General: Early Launch Antimalware, Boot-Start Driver Initialization Policy must prevent boot drivers identified as bad

a9b5b413-0fc5-49c2-ab77-6761b329950c

Compromised boot drivers can introduce malware prior to protection mechanisms that load after initialization. The Early Launch Antimalware driver can limit allowed drivers based on classifications determined by the malware protection application. At a minimum, drivers determined to be bad must not be allowed.

Remediation

To fix this edit GPO: Computer Configuration >> Administrative Templates >> System >> Early Launch Antimalware >> "Boot-Start Driver Initialization Policy" to "Not Configured" or "Enabled" with any option other than "All" selected.

STIG: Server: https://www.stigviewer.com/stig/windows_server_2019/2020-06-15/finding/V-93249
Desktop: https://www.stigviewer.com/stig/windows_10/2021-08-18/finding/V-220813