How to run Virtualization based Security

Jonathan Priyaraj 160

Hi. I have an set of azure VM running windows server OS . My client requested to enable two GPO ie virtualization based Security and Windows defender, I enabled through GPO . But the status it says "enabled not running". I tried to enable through core memory under device security as well. The system restarted but it still does not run.

Sai Krishna Katakam 1,265 Reputation points Microsoft Vendor

2024-11-13T13:08:43.79+00:00

Hi Jonathan Priyaraj

Just checking in to see if you had a chance to see response provided by Zunhui Han to your question. Please tell us if it was helpful and feel free to reach out to us if you have any queries.

If you feel that your queries have been resolved, please accept the answer by clicking the "Upvote" and "Accept Answer" on the post.

Thank you.
Jonathan Priyaraj 160 Reputation points

2024-11-14T10:02:28.73+00:00

Hi . It did not work. Can you let me know how can I test this feature once I implement in a test server
Sai Krishna Katakam 1,265 Reputation points Microsoft Vendor

2024-11-14T12:24:23.9466667+00:00

Hi Jonathan Priyaraj

If modifying the registry did not activate VBS, here’s how you can verify and test this feature on a test server. First, confirm that your VM series supports VBS; compatible Azure VM series include Dv3, Ev3, and newer VMs with nested virtualization support. Enable VBS through Group Policy by opening the Group Policy Editor (gpedit.msc) and navigating to Computer Configuration > Administrative Templates > System > Device Guard. Enable Turn On Virtualization Based Security and configure Virtualization Based Protection of Code Integrity. After applying these settings, restart the VM and check the VBS status by typing msinfo32 into the search bar and opening System Information. In System Summary, check for entries like Virtualization-Based Security and Device Guard to confirm VBS is active and running.

To test the VBS feature on the test server, you can also enable Memory Integrity under Device Security, which relies on VBS to operate. Additionally, you may run the Device Guard and Credential Guard hardware readiness tool to verify that code integrity enforcement and VBS settings are applied correctly.

For more information, please refer to the below documentation:
Virtualization-based Security (VBS)
Verify Device Guard Deployment Status

If you have any further queries, do let us know. If the comment is helpful, please click "Upvote".
Sai Krishna Katakam 1,265 Reputation points Microsoft Vendor

2024-11-15T10:24:04.56+00:00

Hi Jonathan Priyaraj

Just checking in to see if you had a chance to review my comment on your question. Please let us know if it was helpful and feel free to reach out if you have any further queries.

If you found the information useful, please click "Upvote" on the post to let us know.

Thank You.

Accepted answer

Zunhui Han 2,550 Reputation points Microsoft Vendor

2024-11-13T12:15:33.3833333+00:00
Hello,

Thank you for posting in Q&A forum.

I suggest you try to modify the registry to see if you can run memory integrity. Please refer to the following steps:

Press Windows + R key combination to open the Run window, type regedit, and then press Enter to open the registry editor.

Locate the following location in the registry editor:

\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios

Create a new DWORD, rename it to HypervisorEnforcedCodeIntegrity, and then change its value to 1.

Note If you modify the registry incorrectly, you can cause serious problems. Therefore, follow these steps carefully. For additional protection, back up the registry before you modify it. For more information about how to back up and restore the registry, see How to back up and restore the registry in Windows.

I hope the information above is helpful.

Best regards

Zunhui

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to run Virtualization based Security

0 additional answers

Your answer