Windows users should verify their Kernel DMA Protection status in System Information to ensure Thunderbolt and USB4 devices cannot bypass lock screen security to access system memory.

Key Points

• Windows lock screens do not automatically prevent PCIe-connected peripherals from accessing system RAM via Direct Memory Access (DMA).
• Kernel DMA Protection uses an Input-Output Memory Management Unit (IOMMU) to restrict external devices to specific, safe memory regions.
• Users can check their security status by typing "MSInfo32" in the Windows Run dialog and locating the "Kernel DMA Protection" field.
• The feature is hardware-dependent and requires specific UEFI and chipset support, meaning it cannot be manually enabled on incompatible systems.
• Older interfaces like FireWire and ExpressCard are not covered by Kernel DMA Protection, leaving them vulnerable to unauthorized memory access.

Why it Matters

This security feature is critical for protecting sensitive data, such as authentication credentials, from physical "drive-by" attacks using malicious peripherals. Understanding your device's DMA protection status helps identify potential hardware vulnerabilities that remain active even when a computer is locked.