PowerShell: Check Kernel DMA Protection Status
Need to check whether Kernel DMA Protection is available - a security feature that blocks unauthorized memory access from external devices like Thunderbolt or USB4 peripherals? This one-liner checks it directly.
Prerequisites:
- Privileges: None
- Module: Built-in, no import needed
Quick Command:
(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).AvailableSecurityProperties -contains 3Example Output:
True📦
Want all of them at once?
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
How It Works:
- AvailableSecurityProperties is an array listing which hardware-based security features are available on the system - each feature is represented by a specific number (e.g. 1 = hypervisor support, 2 = Secure Boot, 3 = DMA protection).
- -contains 3 checks whether that array includes the value 3, returning a clean True/False instead of a raw array you'd have to interpret manually.
- Kernel DMA Protection blocks external peripherals (like Thunderbolt or USB4 devices) from reading or writing system memory without authorization - it protects against so-called "drive-by DMA attacks", where an attacker with brief physical access to a device can extract data using specialized hardware.
Pro Tip:
You can also verify this outside PowerShell by running msinfo32.exe and checking the "Kernel DMA Protection" field on the System Summary page - useful for a quick GUI-based confirmation.