|
| 1 | +--- |
| 2 | +title: Configure Dev Drive policy for enterprise business devices |
| 3 | +description: Group Policy managers will need to make policy updates in order to enable Dev Drive on Windows 11 devices. Find guidance for using Microsoft InTune, Configuration Manager, or Local Group Policy Editor to update policy, enable Dev Drive, and set security filter permissions. |
| 4 | +author: mattwojo |
| 5 | +ms.author: mattwoj |
| 6 | +manager: jken |
| 7 | +ms.topic: article |
| 8 | +ms.date: 09/26/2023 |
| 9 | +--- |
| 10 | + |
| 11 | +# How to configure Dev Drive security policy for enterprise business devices |
| 12 | + |
| 13 | +Enterprise-level administrators are often responsible for managing security across many different Windows devices within an organization. There are multiple ways to configure the policies that control whether new features are enabled as the become available in new Windows releases. This guide covers important information about Windows 11 [Dev Drive](index.md) storage volume features and how to configure Group Policy for your organization to enable developers to use this performance-optimized storage format while maintaining security and control over attaching file system filters. |
| 14 | + |
| 15 | +Guidance on how to enable Group Policy can be found below using your preferred policy management tool: |
| 16 | + |
| 17 | +- [Microsoft Intune](#use-microsoft-intune-to-update-group-policy-for-dev-drive), |
| 18 | +- [Microsoft Configuration Manager](#use-microsoft-configuration-manager-to-update-group-policy-for-dev-drive) (ConfigMgr, formerly MEMCM/SCCM), or |
| 19 | +- [Windows 11 Local Group Policy Editor](#use-windows-11-local-group-policy-editor-to-update-group-policy-for-dev-drive). |
| 20 | + |
| 21 | +## Prerequisites |
| 22 | + |
| 23 | +- Windows 11, Build #10.0.22621.2338 or later ([Check for Windows updates](ms-settings:windowsupdate)) |
| 24 | +- Recommend 16gb memory (minimum of 8gb) |
| 25 | +- Minimum 50gb free disk space |
| 26 | +- Dev Drives are available on all Windows SKU versions. |
| 27 | + |
| 28 | +## Temporary enterprise feature control disables Dev Drive |
| 29 | + |
| 30 | +New features and enhancements are introduced through the monthly cumulative update to provide continuous innovation for Windows 11. To give organizations time to plan and prepare, some of these new features are temporarily turned off by default using [Temporary enterprise feature control in Windows 11](/windows/whats-new/temporary-enterprise-feature-control). |
| 31 | + |
| 32 | +**Dev Drive will be automatically disabled for devices that have their Windows updates managed by policies.** Disabling the ability to create a Dev Drive is only temporary to allow security administrators time to decide on and roll out new policy updates. Guidance for determining and configuring those policy updates is outlined below. |
| 33 | + |
| 34 | +## Determine Group Policy for Dev Drive storage enablement and antivirus filter security |
| 35 | + |
| 36 | +Group Policy is a Windows feature that lets enterprise administrators manage the settings of work devices and have some control over what setting changes user accounts (local administrators) are allowed to make in a business environment. |
| 37 | + |
| 38 | +Antivirus filters, including both Microsoft Defender and 3rd-party antivirus filters, are attached to a Dev Drive by default. The default settings for Dev Drive storage volumes also allow local device administrators to control what filters are attached. This means that a local device administrator could configure the system to remove default antivirus filters, so that no antivirus filters are attached to the Dev Drive. If this is a concern, Group Policy may be configured to ensure that antivirus filters remain attached when Dev Drive is enabled. Additionally, an allowed file system filter list may be defined. |
| 39 | + |
| 40 | +## Update Group Policy to enable Dev Drive |
| 41 | + |
| 42 | +The **Enable Dev Drive** policy settings include: |
| 43 | + |
| 44 | +- **Not Configured**: By default, the Dev Drive storage volume option will be turned off under the Temporary enterprise feature conrol policy until enabled by an enterprise administrator in the Group Policy. |
| 45 | +- **Enabled**: Enabling turns on the option to create [Dev Drive](index.md) storage volumes. |
| 46 | +- **Options - Let antivirus filter protect Dev Drives**: Dev Drives are optimized for performance in developer scenarios, allowing the **local** administrator (user account) to choose which file system filters are attached. This also allows local administrators to detach the default antivirus features, unless the option to "Let antivirus filter protect Dev Drives" is checked. Checking this option forces default antivirus filters to remain attached. |
| 47 | +- **Disabled**: Disabling this setting turns off the ability to create and use Dev Drive storage volumes. |
| 48 | + |
| 49 | +## Update Dev Drive filter attach policy |
| 50 | + |
| 51 | +Additionally, there is a **Dev Drive filter attach policy** setting, which offers enterprise administrators control over what filters can be attached to a Dev Drive. Settings include: |
| 52 | + |
| 53 | +- **Not Configured**: By default, Dev Drive is optimized for performance, with Microsoft Defender and 3rd-party antivirus filters attached, but with no other file system filters. This default setting allows local administrators to attach or detach filters, including the default antivirus filters. Checking the optional "Let antivirus filter protect Dev Drives" in the Enable Dev Drive policy above will force antivirus filters to remain attached even if no further filter policy is defined. |
| 54 | +- **Enabled**: Local administrators (user accounts) are allowed to attach or detach filters. Adding a Filter list enables enterprise administrators (at the Group Policy Doman level) to define what filters can be attached. Not including a filter list will enable any filter to be attached. |
| 55 | +- **Disabled**: Local administrators (user accounts) are not allowed to attach or detach filters. |
| 56 | + |
| 57 | +There are a few ways to enable the Dev Drive feature and update Group Policy: |
| 58 | + |
| 59 | +- [Update Group Policy using Microsoft InTune](#use-microsoft-intune-to-update-group-policy-for-dev-drive) |
| 60 | +- [Update Group Policy using Microsoft Configuration Manager](#use-microsoft-configuration-manager-to-update-group-policy-for-dev-drive) |
| 61 | +- [Update Group Policy using Windows 11 Local Group Policy Editor](#use-windows-11-local-group-policy-editor-to-update-group-policy-for-dev-drive) |
| 62 | + |
| 63 | +## Use Microsoft InTune to update Group Policy for Dev Drive |
| 64 | + |
| 65 | +To update Group Policy and enable [Dev Drive](index.md) using [Microsoft InTune)](/mem/intune/): |
| 66 | + |
| 67 | +1. Open the InTune portal ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and log in with your credentials. |
| 68 | + |
| 69 | +2. Create a profile: |
| 70 | + 1. Devices > Windows > Configuration pofiles > Create profile |
| 71 | + 1. Select Platform > Windows 10 and later |
| 72 | + 1. Select Profile type > Settings catalog |
| 73 | + |
| 74 | +  |
| 75 | + |
| 76 | +3. Set a custom profile name and description. |
| 77 | + |
| 78 | +  |
| 79 | + |
| 80 | +4. Configure Dev Drive related settings: |
| 81 | + 1. Search “Dev Drive” in settings picker or navigate to “Administrative Templates\System\Filesystem” |
| 82 | + 1. Select Dev Drive related policies: **Enable Dev Drive** and **Let antivirus filter protect Dev Drives**, **Dev Drive filter attach policy** and **Filter list** |
| 83 | + |
| 84 | +  |
| 85 | + |
| 86 | +5. Configure the Dev Drive policy settings, complete the remaining configuration of Scope tags and Assignments, then select **Create** |
| 87 | + |
| 88 | +  |
| 89 | + |
| 90 | +## Use Microsoft Configuration Manager to update Group Policy for Dev Drive |
| 91 | + |
| 92 | +To update Group Policy and enable [Dev Drive](index.md) using [Microsoft Configuration Manager](/mem/configmgr/) (ConfigMgr, formerly MEMCM/SCCM), you can use the following PowerShell scripts. ([What is Configuration Manager?](/mem/configmgr/core/understand/introduction)) |
| 93 | + |
| 94 | +The [Configuration Manager console](/mem/configmgr/core/understand/introduction#BKMK_Console) has an integrated ability to run PowerShell scripts to update Group Policy settings across all computers in your network. |
| 95 | + |
| 96 | +1. Open the Microsoft Configuration Manager console. Select **Software Library** > **Scripts** > **Create Script**. |
| 97 | + |
| 98 | +  |
| 99 | + |
| 100 | +2. Enter the script name (for example, Dev Drive demo), description (Demo configuration to enable Dev Drive settings), language (PowerShell), timeout seconds (180), and then paste in the following "Dev Drive demo" script example to use as a template. |
| 101 | + |
| 102 | + ```powershell |
| 103 | + ###### |
| 104 | + #ConfigMgr Management of Dev Drive |
| 105 | + #Dev Drive is a new form of storage volume available to improve performance for key developer workloads. |
| 106 | + #Check Log File for enforcement status - C:\Windows\temp\ConfigDevDrive-<TimeStamp>.log |
| 107 | + ###### |
| 108 | +
|
| 109 | + Function Set-RegistryKeyValue{ |
| 110 | + param ( |
| 111 | + $KeyPath, |
| 112 | + $ValueName, |
| 113 | + $Value, |
| 114 | + $PropertyType, |
| 115 | + $LogFile |
| 116 | + ) |
| 117 | + Try { |
| 118 | + If (!(Test-path $KeyPath)) { |
| 119 | + $Path = ($KeyPath.Split(':'))[1].TrimStart("\") |
| 120 | + ([Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine,$env:COMPUTERNAME)).CreateSubKey($Path) |
| 121 | + New-ItemProperty -path $KeyPath -name $ValueName -value $Value -PropertyType $PropertyType -Force | Out-Null |
| 122 | + } |
| 123 | + Else { |
| 124 | + New-ItemProperty -path $KeyPath -name $ValueName -value $Value -PropertyType $PropertyType -Force | Out-Null |
| 125 | + } |
| 126 | + $TestValue = (Get-ItemProperty -Path $KeyPath)."$ValueName" |
| 127 | + If ($TestValue -eq $Value){ Add-Content -Path $LogFile -Value "$KeyPath,$ValueName,$Value,$PropertyType,$TestValue,Success" } |
| 128 | + Else { Add-Content -Path $LogFile -Value "$KeyPath,$ValueName,$Value,$PropertyType,$TestValue,Failure" } |
| 129 | + } |
| 130 | + Catch { |
| 131 | + $ExceptionMessage = $($PSItem.ToString()) -replace [Environment]::NewLine,""; |
| 132 | + Add-Content -Path $LogFile -Value "$KeyPath,$ValueName,$Value,$PropertyType,$TestValue,Failure - $ExceptionMessage" |
| 133 | + } |
| 134 | + } |
| 135 | + $ExecutionTime = Get-Date |
| 136 | + $StartTime = Get-Date $ExecutionTime -Format yyyyMMdd-HHmmss |
| 137 | + $LogFile = "C:\Windows\temp\ConfigDevDrive-$StartTime.log" |
| 138 | + Add-Content -Path $LogFile -Value "------------------------------------V 1.0 $ExecutionTime - Execution Starts -------------------------------------------" |
| 139 | + Add-Content -Path $LogFile -Value "RegistryKeyPath,ValueName,ExpectedValue,PropertyType,CurrentValue,ComparisonResult" |
| 140 | + #Set up a Dev Drive |
| 141 | + Set-RegistryKeyValue -KeyPath "HKLM:\System\CurrentControlSet\Policies\" -ValueName "FsEnableDevDrive" -Value "1" -PropertyType "Dword" -LogFile $LogFile |
| 142 | + Set-RegistryKeyValue -KeyPath "HKLM:\System\CurrentControlSet\Policies\" -ValueName "FltmgrDevDriveAllowAntivirusFilter" -Value "1" -PropertyType "Dword" -LogFile $LogFile |
| 143 | + Set-RegistryKeyValue -KeyPath "HKLM:\System\CurrentControlSet\Policies\" -ValueName "FltmgrDevDriveAttachPolicy" -Value "PrjFlt, MsSecFlt, WdFilter, bindFlt, wcifs, FileInfo" -PropertyType "MultiString" -LogFile $LogFile |
| 144 | + $ExecutionTime = Get-Date |
| 145 | + Add-Content -Path $LogFile -Value "------------------------------------ $ExecutionTime - Execution Ends -------------------------------------------" |
| 146 | + -------------------- |
| 147 | + `````` |
| 148 | +
|
| 149 | +3. When adding a new script, you must select and approve it. The approval state will change from "Waiting for approval" to "Approved". |
| 150 | +
|
| 151 | +4. Once approved, right-click a single device or device collection and select **Run script**. |
| 152 | +
|
| 153 | +  |
| 154 | +
|
| 155 | +5. On the script page of the Run Script wizard, choose your script from the list (*Dev Drive demo* in our example). Only approved scripts are displayed. Select **Next** and complete the wizard. |
| 156 | +
|
| 157 | +See [Query policies with FsUtil](#query-policies-with-fsutil) to check that Group Policy settings were accurately updated. |
| 158 | +
|
| 159 | +To learn more, see [Create and run PowerShell scripts from the Configuration Manager console](/mem/configmgr/apps/deploy-use/create-deploy-scripts). |
| 160 | +
|
| 161 | +## Use Windows 11 Local Group Policy Editor to update Group Policy for Dev Drive |
| 162 | +
|
| 163 | +To update Group Policy and enable [Dev Drive](index.md) using Windows 11 Local Group Policy Editor: |
| 164 | +
|
| 165 | +1. Open the **Local Group Policy Editor** in Windows Control Panel. |
| 166 | +
|
| 167 | +  |
| 168 | +
|
| 169 | +2. Under **Computer Configuration**, select **Administrative Templates** > **System** > **Filesystem** and in the Setting list, select **Enable dev drive**. |
| 170 | +
|
| 171 | +  |
| 172 | +
|
| 173 | +3. Select **Enabled** to enable Dev Drive in your Group Policy. |
| 174 | +
|
| 175 | +  |
| 176 | +
|
| 177 | +To update this filter attach policy, select **Dev Drive filter attach policy** from the **Local Group Policy Editor** in Windows Control Panel. |
| 178 | +
|
| 179 | + |
| 180 | +
|
| 181 | +## Query policies with FsUtil |
| 182 | +
|
| 183 | +FSUtil can be used to query the Group Policy configured for Dev Drive. Here is the output from an FsUtil query for a Dev Drive Group Policy configured to: |
| 184 | +
|
| 185 | +- Enable Dev Drive |
| 186 | +- Let antivirus filters protect Dev Drives (`MsSecFlt`) |
| 187 | +- `FileInfo` minifilter has been added to the **Filter list** as an allowed filter |
| 188 | +
|
| 189 | +Enter the FSUtil command: |
| 190 | +
|
| 191 | +```powershell |
| 192 | +fsutil devdrv query |
| 193 | +``` |
| 194 | + |
| 195 | +Result: |
| 196 | + |
| 197 | +```powershell |
| 198 | +Developer volumes are enabled. |
| 199 | +Developer volumes are protected by antivirus filter, by group policy. |
| 200 | +Filters allowed on any developer volume, by group policy: |
| 201 | + MsSecFlt |
| 202 | +Filters allowed on any developer volume: |
| 203 | + FileInfo |
| 204 | +``` |
| 205 | + |
| 206 | +This same query can be run on a specific Dev Drive to see the attached filters. To run the command on a specific Dev Drive, enter the command: |
| 207 | + |
| 208 | +```powershell |
| 209 | +fsutil devdrv query d: |
| 210 | +``` |
| 211 | + |
| 212 | +Result: |
| 213 | + |
| 214 | +```powershell |
| 215 | +This is a trusted developer volume. |
| 216 | +Developer volumes are protected by antivirus filter, by group policy. |
| 217 | +Filters allowed on any developer volume, by group policy: |
| 218 | + MsSecFlt |
| 219 | +Filters allowed on any developer volume: |
| 220 | + FileInfo |
| 221 | +Filters currently attached to this developer volume: |
| 222 | + MsSecFlt, WdFilter, FileInfo |
| 223 | +``` |
| 224 | + |
| 225 | +## Additional resources |
| 226 | + |
| 227 | +- [Delivering continuous innovation in Windows 11 (Microsoft Support)](https://support.microsoft.com/windows/delivering-continuous-innovation-in-windows-11-b0aa0a27-ea9a-4365-9224-cb155e517f12) |
| 228 | + |
| 229 | +- [Temporary enterprise feature control in Windows 11](/windows/whats-new/temporary-enterprise-feature-control) |
| 230 | + |
| 231 | +- [Manage additional Windows Update settings (Windows Deployment)](/windows/deployment/update/waas-wu-settings) |
0 commit comments