Virtualization Based Security

Question

I configured the turn on Virtualization Based Security as folows:

Select Platform Security Level: Secure Boot and DMA Protection

Virtualization Based Protection of Code Integrity: Enabled without lock

Credential Guard Configuration: Enabled without lock

Machine Identity Isolation Configuration: Enabled in enforcement mode

Secure Launch Configuration: Enabled

Kernel-mode Hardware-enforced Stack Protection: Enabled in enforcement mode

Is it a good configuration? Is it good to enable Virtualization Based Security? Are there nay downsides? Can I disable it after?

Answer 1

Hello,

Configuring Virtualization Based Security (VBS) can enhance the security of your system by creating an isolated environment for certain security features, which makes it more difficult for malware to compromise these features. Here’s a breakdown of the configuration settings you've provided:

Platform Security Level: Secure Boot and DMA Protection

This ensures that only trusted software can run during the boot process and protects against Direct Memory Access (DMA) attacks.

Virtualization Based Protection of Code Integrity: Enabled without lock

This setting helps prevent unsigned or malicious drivers from being loaded, enhancing system integrity.

Credential Guard Configuration: Enabled without lock

This protects user credentials from being accessed by unauthorized software, which is crucial for maintaining security.

Machine Identity Isolation Configuration: Enabled in enforcement mode

This isolates machine identities, providing an additional layer of security against credential theft.

Secure Launch Configuration: Enabled

This ensures that the system launches securely, protecting against attacks during the boot process.

Kernel-mode Hardware-enforced Stack Protection: Enabled in enforcement mode

This protects against certain types of attacks that target the kernel, enhancing overall system security.

Benefits of Enabling VBS

Enhanced Security: VBS provides a robust defense against various types of malware and exploits, particularly those targeting the kernel and system memory.

Protection of Sensitive Data: It helps safeguard sensitive information, such as user credentials and system integrity.

Potential Downsides

Performance Impact: Enabling VBS can lead to a performance decrease, particularly in gaming and resource-intensive applications.

Compatibility Issues: Some older applications or drivers may not work correctly with VBS enabled, leading to potential functionality issues.

Can it be disabled?

Yes, you can disable VBS if you find that the performance impact is too significant or if you encounter compatibility issues. To do this, you would typically go back into the Windows Security settings or use Group Policy to turn off the relevant VBS features. However, keep in mind that disabling it will reduce your system's security posture.

Overall, with the settings you've configured, you’ve taken a robust approach to securing your system by leveraging VBS. If you don't encounter significant performance or compatibility issues, keeping VBS enabled can provide substantial security benefits.

I hope the information above is helpful.

Best Regards,

Yanhong Liu

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.