Reply to thread

Message

<blockquote data-quote="DeepWeb" data-source="post: 779183" data-attributes="member: 63811">&quot;As Windows 10 boots, a series of integrity measurements are taken by Windows Defender System Guard using the device’s Trusted Platform Module 2.0 (TPM). This process and data are hardware isolated away from Windows to help ensure that the measurement data is not subject to the type of tampering that could happen if the platform was compromised. From here, the measurements can be used to determine the integrity of the device’s firmware, hardware configuration state, and Windows boot-related components, just to name a few. After the system boots, Windows Defender System Guard signs and seals these measurements using the TPM, and, upon request a management system, like Intune or System Center Configuration Manager, can acquire them for remote analysis. From here the management system can take a series of actions, such as denying the device access to resources, if Windows Defender System Guard indicates that the device lacks integrity.&quot;<a href="https://cloudblogs.microsoft.com/microsoftsecure/2017/10/23/hardening-the-system-and-maintaining-integrity-with-windows-defender-system-guard/" target="_blank">Hardening the system and maintaining integrity with Windows Defender System Guard - Microsoft Secure</a>So I think you need to have hardware with a TPM 2.0 chip in order to enable it. But I&#039;m not sure. Another place I&#039;ve read that your AV disables firmware protection if it&#039;s not compatible which might explain why it is grayed out for me.</blockquote>

[QUOTE="DeepWeb, post: 779183, member: 63811"] "As Windows 10 boots, a series of integrity measurements are taken by Windows Defender System Guard using the device’s Trusted Platform Module 2.0 (TPM). This process and data are hardware isolated away from Windows to help ensure that the measurement data is not subject to the type of tampering that could happen if the platform was compromised. From here, the measurements can be used to determine the integrity of the device’s firmware, hardware configuration state, and Windows boot-related components, just to name a few. After the system boots, Windows Defender System Guard signs and seals these measurements using the TPM, and, upon request a management system, like Intune or System Center Configuration Manager, can acquire them for remote analysis. From here the management system can take a series of actions, such as denying the device access to resources, if Windows Defender System Guard indicates that the device lacks integrity." [URL='https://cloudblogs.microsoft.com/microsoftsecure/2017/10/23/hardening-the-system-and-maintaining-integrity-with-windows-defender-system-guard/']Hardening the system and maintaining integrity with Windows Defender System Guard - Microsoft Secure[/URL] So I think you need to have hardware with a TPM 2.0 chip in order to enable it. But I'm not sure. Another place I've read that your AV disables firmware protection if it's not compatible which might explain why it is grayed out for me. [/QUOTE]

Verification