Safety principle
Checking the protection state only requires reading Windows information. Do not disable IOMMU, Secure Boot, BitLocker, or another security control merely to make an unknown device operate.
01
How Windows restricts DMA
Windows uses the system IOMMU to isolate device memory access. Drivers compatible with DMA remapping allow a device to operate inside assigned regions. External devices with incompatible drivers may be blocked according to sign-in state and administrator policy.
This is a platform capability formed by devices, drivers, firmware, and the operating system—not merely one BIOS switch.
02
Check the current state safely
Method one: open Windows Security, then select Device security → Core isolation details → Memory access protection.
Method two: run msinfo32.exe and review the Kernel DMA Protection entry in System Summary.
03
Why systems report different states
Support depends on correct UEFI implementation, IOMMU availability—Intel VT-d or AMD-Vi—PCIe platform control, Windows version, and driver compatibility. An Off or missing status does not by itself prove a Windows fault or establish that a device is safe.
04
Scope and limitations
Microsoft documents Kernel DMA Protection primarily as runtime protection after Windows loads; pre-boot DMA protection remains a firmware responsibility. It does not cover every legacy bus, so physical access control, trusted firmware, signed drivers, disk encryption, and asset management remain important.
05
Safe response to an unexpected status
Escalate uncertain cases to an authorized administrator or support owner.
- Record the exact board model, UEFI version, and Windows build
- Review official board and device-vendor documentation
- Use only formally released and signed firmware and drivers
- Prepare recovery material, backups, and rollback before updates
FAQ
Frequently asked questions
01Is Kernel DMA Protection enabled automatically on supported systems?
Microsoft states that systems meeting the full platform requirements normally enable it automatically. Confirm the actual state in Windows Security or System Information.
02Does Off mean that the computer is broken?
Not necessarily. Platform firmware, IOMMU, ACPI declarations, Windows version, or driver conditions may not meet the feature requirements.
03Is Kernel DMA Protection the same as Memory Integrity?
No. They are different Windows security controls, even though both may appear in device-security settings.
04Does it protect the pre-boot stage?
Windows runtime protection begins after the operating system loads. Platform firmware is responsible for pre-boot DMA protection.
SOURCES