Security Parameters
SOTI checks the following parameters for compliance by the Microsoft Health Attestation Reports.
Tip: Search for devices
with specific Health Attestation properties to triage them as required. See Searchable Health Attestation Properties.
Parameter | Description | Compliant Status |
---|---|---|
Attestation Identity Key (AIK) | Indicates that the device has an endorsement key certificate. | Present on device |
Bitlocker Status | Protects data on the device drive from unauthorized access. | Enabled |
Boot debug is disabled |
Indicates a device used for development and testing, which is typically less secure. | Disabled |
Boot Manager Version | Indicates the version of the Boot Manager and facilitates tracking of the security of the boot sequence and environment. | Running latest version |
Code Integrity | Restricts code execution to integrity verified code. | Enabled |
Code Integrity Version | Helps in ensuring usage of latest code for performing integrity checks during the boot sequence | Running latest version |
Data Execution Prevention | Data Execution Prevention policy defines a set of hardware and software technologies that perform further checks on memory to help prevent malicious code from running on a system. | Enabled |
Early launch anti-malware | Protect computers in your network when they start up and before third-party drivers initialize. | Enabled |
OS Kernel Debugging | Indicates a device used for development and testing, which is typically less secure. | Disabled |
Platform Configuration Register[0] | Represents a consistent view of the Host Platform between boot cycles. |
|
Safe Mode | Starts your computer in a limited state. | Disabled |
Secure Boot | Forces system to boot to a factory trusted state. | Enabled |
Test Signing | Does not enforce signature validation during boot and enables unsigned drivers to load. | Disabled |
Virtual Secure Mode | A container that protects high value assets from a compromised kernel. | Enabled |
Windows Pre-Installation Environment | Minimal operating system with limited services used to prepare a computer for Windows installation, to copy disk images from a network file server, and to start Windows Setup. | Disabled |