Registry key

Question

Howdy

Would like to know a few things maybe just one for now and yeah im a bit curious about some keys in the registry but there i cant find honest answer or enlight me about it.
For now the only one keys i wanna ask is:

Control\Session Manager\Configuration Manager : VirtualizationEnabled 0-1-2 and what it does.

Control\Lsa\FipsAlgorithmPolicy : Enabled is 0 but what about MDMEnabled and STE ?

Some of my questions are not answerd or can be found anything about them...neither i can find a documentation out there unless i confuse my self with something esle cuz of recommandation google gives or even AI.

Thanks !!!

Answer 1

Dear Baz

Of course. Here are the answers to your questions about those specific registry keys.

Control\Session Manager\Configuration Manager\VirtualizationEnabled

This registry key controls aspects of virtualization-based security (VBS) features in Windows. The values for VirtualizationEnabled determine the operational state of these security features:

• 0: Disables virtualization-based security.
• 1: Enables virtualization-based security. This is the standard setting for features like Hypervisor-Enforced Code Integrity (HVCI).
• 2: Enables VBS with a higher level of security, often including DMA (Direct Memory Access) protection with input/output memory management unit (IOMMU).

---

Control\Lsa\FipsAlgorithmPolicy

This key manages the settings for the Federal Information Processing Standard (FIPS), which dictates the cryptographic algorithms that are approved for use in federal government computer systems.

• Enabled (0): A value of 0 means that the FIPS-compliant algorithm policy is disabled. The operating system will use its standard cryptographic algorithms, which may not all be FIPS-validated. If this were set to 1, it would enforce the use of FIPS-validated algorithms only.
• MDMEnabled: This value relates to Mobile Device Management (MDM) policies. It determines whether FIPS policy can be configured by an MDM service, like Microsoft Intune. A value of 0 (disabled) would mean that MDM cannot control the FIPS setting.
• STE: This likely refers to Secure Telemetry. This value would control whether the telemetry data sent by the system must adhere to FIPS-compliant encryption standards. A value of 0 would indicate that this is not enforced.Of course. Here are the answers to your questions about those specific registry keys. Control\Session Manager\Configuration Manager\VirtualizationEnabled This registry key controls aspects of virtualization-based security (VBS) features in Windows. The values for VirtualizationEnabled determine the operational state of these security features:
  • 0: Disables virtualization-based security.
  • 1: Enables virtualization-based security. This is the standard setting for features like Hypervisor-Enforced Code Integrity (HVCI).
  • 2: Enables VBS with a higher level of security, often including DMA (Direct Memory Access) protection with input/output memory management unit (IOMMU).
  Control\Lsa\FipsAlgorithmPolicy This key manages the settings for the Federal Information Processing Standard (FIPS), which dictates the cryptographic algorithms that are approved for use in federal government computer systems.
  • Enabled (0): A value of 0 means that the FIPS-compliant algorithm policy is disabled. The operating system will use its standard cryptographic algorithms, which may not all be FIPS-validated. If this were set to 1, it would enforce the use of FIPS-validated algorithms only.
  • MDMEnabled: This value relates to Mobile Device Management (MDM) policies. It determines whether FIPS policy can be configured by an MDM service, like Microsoft Intune. A value of 0 (disabled) would mean that MDM cannot control the FIPS setting.
  • STE: This likely refers to Secure Telemetry. This value would control whether the telemetry data sent by the system must adhere to FIPS-compliant encryption standards. A value of 0 would indicate that this is not enforced.

Best Regards,