cancel
Showing results for 
Search instead for 
Did you mean: 
Reply
CCIIT
Paper Tape
Posts: 1
Registered: ‎01-30-2018
Location: US
Views: 8,657
Message 1 of 8

Device Guard BIOS Setting?

T460s and T470s have a Device Guard setting in the BIOS. According to this article (https://support.lenovo.com/us/en/solutions/ht503039), only ThinkPad devices with this setting are officially supported for Device Guard. However, I would like a more detailed explanation of what the BIOS setting actually does or what feature it enables. We have some older model ThinkPads that meet system requirements for device guard according to Microsoft that do not have the BIOS option for enabling device guard, so we are looking for further information in order to move forward. 

 

Thanks for any input. 

 

Community SeniorMod
Community SeniorMod
Posts: 10,198
Registered: ‎01-01-2010
Location: US
Views: 8,604
Message 2 of 8

Re: Device Guard BIOS Setting?

you might read this:

 

https://blogs.technet.microsoft.com/ash/2016/03/02/windows-10-device-guard-and-credential-guard-demy...

 


Rich


I do not respond to requests for private, one-on-one help. Your questions should be posted in the appropriate forum where they may help others as well.

If a response answers your question, please mark it as the accepted solution.

I am not an employee or agent of Lenovo.
bobNOTurUNCLE
Ctrl-Alt-Del
Posts: 5
Registered: ‎04-09-2019
Location: CA
Views: 4,308
Message 3 of 8

Re: Device Guard BIOS Setting?

I have the same question about this feature, using the X1 extreme; I am worried about the boot order being locked & not being able to use USB Flash to repair / re-install MS OS. For reasons unknown, I cannot place the USB F to the top of the boot order list. Details seem to be scarce on this -even with the instructions!
Lenovo Staff
Lenovo Staff
Posts: 5,984
Registered: ‎10-29-2009
Location: NC
Views: 4,264
Message 4 of 8

Re: Device Guard BIOS Setting?

With Device Guard enabled, boot order is locked to internal drive only.  USB boot is not possible.  But you can always go into BIOS setup and disable Device Guard if you need to boot to USB.

RLangen
Paper Tape
Posts: 1
Registered: ‎10-01-2019
Location: DE
Views: 1,278
Message 5 of 8

Re: Device Guard BIOS Setting?

Does it mean it have nothing to do with the Windows Defender Device Guard? I understand that these are completly different things.

 

1. Device Guard in Bios means it only deny to boot from USB Devices.

 

2. Windows Defender Device Guard is a windows only feature. It has nothing to do with the "Device Guard" setting in the BIOS.

 

Is that correct?

 

 

Edit: I have set the Device Guard in BIOS to DISABLED, but i cannot boot from the USB-Stick. So i think the first rule is wrong...?

 

 

Regards,

 

R. Langen

Highlighted
Lenovo Staff
Lenovo Staff
Posts: 5,984
Registered: ‎10-29-2009
Location: NC
Views: 1,233
Message 6 of 8

Re: Device Guard BIOS Setting?

The Device Guard BIOS setting locks down the boot order to internal HDD/SSD only.  It also configures the other BIOS settings (like Virtualization) which are required for Device Guard.  But you still need to enable Device Guard in Windows if you want to use it.

 

If you have Device Guard disabled and still can't boot from USB stick, it might be something wrong with your USB stick.  What are you trying to boot to, and what are the contents of the USB stick?

ve2mrx
802.11n
Posts: 157
Registered: ‎07-07-2019
Location: CA
Views: 953
Message 7 of 8

Re: Device Guard BIOS Setting?

Hi!

One possibility is that you have Secure Boot still active. Most bootable tools are not boot-signed for Secure Boot.

 

Device Guard does turn ON Secure Boot (as well as change a handfull of others), but disabling Device Guard does not return the settings to their previous state. It's up to you to change the settings back.

 

Martin

I'm a user, NOT a Lenovo employee. If my post helped, consider giving me a Kudos. If I solved your issue, please mark it as Solved.
P52 I7-8750H P1000 FHD 16GB 512GB-SSD 1TB-HDD
ve2mrx
802.11n
Posts: 157
Registered: ‎07-07-2019
Location: CA
Views: 948
Message 8 of 8

Re: Device Guard BIOS Setting?

Windows Defender Device Guard might be a software implementation of Device Guard. I would hope it augments the BIOS capabilities too if enabled, as the BIOS still has a somewhat limited understanding of devices.

 

The idea is to force the computer to boot ONLY to Windows, so Windows can limit or block all other possible boot devices. That explains the need for Secure Boot and locking out external devices.

 

I'm not completely sure yet about why it enables VT tech, but I suspect it's to better protect critical structures in Windows from external tampering by malware. After all, on capable machines, Windows creates a virtual machine in which it partly runs to better defend itself from attack. That way, "normal" users cannot alter critical structures. At least, that's the plan...

 

Martin

I'm a user, NOT a Lenovo employee. If my post helped, consider giving me a Kudos. If I solved your issue, please mark it as Solved.
P52 I7-8750H P1000 FHD 16GB 512GB-SSD 1TB-HDD

Check out current deals!


Shop current deals

Top Kudoed Authors