Skip to content

Instantly share code, notes, and snippets.

@LuemmelSec

LuemmelSec/disabledevicegard.ps1

Created December 1, 2022 08:51
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save LuemmelSec/590012ad04ad5bcfafc3b8257c636938 to your computer and use it in GitHub Desktop.
Save LuemmelSec/590012ad04ad5bcfafc3b8257c636938 to your computer and use it in GitHub Desktop.
Download ZIP
Disable DeviceGuard with UEFI lock
Raw
disabledevicegard.ps1
# Steps needed to disable DeviceGuard with UEFI lock
# Disable DeviceGuard in registry
cmd /c 'REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /f'
cmd /c 'REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" /v "RequirePlatformSecurityFeatures" /f'
cmd /c 'REG DELETE "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /f'
cmd /c 'REG DELETE "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /f'
# Change UEFI settings. Reboot and confirmation needed.
mountvol X: /s
copy-item c:\windows\System32\SecConfig.efi X:\EFI\Microsoft\Boot\SecConfig.efi
cmd /c 'bcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d "DebugTool" /application osloader'
cmd /c 'bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} path "\EFI\Microsoft\Boot\SecConfig.efi"'
cmd /c 'bcdedit /set {bootmgr} bootsequence {0cb3b571-2f2e-4343-a879-d86a476d7215}'
cmd /c 'bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO'
cmd /c 'bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X:'
cmd /c 'bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS'
cmd /c 'bcdedit /set vsmlaunchtype off'
mountvol X: /d
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment