Windows 10/8 menyertakan fitur keamanan baru yang disebut Secure Boot , yang melindungi konfigurasi dan komponen boot Windows , dan memuat driver ^(Windows)Early Launch Anti-malware ( ELAM ). Driver ini dimulai sebelum driver boot-start lainnya dan memungkinkan evaluasi driver tersebut dan membantu kernel Windows^{(Windows kernel)} memutuskan apakah mereka harus diinisialisasi. Dengan diluncurkan pertama kali oleh kernel, ELAM dipastikan diluncurkan sebelum perangkat lunak pihak ketiga lainnya. Oleh karena itu, ia dapat mendeteksi malware dalam proses boot itu sendiri dan mencegahnya memuat atau menginisialisasi.

Peluncuran^{(Launch Anti-Malware)} Awal Perlindungan Anti-Malware

Windows Defender memanfaatkan Early-Launch Anti-Malware , dan oleh karena itu, Anda melihat bahwa itu tidak lagi dimuat setelah proses start-up selesai, tetapi lebih awal selama proses boot.

Perangkat lunak antivirus pihak ketiga juga dapat memanfaatkan teknologi ELAM . Untuk melakukannya, mereka harus mengintegrasikan kemampuan Early Launch Anti-Malware ( ELAM ) yang sama dalam perangkat lunak mereka. Untuk membantu vendor perangkat lunak keamanan memulai, Microsoft telah merilis whitepaper  yang menyediakan informasi tentang pengembangan driver Early Launch Anti-Malware ( ELAM ) untuk Windowssistem operasi. Ini memberikan panduan bagi pengembang anti-malware untuk mengembangkan driver anti-malware yang diinisialisasi sebelum driver boot-start lainnya, dan memastikan bahwa driver berikutnya tidak mengandung malware. Beberapa perusahaan antivirus, yang telah merilis solusi terbaru mereka untuk Windows , telah menggabungkan teknologi ini.

Pengandar boot-start Antimalware Peluncuran^{(Launch Antimalware)} Awal telah mengklasifikasikan pengandar sebagai berikut:

1. Baik^(Good) : Pengemudi telah ditandatangani dan belum diutak-atik.
2. Buruk^(Bad) : Pengemudi telah diidentifikasi sebagai malware. Disarankan agar Anda tidak mengizinkan pengandar buruk yang diketahui untuk diinisialisasi.
3. Bad, but required for boot: The driver has been identified as malware, but the computer cannot successfully boot without loading this driver.
4. Unknown: This driver has not been attested to by your malware detection application and has not been classified by the Early Launch Antimalware boot-start driver.

By default, Windows 10 loads those drivers which have been classified as Good, Unknown, and Bad but Boot Critical; ie 1, 3 and 4 above. Bad drivers are not loaded.

Configure Boot-Start Driver Initialization Policy using Group Policy Editor

Meskipun pengaturan ini sebaiknya dibiarkan pada nilai defaultnya, jika diinginkan, Anda dapat mengubah pengaturan ini melalui Editor Kebijakan Grup^{(Group Policy Editor)} . Untuk melakukannya, buka menu WinX > Run > gpedit.msc > Tekan Enter^{(Hit Enter)} . Navigasikan^(Navigate) ke setelan kebijakan berikut:

Computer Configuration > Administrative Templates >  System > Early Launch Antimalware

Di panel kanan, klik dua kali pada  Kebijakan Inisialisasi Pengandar Boot-Start^{(Boot-Start Driver Initialization Policy)} untuk mengonfigurasinya.

Anda akan melihat konfigurasi default Not Configured . Jika Anda menonaktifkan atau tidak mengonfigurasi pengaturan kebijakan ini, pengandar boot-start yang ditentukan sebagai Baik, Tidak Dikenal^(Unknown) , atau Buruk^(Bad) tetapi Boot Kritis^{(Boot Critical)} akan diinisialisasi, dan inisialisasi pengandar yang ditetapkan sebagai Buruk^(Bad) akan dilewati.

Jika Anda Mengaktifkan^(Enable) pengaturan kebijakan ini, Anda akan dapat memilih driver boot-start mana yang akan diinisialisasi saat komputer dinyalakan lagi.

Jika Anda menggunakan Windows 10/8 , Anda ingin memeriksa apakah perangkat lunak anti-malware Anda menyertakan driver boot-start Early Launch Antimalware . Jika tidak, semua driver boot-start akan diinisialisasi, dan Anda tidak akan dapat memanfaatkan teknologi ELAM baru ini .

Early Launch Anti-Malware (ELAM) protection technology in Windows 10

Windows 10/8 inclυdes a new security feature called Secure Boot, which рrotects the Windows boot configuration and components, аnd loads an Early Launch Anti-malware (ELAM) driver. This driver starts before other boot-start drivers and enables the evaluation of those drivers and helps the Windows kernel decide whether they should be initialized. By being launched first by the kernel, ELAM is ensured that it is launched before any other third-party software. It is, therefore, able to detect malware in the boot process itself and prevent it from loading or initializing.

Early Launch Anti-Malware protection

Windows Defender takes advantage of Early-Launch Anti-Malware, and you, therefore, see that it no longer loads after the start-up process is complete, but early on during the boot process.

Third-party antivirus software too, is able to take advantage of the ELAM technology. To do so, they will have to integrate the same Early Launch Anti-Malware (ELAM) capability in their software. To help security software vendors get started, Microsoft has released a whitepaper that provides information about developing Early Launch Anti-Malware (ELAM) drivers for Windows operating systems. It provides guidelines for anti-malware developers to develop anti-malware drivers that are initialized before other boot-start drivers, and ensure that those subsequent drivers do not contain malware. Several antivirus companies, who have released their updated solutions for Windows already incorporate this technology.

The Early Launch Antimalware boot-start driver has classified the drivers as follows:

1. Good: The driver has been signed and has not been tampered with.
2. Bad: The driver has been identified as malware. It is recommended that you do not allow known bad drivers to be initialized.
3. Bad, but required for boot: The driver has been identified as malware, but the computer cannot successfully boot without loading this driver.
4. Unknown: This driver has not been attested to by your malware detection application and has not been classified by the Early Launch Antimalware boot-start driver.

By default, Windows 10 loads those drivers which have been classified as Good, Unknown, and Bad but Boot Critical; ie 1, 3 and 4 above. Bad drivers are not loaded.

Configure Boot-Start Driver Initialization Policy using Group Policy Editor

While this setting is best left at its default value, if you wish, you can change this setting via your Group Policy Editor. To do so, open the WinX menu > Run > gpedit.msc > Hit Enter. Navigate to the following policy setting:

Computer Configuration > Administrative Templates >  System > Early Launch Antimalware

In the right pane, double-click on  Boot-Start Driver Initialization Policy to configure it.

You will see the default configuration of Not Configured. If you disable or do not configure this policy setting, the boot-start drivers determined to be Good, Unknown or Bad but Boot Critical are initialized, and the initialization of drivers determined to be Bad is skipped.

If you Enable this policy setting, you will be able to choose which boot-start drivers to initialize the next time the computer is started.

If you are using Windows 10/8, you want to check if your anti-malware software includes an Early Launch Antimalware boot-start driver. If it doesn’t, all boot-start drivers will be initialized, and you will not be able to take advantage of this new ELAM technology.

Related posts

• Aktifkan Enhanced Anti-Spoofing di Windows 10 Hello Face Authentication

• Cara Memformat Komputer Windows 10

• Fitur dihapus di Windows 10 v 21H1

• Cara Mengaktifkan atau Disable Automatic Learning di Windows 10

• Aktifkan, Disable Data Collection untuk Reliability Monitor di Windows 10

• Hide Toolbars option di Taskbar Context Menu di Windows 10

• Cortana Features, Tips and Tricks di Windows 10

• Cara Menggunakan Resource Monitor di Windows 10

• Perangkat Lunak dan Fitur Esensial untuk PC Windows 10 Baru

• Fitur dihapus atau usang di Windows 10 V2004

• Cara Menghidupkan atau Mati Pemecahan Masalah yang Disarankan di Windows 10

• Cara menonaktifkan Windows Mobility Centre di Windows 10

• Mengaktifkan atau menonaktifkan berita dan minat pada taskbar di Windows 10

• Cara Menggunakan Start feature Segar di Windows 10

• Cara menonaktifkan kelas Removable Storage dan akses di Windows 10

• Nonaktifkan Telemetry & Data Collection di Windows 10 menggunakan Task Scheduler

• Cara Menginstal NumPy Menggunakan PIP pada Windows 10

• 15 Fitur Baru Windows 10 yang Harus Anda Mulai Gunakan

• Fitur dihapus di Windows 10 V20H2 October 2020 Update

• Aktifkan atau Nonaktifkan Open News and Interests pada Hover di Windows 10