AMD-V and IOMMU settings do not enable Kernel DMA protection under Windows 11 Home with BEST

Septimiu · 2025-05-30T09:06:22+00:00

There was an error rendering this rich post.

Hi,

I have a Secure-Boot enabled system running Windows 11 Home. I have been carefully enabling all of the required BIOS settings in my Gigabyte Zen 4 / Zen 5 motherboard in order to enable Kernel DMA protection.

IOMMU is on, and I can see the following security options ready:

this includes the DMA Protection capabilities, but they remain disabled.

They remain disabled because Windows 11 Home doesn't support them:

Could anybody please explain whether Bitdefender Endpoint Security Tools configured through Gravityzone is compatible with my Windows 11 Home machine without DMA Protection?

I have the following options enabled in my posture from BEST:

On-Access ON
Advanced Threat Control ON
Antiexploit ON
Ransomware Mitigation ON
Anti-Tampering (Callback Evasion and Vulnerable Drivers) ON
Content Control ON

Is my system protected from DMA attacks through my antivirus, or does my antivirus require that my Windows has DMA protection for the antivirus to be able to protect me from DMA attacks? Which capabilities does Bitdefender have regarding this attack vector?

Best regards,

Septimiu

Find more posts tagged with

driver

Endpoint Security

Accepted answers

Andrei_S Enterprise

Hello @Septimiu ,

I have confirmation from our Labs teams:

Protections against malicious DMA transfers are provided at the platform level (Intel VT-d, AMD-Vi) and must be enabled and configured by the OS.

This means that these type of attacks are not covered by security solutions as these operate at an upper level and the protection mechanism is set at the platform level. This does not mean that you are not protected if you install our solution, we have other features that can protect you in case of suspicious behavior .

Kind Regards,

Andrei

All comments

Andrei_S Enterprise

Hello @Septimiu ,

I still checking to provide a confirmation for DMA attacks but we do scan the memory and it is part of the Antimalware →On-Access →Process memory feature:

Scans the memory of a process to detect in-memory malicious behavior.

Process memory

And also we have the Advanced Anti-Exploit module:

Advanced Anti-Exploit which catches the latest exploits in real-time and mitigates memory corruption vulnerabilities that can evade other security solutions. It protects the most commonly used applications, such as browsers, Microsoft Office or Adobe Reader, as well as others that you may think of. It watches over system processes and protects against security breaches and hijacking existing processes.

Advanced Anti-Exploit

Kind Regards,

Andrei

Septimiu

Ok, looking forward to any further confirmations.

Because Windows 11 Home use is a big part of my life, it would help to know to which Business Security package I have to upgrade in order to benefit from DMA protection on AMD, or if my Small Business license covers this.

Appreciated!

Andrei_S Enterprise

Hello @Septimiu ,

I have confirmation from our Labs teams:

Protections against malicious DMA transfers are provided at the platform level (Intel VT-d, AMD-Vi) and must be enabled and configured by the OS.

Kind Regards,

Andrei