Virtualized Intel VT-x/EPT is Not Supported on this Platform when Device Guard and Credential Guard are enabled on Surface Pro 8

Anonymous
2025-02-27T21:31:05+00:00

Hi Microsoft,

I am unable to use VMware® Workstation 17 Pro, 17.6.2 build-24409262, with Windows 11 Pro 24H2 26100.3194 Windows Feature Experience Pack 1000.26100.48.0 On a Windows Surface 8 Pro with Device Guard and Credential Guard enabled....

When i try to launch any VM with Virtualized Intel VT-x/EPT enabled i receive the following:

I have disabled hyper V, Windows Hyper Visor and Virtual Machine Platform as below:

I have ran the following commands:

 - Deactivate the hypervisor launch type . Command:

bcdedit /set hypervisorlaunchtype off

Disable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-All

powershell dudes may need this:

Set-ExecutionPolicy RemoteSigned

Screenshot for illustration only:

I have turned off core memory isolate:

I have also disabled Device Guard and Credential Guard - this will fix VMware and allow vt-X and I can use my virtual machines with VT-X - yay! however, i cannot use PIN and facial recognition to sign into Windows 11.

Can you fix this so i can sign in with Facial and use VM please ?

Download Device Guard and Credential Guard hardware readiness tool from Official Microsoft Download Center

*** Warning Surface Users: make sure you know your password if you run this as your Facial sign in and Pin will stop working if you disable ***

.\DG_Readiness_Tool_v3.6.ps1 -Disable

Also please confirm what manages Facial recognition login and Pin Login ? is this Credential Guard or Device Guard or both ?

Thank you very much.

-Z

Windows for home | Windows 11 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Francisco Montilla 31,550 Reputation points Independent Advisor
2025-02-28T02:45:11+00:00

Hi Ziggy,

Your observation is correct. Windows Hello itself isn’t what directly “turns on” VT‑x/EPT restrictions. Instead, when you re-enable Windows Hello after disabling Device Guard and Credential Guard, the system on your Surface Pro 8 appears to be reactivating components of virtualization‐based security (VBS) that conflict with VMware’s use of VT‑x/EPT.

Windows Hello (facial recognition and PIN) is managed independently through the TPM and Windows Hello infrastructure, not by Device Guard or Credential Guard. However, on some platforms the reconfiguration of Windows Hello can inadvertently cause certain VBS features to reinitialize. This reactivation is what prevents VMware from accessing VT‑x/EPT even though you initially disabled Device Guard and Credential Guard.

At this time the supported configuration for running VMware Workstation with nested virtualization requires that VBS (including Device Guard/Credential Guard) remain turned off. If maintaining Windows Hello with facial recognition and PIN is critical to your workflow, one solution is to switch to Hyper‑V instead of VMware Workstation. Hyper‑V is designed to operate with VBS enabled and will allow you to use Windows Hello normally while still supporting virtualization.

Was this answer helpful?

5 people found this answer helpful.
0 comments

7 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2025-03-03T20:29:29+00:00

    HI Ziggy,

    I have been investigating further, but it seems like a problem with Surface models only. This is a public forum staffed by users like you and me, but If needed you can contact microsoft support here:

    https://support.microsoft.com/

    Hi Francisco,

    Like Ziggy, I have been trying to solve this problem for days. I don't care about Windows Hello, I just want to use VMware Workstation Pro 17 for CML and have tried everything like Ziggy. Disabled core isolation, disabled windows features, disabled device guard, disabled all features via powershell with get features I saw it. Can you please help me somehow....

    Was this answer helpful?

    5 people found this answer helpful.
    0 comments
  2. Anonymous
    2025-02-27T23:38:21+00:00

    When i turn off Device Guard and Credential Guard it disables windows Hello...

    When i turn Hello off then turn it back on... v-tx stops working...

    I had to again turn off Device Guard and Credential Guard, but hello kept working this time....

    ty so much!

    Was this answer helpful?

    0 comments
  3. Anonymous
    2025-02-27T23:24:44+00:00

    When i turn off Device Guard and Credential Guard it disables windows Hello...

    For the first boot, i then disabled and re-enabled windows hello and i was able to get into windows with facial rec. and pin.

    thank you so much Francisco !

    Was this answer helpful?

    0 comments
  4. Francisco Montilla 31,550 Reputation points Independent Advisor
    2025-02-27T23:05:27+00:00

    Hi Ziggy,

    You can keep Windows Hello face/PIN sign-in and still use VT‐x/EPT in VMware by turning off (or not enabling) Device Guard/Credential Guard while leaving Windows Hello active.

    Device Guard and Credential Guard isolate certain key processes in a virtualized environment, which prevents VMware from accessing VT‐x. Windows Hello itself does not strictly require Device Guard/Credential Guard (it relies on the TPM and Windows Hello for Business instead) so disabling VBS (via “Turn Windows features on or off” and ensuring hypervisorlaunchtype is set to Off) will allow nested virtualization in VMware without breaking face or PIN sign-in.

    If those sign-in methods get lost after disabling, you can simply reconfigure Windows Hello in “Sign-in options” and it will work again independently of Device Guard/Credential Guard.

    I hope this helps!

    Was this answer helpful?

    0 comments