Page 236 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
Kernel DMA Protection prevents unauthorized memory access by external DMA-capable peripherals. Thunderbolt, USB4, and CFexpress devices can access memory without CPU involvement, creating drive-by DMA risk.
Read the explainer
System Guard Secure Launch and SMM protection improve Windows startup security. Secure Launch requires a supported processor and Microsoft documents how to verify that it is configured and running.
Read the guide
Advanced audit settings reside under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → System Audit Policies and are available through Local Security Policy or Group Policy.
Read the playbook
BitLocker policy can place a custom recovery message and URL on the preboot screen, including a self-service recovery portal, internal support site, or support phone number.
Read the briefing
BitLocker recovery can be user self-service or a controlled helpdesk process. Microsoft documents recovery-information retrieval for Entra joined, hybrid joined, and AD joined devices.
Read the checklist
Network Unlock can automatically unlock BitLocker OS volumes on a wired corporate network during reboot. It requires compatible UEFI DHCP support and combines a TPM-held key with network key material handled by the unlock server.
Read the explainer
Zero Trust DNS uses a deny-by-default outbound model; traffic is allowed when its destination came from the trusted resolver or an administrator placed it on the approved list.
Read the guide
Windows Firewall rules can allow an application, port, protocol, or predefined traffic type. Inbound and outbound precedence, local policy merge, application rules, and automatic rule creation affect the result.
Read the playbook
Windows Firewall can log dropped packets and successful connections. Microsoft documents configuration through CSP or Group Policy together with parsing and missing-log troubleshooting.
Read the briefing
UAC reduces malware risk by limiting execution with administrator privileges. Applications needing an administrator token prompt for consent, while child processes inherit the parent token only at the same integrity level.
Read the checklist