Configure Thunderbolt and USB4 Security in Windows 11

PCIe tunneling over Thunderbolt and USB4 allows high-speed external devices like external GPUs, high-performance storage, and docks to communicate directly with your system’s memory. While this unlocks peak performance, it also introduces security risks such as Direct Memory Access (DMA) attacks. This guide explains how to check, enable, and configure Kernel DMA Protection and related security policies in Windows 11 to protect your computer against unauthorized PCIe hardware.

Step 1: Check Kernel DMA Protection Status

Windows 11 uses Kernel DMA Protection to shield systems from drive-by DMA attacks using Thunderbolt and USB4 ports.

  1. Press Windows Key + R to open the Run dialog.
  2. Type msinfo32 and press Enter to open System Information.
  3. In the System Summary pane, scroll down to find Kernel DMA Protection.
  4. Verify the value:
    • On: Your system is actively protecting against malicious external DMA devices.
    • Off: Hardware virtualization or firmware-level security is disabled or unsupported.

Step 2: Enable Kernel DMA Protection in UEFI/BIOS

If Kernel DMA Protection is off, it must be enabled within your computer’s firmware.

  1. Restart your PC and press the appropriate key during boot (commonly F2, F10, F12, or Del) to enter BIOS/UEFI settings.
  2. Locate the virtualization and security settings:
    • Intel platforms: Enable Intel Virtualization Technology (VT-x) and Intel Directed I/O (VT-d).
    • AMD platforms: Enable SVM Mode and AMD-Vi (IOMMU).
  3. Locate the Thunderbolt or USB4 configuration menu:
    • Set Thunderbolt Security Level or PCIe Tunneling Security to Kernel DMA Protection (or SL1: User Authorization / SL2: Secure Connect on older firmwares).
    • Enable Pre-boot DMA Protection if available.
  4. Save your changes and restart the computer into Windows 11.

Step 3: Configure DMA Enumeration Policies via Group Policy

Windows 11 Pro, Enterprise, and Education editions allow administrators to control how external PCIe tunneling devices behave when locked or when devices are incompatible with DMA remapping.

  1. Press Windows Key + R, type gpedit.msc, and press Enter.
  2. Navigate to:
    Computer Configuration > Administrative Templates > System > Kernel DMA Protection
  3. Double-click Enumeration policy for external devices incompatible with Kernel DMA Protection.
  4. Set the policy to Enabled.
  5. Under Options, select an enumeration policy:
    • Block All: Blocks any external peripheral that does not support DMA remapping (most secure).
    • Allow only while logged in: Allows devices to connect only after a user successfully logs into Windows.
    • Allow all: Permits all external devices regardless of DMA compatibility (least secure).
  6. Click Apply and then OK.

Step 4: Configure DMA Enumeration Policies via Registry (Windows Home)

For Windows 11 Home edition, you can apply the same security policies using the Windows Registry.

  1. Press Windows Key + R, type regedit, and press Enter.
  2. Navigate to:
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\KernelDMA
    (If the KernelDMA key does not exist, right-click Windows, select New > Key, and name it KernelDMA.)
  3. Right-click in the right pane, select New > DWORD (32-bit) Value, and name it DeviceEnumerationPolicy.
  4. Double-click DeviceEnumerationPolicy and set its value:
    • 0: Block all incompatible devices.
    • 1: Allow devices only while logged in (default).
    • 2: Allow all devices.
  5. Click OK and restart your computer to apply the changes.