DG Readiness Tool - Unable to Disable Device Guard

Hey @TechServices33,

I'm having the same issue. I'm desperately trying to disable hyper-v but I don't have hyper-v as an option to deselect in my Windows Features. I ran the dgreadiness script, "Device Guard and Credential Guard hardware readiness tool", provided by Microsoft.

After the script finishes the result indicates that it can't find my regkeys. I set the dgreadiness.exe to what I believe is my sipolicy path as the default script couldn't locate it.

• How can I confirm that my path to sipolicy is correct?

-How can I locate the reg key or value and correct the command?

I believe these two issues may be the cause for not disabling. Ultimately, I just want this fixed so I can install Flutter but I can't disable hyper-v. Please help.

Execution Result from Powershell

---

Windows PowerShell

Copyright (C) Microsoft Corporation. All rights reserved.

Try the new cross-platform PowerShell https://aka.ms/pscore6

PS C:\WINDOWS\system32> cd C:\Users\Doug\Downloads\dgreadiness_v3.6\dgreadiness_v3.6

PS C:\Users\Doug\Downloads\dgreadiness_v3.6\dgreadiness_v3.6> dir

    Directory: C:\Users\Doug\Downloads\dgreadiness_v3.6\dgreadiness_v3.6

Mode                LastWriteTime         Length Name

----                -------------         ------ ----

-a----         5/1/2020  10:39 AM          10949 DefaultWindows_Audit.xml

-a----         5/1/2020  10:39 AM           2312 DefaultWindows_Audit_sipolicy.p7b

-a----         5/1/2020  10:39 AM          10888 DefaultWindows_Enforced.xml

-a----         5/1/2020  10:39 AM           2316 DefaultWindows_Enforced_sipolicy.p7b

-a----         5/1/2020  10:39 AM          77648 DG_Readiness_Tool_v3.6.ps1

-a----         5/1/2020  10:39 AM           6079 ReadMe.txt

PS C:\Users\Doug\Downloads\dgreadiness_v3.6\dgreadiness_v3.6> Set-ExecutionPolicy Unrestricted

Execution Policy Change

The execution policy helps protect you from scripts that you do not trust. Changing the execution policy might expose

you to the security risks described in the about_Execution_Policies help topic at

https:/go.microsoft.com/fwlink/?LinkID=135170. Do you want to change the execution policy?

[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "N"): Y

PS C:\Users\Doug\Downloads\dgreadiness_v3.6\dgreadiness_v3.6> DG_Readiness_Tool_v3.6.ps1 -Disable

DG_Readiness_Tool_v3.6.ps1 : The term 'DG_Readiness_Tool_v3.6.ps1' is not recognized as the name of a cmdlet,

function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the

path is correct and try again.

At line:1 char:1

• DG_Readiness_Tool_v3.6.ps1 -Disable

    + CategoryInfo          : ObjectNotFound: (DG_Readiness_Tool_v3.6.ps1:String) [], CommandNotFoundException

    + FullyQualifiedErrorId : CommandNotFoundException

Suggestion [3,General]: The command DG_Readiness_Tool_v3.6.ps1 was not found, but does exist in the current location. Windows PowerShell does not load commands from the current location by default. If you trust this command, instead type: ".\DG_Readiness_Tool_v3.6.ps1". See "get-help about_Command_Precedence" for more details.

PS C:\Users\Doug\Downloads\dgreadiness_v3.6\dgreadiness_v3.6> "DG_Readiness_Tool_v3.6.ps1 -Disable"

DG_Readiness_Tool_v3.6.ps1 -Disable

PS C:\Users\Doug\Downloads\dgreadiness_v3.6\dgreadiness_v3.6> -Command "DG_Readiness_Tool_v3.6.ps1 -Disable"

-Command : The term '-Command' is not recognized as the name of a cmdlet, function, script file, or operable program.

Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

At line:1 char:1

• -Command "DG_Readiness_Tool_v3.6.ps1 -Disable"

    + CategoryInfo          : ObjectNotFound: (-Command:String) [], CommandNotFoundException

    + FullyQualifiedErrorId : CommandNotFoundException

PS C:\Users\Doug\Downloads\dgreadiness_v3.6\dgreadiness_v3.6> .\DG_Readiness_Tool_v3.6.ps1 -Disable

###########################################################################

Readiness Tool Version 3.4 Release.

Tool to check if your device is capable to run Device Guard and Credential Guard.

###########################################################################

Disabling Device Guard and Credential Guard

Deleting RegKeys to disable DG/CG

ERROR: The system was unable to find the specified registry key or value.

ERROR: The system was unable to find the specified registry key or value.

ERROR: The system was unable to find the specified registry key or value.

ERROR: The system was unable to find the specified registry key or value.

ERROR: The system was unable to find the specified registry key or value.

ERROR: The system was unable to find the specified registry key or value.

del : Cannot find path 'C:\WINDOWS\System32\CodeIntegrity\SIPolicy.p7b' because it does not exist.

At line:1 char:1

• del  "$env:windir\System32\CodeIntegrity\SIPolicy.p7b"

    + CategoryInfo          : ObjectNotFound: (C:\WINDOWS\Syst...ty\SIPolicy.p7b:String) [Remove-Item], ItemNotFoundEx

   ception

    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.RemoveItemCommand

Disabling Hyper-V and IOMMU

Disabling Hyper-V failed please check the log file

Please reboot the machine, for settings to be applied.

PS C:\Users\Doug\Downloads\dgreadiness_v3.6\dgreadiness_v3.6>

>> .\DG_Readiness_Tool_v3.6.ps1 -Disable -Enable -Path "C:\WINDOWS\System32\CodeIntegrity\driversipolicy.p7b"

###########################################################################

Readiness Tool Version 3.4 Release.

Tool to check if your device is capable to run Device Guard and Credential Guard.

###########################################################################

###########################################################################

OS and Hardware requirements for enabling Device Guard and Credential Guard

 1. OS SKUs: Available only on these OS Skus - Enterprise, Server, Education, Enterprise IoT, Pro, and Home

 2. Hardware: Recent hardware that supports virtualization extension with SLAT

To learn more please visit: https://aka.ms/dgwhcr

###########################################################################

Enabling Device Guard and Credential Guard

Setting RegKeys to enable DG/CG

Enabling Hyper-V and IOMMU

Enabling Hyper-V failed please check the log file

Please reboot the machine, for settings to be applied.

Disabling Device Guard and Credential Guard

Deleting RegKeys to disable DG/CG

ERROR: The system was unable to find the specified registry key or value.

Disabling Hyper-V and IOMMU

Disabling Hyper-V failed please check the log file

Please reboot the machine, for settings to be applied.

PS C:\Users\Doug\Downloads\dgreadiness_v3.6\dgreadiness_v3.6>

Matt

This is very weird. I ran 'DG_Readiness_Tool_v3.6.ps1 -Ready' to see if DG/CG was disabled and I got:

Credential-Guard is not running.

HVCI is not running.

Config-CI is not running. (Not Enabled)

Not all services are running.

But I still can't run VMWare. I checked that Hyper V is not enabled and it isn't so I'm stumped.

Hi Matt

Thanks for the response.  i had forgotten that I needed to run the script from Power Shell (hardly ever use oit.)

Anyway Loaded PS and changed to the DGReadiness folder and ran the script with the following results:

>>PS C:\DGReadiness> DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot

DG_Readiness_Tool_v3.6.ps1 : The term 'DG_Readiness_Tool_v3.6.ps1' is not recognized as the name of a cmdlet, function, script file,

or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

At line:1 char:1

• DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot

    + CategoryInfo          : ObjectNotFound: (DG_Readiness_Tool_v3.6.ps1:String) [], CommandNotFoundException

    + FullyQualifiedErrorId : CommandNotFoundException<<

Not sure what do do now :-(

Hello ,

I am Matt, an Independent Adviser and a specialist technician. I would like to assist you with this and hopefully I can help you to resolve this issue promptly.

Firstly you need to use "Power Shell" and not "Command Prompt".

You could try the following command from command prompt it should work

powershell.exe -noprofile -executionpolicy bypass -file .\DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot

Or better yet open powershell and then navigate to the folder you need and run the script.

Open powershell by searching for it in your start menu or you can type "powershell" at the command prompt to activate powershell mode.

If you downloaded the powershell script you may need to change the execution policy first for it to run with the following command;

set-executionpolicy remotesigned

or

set-executionpolicy unrestricted

I really hope this helps, let me know if I can be of more assistance. Have a great day.

Standard Disclaimer: There are links to non-Microsoft websites. The pages appear to be providing accurate, safe information. Watch out for ads on the sites that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the sites before you decide to download and install it.

Kind Regards,