In this case, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. With appropriate hardware, Device Guard can use the new virtualization-based security in Windows 10 to isolate the Code Integrity service from the Microsoft Windows kernel itself.

With hardware that meets basic requirements, it also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code. If the app isn’t trusted it can’t run, period. Technical information Device Guardĭevice Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications that you define in your code integrity policies. All of your users are local administrator on their laptops and as an administrator you want to protect your employees from installing and running malicious or unknown software with new Windows 10 technology with the highest possible security but they should be able to install any application from the Windows Store.

On these laptops they will run standard Windows Applications, Windows Store applications and an unsigned line of business application (7-zip).

In your company your employees are using domain joined Windows 10 laptops.

How to open .cdf files in windows 8