To Enable Kernel-mode Hardware-enforced Stack Protection in the Intune configuration policy

Question

To Enable Kernel-mode Hardware-enforced Stack Protection in the Intune configuration policy

Vinayak Kanavimath 20

Hi Team,

I am trying to enable both Memory Integrity (HVCI) and Kernel-mode Hardware-enforced Stack Protection on Windows 11 devices using Intune.

Currently, I have configured the following Intune policy:

Devices > Configuration Profiles > Settings Catalog > Virtualization Based Technology > Hypervisor Enforced Code Integrity = Enabled

As expected, Memory Integrity is enabled and the toggle is greyed out with the message "This setting is managed by your administrator."

However, Kernel-mode Hardware-enforced Stack Protection remains disabled on all tested devices.

Tested on:

Windows 11 23H2 and 24H2
Lenovo ThinkPad T14 Gen 3
Dell Latitude 7440

According to Microsoft documentation, Kernel-mode Hardware-enforced Stack Protection requires:

VBS enabled
HVCI enabled
Supported hardware (Intel CET / AMD Shadow Stack)
Compatible drivers

All prerequisites appear to be met. I have also tested on multiple modern devices with the same result.

My questions are:

Is there currently a supported Intune Settings Catalog policy or CSP to enable Kernel-mode Hardware-enforced Stack Protection?
Can this setting be enforced and greyed out for users in the same way as Memory Integrity?
If Intune does not currently support this setting, is the recommended approach to use Group Policy, OMA-URI, or a remediation script?
Are there any known limitations or dependencies that would prevent the feature from enabling even when VBS and HVCI are active?

Any guidance or Microsoft-recommended approach would be appreciated.

Thank you.Hi Team,

I am trying to enable both Memory Integrity (HVCI) and Kernel-mode Hardware-enforced Stack Protection on Windows 11 devices using Intune.

Currently, I have configured the following Intune policy:

Devices > Configuration Profiles > Settings Catalog > Virtualization Based Technology > Hypervisor Enforced Code Integrity = Enabled

As expected, Memory Integrity is enabled and the toggle is greyed out with the message "This setting is managed by your administrator."

However, Kernel-mode Hardware-enforced Stack Protection remains disabled on all tested devices.

Tested on:

Windows 11 23H2 and 24H2
Lenovo ThinkPad T14 Gen 3
Dell Latitude 7440

According to Microsoft documentation, Kernel-mode Hardware-enforced Stack Protection requires:

VBS enabled
HVCI enabled
Supported hardware (Intel CET / AMD Shadow Stack)
Compatible drivers

All prerequisites appear to be met. I have also tested on multiple modern devices with the same result.

My questions are:

Is there currently a supported Intune Settings Catalog policy or CSP to enable Kernel-mode Hardware-enforced Stack Protection?
Can this setting be enforced and greyed out for users in the same way as Memory Integrity?
If Intune does not currently support this setting, is the recommended approach to use Group Policy, OMA-URI, or a remediation script?
Are there any known limitations or dependencies that would prevent the feature from enabling even when VBS and HVCI are active?

Any guidance or Microsoft-recommended approach would be appreciated.

Thank you.

0 comments

1 answer

Your answer

Answer 1

This policy setting enables Hardware-enforced Stack Protection for kernel-mode code. Kernel-mode data stacks are hardened with hardware-based shadow stacks, which store intended return address targets to ensure that program control flow is not tampered.

The recommended state for this setting is: Enabled: Enabled in enforcement mode.

Note: Virtualization Based Security (VBS) requires a 64-bit version of Windows with Secure Boot enabled, which in turn requires that Windows was installed with a UEFI BIOS configuration, not a Legacy BIOS configuration. In addition, if running Windows on a virtual machine, the hardware-assisted CPU virtualization feature (Intel VT-x or AMD-V) must be exposed by the host to the guest VM.

More information on system requirements for this feature can be found at Windows Defender Credential Guard Requirements (Windows 10) | Microsoft Docs

Note #2: This specific security feature of VBS is only compatible with Windows 11 Release 22H2 (and newer).

Note #3: Only Intel CPUs from Tiger Lake and beyond or AMD CPUs Zen3 and beyond (both were release in fall 2020) are compatible with this security feature.

Note #4: Credential Guard and Device Guard are not currently supported when using Azure IaaS VMs.

Rationale: This setting stores a copy of the apps shadow stack (intended code execution flow) in the hardware-based (CPU) security feature VBS. This can prevent malware from hijacking an apps code by exploiting memory bugs such as stack buffer overflows, dangling pointers, or uninitialized variables. This allows VBS to shut down any exploit attempts via the modification of the intended code execution flow.

Impact: This setting is dependent upon Virtualization Based Protection of Code Integrity (aka HVCI) first being enabled, in addition to CPU hardware support for shadow stacks. If either HVCI is not enabled or hardware-based shadow stacks are not supported, this setting will have no effect.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled: Enabled in enforcement mode Computer Configuration\Policies\Administrative Templates\System\Device Guard\Turn On Virtualization Based Security: Kernel-mode Hardware-enforced Stack Protection Note: This Group Policy path may not exist by default. It is provided by the Group Policy template DeviceGuard.admx/adml that is included with the Microsoft Windows 11 Release 22H2 Administrative Templates (and newer).

Default Value: Not Configured.

Note #5: Attached image from Intune Turn On Virtualization Based Security