How to Configure Kernel DMA Protection in Windows 11 Using PowerShell

Direct Memory Access (DMA) enables high-speed peripheral buses—such as Thunderbolt, USB4, and PCIe expansion ports—to read and write directly to system memory without taxing the CPU. However, untrusted external peripherals can exploit unconstrained DMA to execute Drive-By DMA attacks, dumping encryption keys or injecting malicious kernel payloads. Windows 11 Kernel DMA Protection uses the Input-Output Memory Management Unit (IOMMU) to block unauthorized DMA transfers until a user unlocks the workstation and approves peripheral access.

Architectural Overview of Kernel DMA Protection

Kernel DMA Protection integrates hardware virtualization features with the Windows kernel:

• IOMMU Page Tables: The operating system isolates peripheral device memory access through virtualized IOMMU remapping, preventing devices from accessing unauthorized physical memory addresses.
• Pre-Boot DMA Remapping: UEFI firmware creates strict DMA boundaries before the Windows bootloader initialises, preventing pre-boot exploits.
• BitLocker Integration: Protects BitLocker encryption keys stored in RAM from being extracted via external Thunderbolt hardware attached to a locked laptop.

Verifying Hardware and Firmware Support via PowerShell

Before configuring policies, confirm that the motherboard and CPU support Kernel DMA Protection:

# Query System Information via PowerShell
Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object -Property DeviceGuardSmartStatus, HypervisorPresent

To inspect detailed DMA Protection status via msinfo32 exported telemetry:

# Check Kernel DMA Protection status
(Get-ComputerInfo).DeviceGuardSecurityServicesConfigured

Alternatively, launch System Information (msinfo32.exe) and inspect the System Summary. Verify that Kernel DMA Protection displays On.

Configuring Thunderbolt and PCI DMA Policies via PowerShell

In enterprise environments, administrators enforce DMA security policies across all external Thunderbolt and USB4 interfaces:

# Define Device Guard and DMA registry path
$DmaRegistryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard"

# Ensure registry key exists
if (-not (Test-Path $DmaRegistryPath)) {
    New-Item -Path $DmaRegistryPath -Force | Out-Null
}

# Enforce external DMA blocking when workstation is locked
New-ItemProperty -Path $DmaRegistryPath -Name "ExternalDmaBlocking" -Value 1 -PropertyType DWord -Force

# Verify configured registry entry
Get-ItemProperty -Path $DmaRegistryPath -Name "ExternalDmaBlocking"

Setting ExternalDmaBlocking = 1 ensures that connected Thunderbolt docks and PCIe devices can only access memory while the PC is unlocked.

Verifying Peripheral Access Controls in Device Manager

Inspect peripheral DMA remapping status using PowerShell to ensure connected controllers participate in IOMMU virtualization:

# Query PCI devices with DMA remapping support
Get-PnpDevice -Class "System" | Where-Object { $_.FriendlyName -like "*PCI Express Root Port*" -or $_.FriendlyName -like "*Thunderbolt*" } | Select-Object FriendlyName, InstanceId, Status

Under device details, verify the property DMA Remapping Policy reports value 1 (Supported / Enabled). External devices attached to these ports are strictly confined to their allotted IOMMU memory slices.