Share via

Testing sign and debug of VBS enclaves on a virtual machine

ken 0 Reputation points
2024-07-31T09:32:20.8366667+00:00

Is there a way to test sign and debug VBS enclaves on a virtual machine? I've tried with VMware, but can't enable virtualization based security.

Hyper-V
Hyper-V
A Windows technology providing a hypervisor-based virtualization solution enabling customers to consolidate workloads onto a single server.
2,737 questions
Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,932 questions
Windows 11
Windows 11
A Microsoft operating system designed for productivity, creativity, and ease of use.
9,940 questions
Azure Trusted Signing
Azure Trusted Signing
Trusted Signing is a Microsoft fully managed, end-to-end signing solution that simplifies the certificate signing process and helps partner developers more easily build and distribute applications.
113 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Neuvi Jiang 1,460 Reputation points Microsoft Vendor
    2024-08-01T08:03:54.3433333+00:00

    Hi ken,

    Thank you for posting in the Q&A Forums.

    First, ensure that your virtual machine configuration supports virtualization-based security (VBS). This typically requires that both the version of hardware used by the virtual machine and the guest operating system support VBS. for example, VMware supports enabling VBS on guest operating systems in Windows 10 and later (it is enabled by default in Windows 11).

    Enabling VBS and HVCI

    On Windows client operating systems, you need to ensure that VBS (virtualization-based security) and HVCI (hardware-supported code integrity) are enabled. These features are enabled by default in Windows 11, but may need to be enabled manually in older versions of Windows.

    For Windows 11: Usually these features are already enabled. You can check their status via System Information or Group Policy Editor.

    For Windows 10: You may need to enable these features through the registry or using a PowerShell script. Please note that enabling VBS in a virtual machine may affect performance and may require the virtual machine to have specific hardware compatibility.

    Disabling virtual machine settings that conflict with VBS

    If VBS cannot be enabled in a VMware virtual machine, it may be because some VMware settings conflict with VBS. In particular, virtualization-based security (VBS) and kernel isolation (e.g., HVCI) may conflict with some of VMware's virtualization technologies.

    Turning off certain VMware security features: For example, you can try turning off certain VMware security features, such as memory protection or isolation at the virtual machine monitor level, to see if VBS is allowed to be enabled. Note, however, that this may reduce the security of the virtual machine.

    Check VMware's documentation: VMware's official documentation may contain specific guidance or restrictions on enabling VBS in a virtual machine.

    Best regards

    NeuviJ

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.