Glossary
Kernel DMA Protection
A Windows feature that uses the IOMMU to block external Thunderbolt and PCIe devices from direct memory access until they are trusted.
Direct memory access (DMA) lets devices such as Thunderbolt, USB4 or CFexpress peripherals read and write system memory without the CPU. A malicious device plugged into an unattended or locked laptop can use it to read secrets, including BitLocker keys, or to inject code. Kernel DMA Protection, introduced in Windows 10 1803, uses the system's IOMMU (Intel VT-d or AMD-Vi) to block DMA from external devices whose drivers do not support DMA remapping until a user signs in and unlocks the screen. It must be supported by the firmware and enabled at manufacture, so it cannot be turned on later by policy.
Check its status in msinfo32, under "Kernel DMA Protection". Where it is on, the "Enumeration policy for external devices incompatible with Kernel DMA Protection" setting controls how unsupported devices are treated. On older hardware without it, mitigate DMA risk with a BitLocker pre-boot PIN and by disabling Thunderbolt or new DMA device enumeration while locked.
See Virtualization-based security, HVCI and Kernel DMA protection and BitLocker with TPM and PIN.