Page 139 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
AD-backed Windows LAPS requires new forest schema elements installed with Update-LapsADSchema. The schema includes separate attributes for expiration, clear password, encrypted password, history, and encrypted DSRM password.
Read the playbook
The TPM enters lockout to resist tampering or repeated malicious authorization attempts. During lockout it rejects authorization-dependent commands but preserves at least one owner attempt to reset lockout.
Read the briefing
Windows exposes TPM Services policy under Computer Configuration administrative templates. The policies control blocked TPM commands, owner-authorization availability, and standard-user lockout duration and thresholds.
Read the checklist
Kernel DMA Protection prevents unauthorized memory access by external DMA-capable peripherals. Thunderbolt, USB4, and CFexpress devices can access memory without CPU involvement, creating drive-by DMA risk.
Read the explainer
System Guard Secure Launch and SMM protection improve Windows startup security. Secure Launch requires a supported processor and Microsoft documents how to verify that it is configured and running.
Read the guide
Advanced audit settings reside under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → System Audit Policies and are available through Local Security Policy or Group Policy.
Read the playbook
BitLocker policy can place a custom recovery message and URL on the preboot screen, including a self-service recovery portal, internal support site, or support phone number.
Read the briefing
BitLocker recovery can be user self-service or a controlled helpdesk process. Microsoft documents recovery-information retrieval for Entra joined, hybrid joined, and AD joined devices.
Read the checklist
Network Unlock can automatically unlock BitLocker OS volumes on a wired corporate network during reboot. It requires compatible UEFI DHCP support and combines a TPM-held key with network key material handled by the unlock server.
Read the explainer
Zero Trust DNS uses a deny-by-default outbound model; traffic is allowed when its destination came from the trusted resolver or an administrator placed it on the approved list.
Read the guide