Device guard missing on local group policy

Question

Device guard missing on local group policy

Ahmed Selim zoqlaa 20

I want to let device guard appear in local group policy

Can any one support me please ,

Thanks Device guard

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Marcin Policht 109.6K MVP Volunteer Moderator

Download admin templates from https://www.microsoft.com/en-us/download/details.aspx?id=105390 and copy them to C:\Windows\PolicyDefinitions folder

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Ahmed Selim zoqlaa 20 Reputation points

2026-05-24T15:06:02.5666667+00:00

issue still not resolved device guard not showing in local group policy
Marcin Policht 109.6K Reputation points MVP Volunteer Moderator

2026-05-25T03:39:37.2566667+00:00

Try this one:

https://github.com/nsacyber/Windows-Secure-Host-Baseline/blob/master/Windows/Group%20Policy%20Templates/DeviceGuard.admx

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin
Ahmed Selim zoqlaa 20 Reputation points

2026-05-25T14:21:25.4566667+00:00

I used the above direction to add it kindly give me full Steps because I'm keep trying and also the Device Guard still absence and this error is showing, and also the GitHub file you shared for Win10 I using Win 11

I didn't see in improvement

Marcin Policht 109.6K MVP Volunteer Moderator

Try the following

DeviceGuard.admx

<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2015 Microsoft Corporation -->
<policyDefinitions
    xmlns:xsd="http://www.w3.org/2001/xmlschema"
    xmlns:xsi="http://www.w3.org/2001/xmlschema-instance"
    revision="1.0"
    schemaVersion="1.0"
    xmlns="http://schemas.microsoft.com/grouppolicy/2006/07/policydefinitions">

    <policyNamespaces>
        <target
            prefix="deviceguard"
            namespace="Microsoft.Windows.DeviceGuard" />
        <using
            prefix="windows"
            namespace="Microsoft.Policies.Windows" />
    </policyNamespaces>

    <resources minRequiredRevision="1.0" />

    <categories>
        <category
            name="DeviceGuardCategory"
            displayName="$(string.DeviceGuard)">
            <parentCategory ref="windows:System" />
        </category>
    </categories>

    <policies>
        <policy
            name="VirtualizationBasedSecurity"
            clientExtension="{F312195E-3D9D-447A-A3F5-08DFFA24735E}"
            displayName="$(string.VirtualizationBasedSecurity)"
            explainText="$(string.VirtualizationBasedSecurityHelp)"
            presentation="$(presentation.VirtualizationBasedSecurity)"
            class="Machine"
            key="SOFTWARE\Policies\Microsoft\Windows\DeviceGuard"
            valueName="EnableVirtualizationBasedSecurity">

            <parentCategory ref="DeviceGuardCategory" />
            <supportedOn ref="windows:SUPPORTED_Windows_10_0" />

            <elements>
                <enum
                    id="RequirePlatformSecurityFeaturesDrop"
                    valueName="RequirePlatformSecurityFeatures">

                    <item displayName="$(string.SecureBoot)">
                        <value>
                            <decimal value="1" />
                        </value>
                    </item>

                    <item displayName="$(string.SecureBootAndDmaProtection)">
                        <value>
                            <decimal value="3" />
                        </value>
                    </item>
                </enum>

                <enum
                    id="HypervisorEnforcedCodeIntegrityDrop"
                    valueName="HypervisorEnforcedCodeIntegrity">

                    <item displayName="$(string.Disabled)">
                        <value>
                            <decimal value="0" />
                        </value>
                    </item>

                    <item displayName="$(string.EnabledWithUefiLock)">
                        <value>
                            <decimal value="1" />
                        </value>
                    </item>

                    <item displayName="$(string.EnabledWithoutLock)">
                        <value>
                            <decimal value="2" />
                        </value>
                    </item>
                </enum>

                <enum
                    id="CredentialIsolationDrop"
                    valueName="LsaCfgFlags">

                    <item displayName="$(string.Disabled)">
                        <value>
                            <decimal value="0" />
                        </value>
                    </item>

                    <item displayName="$(string.EnabledWithUefiLock)">
                        <value>
                            <decimal value="1" />
                        </value>
                    </item>

                    <item displayName="$(string.EnabledWithoutLock)">
                        <value>
                            <decimal value="2" />
                        </value>
                    </item>
                </enum>
            </elements>
        </policy>
    </policies>

</policyDefinitions>

DeviceGuard.adml

<?xml version="1.0" encoding="utf-8"?>
<!-- (c) 2015 Microsoft Corporation -->
<policyDefinitionResources
    xmlns:xsd="http://www.w3.org/2001/xmlschema"
    xmlns:xsi="http://www.w3.org/2001/xmlschema-instance"
    revision="1.0"
    schemaVersion="1.0"
    xmlns="http://schemas.microsoft.com/grouppolicy/2006/07/policydefinitions">

    <displayName>Device Guard Policy Definitions</displayName>

    <description>
        This file contains the language resources for Device Guard policies.
    </description>

    <resources>
        <stringTable>
            <string id="DeviceGuard">Device Guard</string>

            <string id="VirtualizationBasedSecurity">
                Turn On Virtualization Based Security
            </string>

            <string id="VirtualizationBasedSecurityHelp">
                Configures virtualization-based protection of security-sensitive
                features.
            </string>

            <string id="SecureBoot">Secure Boot</string>

            <string id="SecureBootAndDmaProtection">
                Secure Boot and DMA Protection
            </string>

            <string id="Disabled">Disabled</string>

            <string id="EnabledWithUefiLock">
                Enabled with UEFI Lock
            </string>

            <string id="EnabledWithoutLock">
                Enabled without Lock
            </string>
        </stringTable>

        <presentationTable>
            <presentation id="VirtualizationBasedSecurity">

                <dropdownList
                    refId="RequirePlatformSecurityFeaturesDrop"
                    defaultItem="0">
                    Select Platform Security Level:
                </dropdownList>

                <dropdownList
                    refId="HypervisorEnforcedCodeIntegrityDrop"
                    defaultItem="0">
                    Virtualization Based Protection of Code Integrity:
                </dropdownList>

                <dropdownList
                    refId="CredentialIsolationDrop"
                    defaultItem="0">
                    Credential Guard Configuration:
                </dropdownList>

            </presentation>
        </presentationTable>
    </resources>

</policyDefinitionResources>

Open File Explorer and navigate to your local PolicyDefinitions root folder: C:\Windows\PolicyDefinitions\.
Copy DeviceGuard.admx directly into the C:\Windows\PolicyDefinitions\ folder.
Open the en-US subfolder located at C:\Windows\PolicyDefinitions\en-US\.
Copy DeviceGuard.adml into that en-US folder.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin