Is UEFI lock required for Encrypted Azure VM

Question

Hello,

We are asked to apply a New Security Control –“ Protective Process Light for LSASS should be enabled with a UEFI lock.”

We are using Gen2 Azure Windows Server 2019 and selected 'Standard' as security type when the VMs were created.

The OS disk has encryption enabled using SSE with PMK & ADE. Also, using Azure Disk Encryption in the Extension.

Our question is do we require UEFI lock for these VMs? Will it cause any issue?

Thanks in advance.

Answer 1

Hi @Farzana Mustafa

The security control you mentioned, "Protective Process Light for LSASS should be enabled with a UEFI lock," is a best practice for securing Windows servers. It is recommended to enable this security control to protect against credential theft attacks.

Regarding your question, enabling UEFI lock on your Azure Windows Server 2019 VMs should not cause any issues as long as the VMs are compatible with UEFI. Gen2 Azure VMs support UEFI boot mode, so you should be able to enable UEFI lock without any issues.

However, before enabling UEFI lock, I would recommend you to check if your VMs are compatible with UEFI and if there are any specific requirements for enabling UEFI lock on Azure VMs. You can refer to the document "Secure the Windows 10 boot process with Secure Boot and UEFI" for more information on how to enable UEFI lock on Windows servers.

Additionally, you should also test the UEFI lock after enabling it to ensure that the VMs are booting up properly and there are no issues.

I hope this helps you to make an informed decision on enabling UEFI lock on your Azure Windows Server 2019 VMs.

<If this does answer your question, please accept it as the answer as a token of appreciation.>