legacy External Graphics (eGPU): High-bandwidth external GPU enclosures may prompt for user confirmation or require updated driver packages certified for Windows 11 IOMMU memory remapping.
• Pre-Boot PIN Protection: For maximum physical protection on mobile laptops, combine Kernel DMA Protection with a BitLocker TPM + PIN startup requirement using Enable-BitLocker -Pin.