The l1vhlwf service failed to start due to the following error: A hypervisor feature is not available to the user.

Question

Hi.

Got this error in event log, the rest is working wo problems as far as I can tell.

"The l1vhlwf service failed to start due to the following error: A hypervisor feature is not available to the user."

Tried many solutions I could find though neither of them worked.

0.1 I have fresh install of win11, fully updated:
Edition Windows 11 Pro

Version 24H2

Installed on ‎21.‎11.‎2024

OS build 26100.2454

Experience Windows Feature Experience Pack 1000.26100.36.0

0.2 The Problem

C:\Windows\System32>sc qc l1vhlwf

[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: l1vhlwf

    TYPE               : 1  KERNEL\_DRIVER 

    START\_TYPE         : 2   AUTO\_START 

    ERROR\_CONTROL      : 1   NORMAL 

    BINARY\_PATH\_NAME   : System32\drivers\l1vhlwf.sys 

    LOAD\_ORDER\_GROUP   : NDIS 

    TAG                : 0 

    DISPLAY\_NAME       : Nested Network Virtualization 

    DEPENDENCIES       : 

    SERVICE\_START\_NAME : 

0.2.1 C:\Windows\System32>sc query l1vhlwf

SERVICE_NAME: l1vhlwf

    TYPE               : 1  KERNEL\_DRIVER 

    STATE              : 1  STOPPED 

    WIN32\_EXIT\_CODE    : 3224698910  (0xc035001e) 

    SERVICE\_EXIT\_CODE  : 0  (0x0) 

    CHECKPOINT         : 0x0 

    WAIT\_HINT          : 0x0

0.3 C:\Windows\System32>net start l1vhlwf

System error 3224698910 has occurred.

A hypervisor feature is not available to the user.

What have tried and other information that may be useful to resolve issue:

1. Setting Virtualization Based Protection of Code Integrity to disabled. (though its irrelevant for win11:
   "If configuring the GPO from RS2 ADMX templates and the client base is RS1, make sure you set Virtualization Based Protection of Code Integrity to "Disabled" and not "Not Configured"")
2. Enabling hypervisoriommupolicy.

Also, I suggest you to execute the below command and check if the issue persists.

bcdedit /set hypervisoriommupolicy enable

3. I have 0 driver conflicts or driver/software errors (in event viewer at least and device manager, MS Vulnerable driver blocklist is on and working).
4. C:\Windows\System32>dism /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool

Version: 10.0.26100.1150

Image Version: 10.0.26100.2454

[==========================100.0%==========================] The restore operation completed successfully.

The operation completed successfully.

C:\Windows\System32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.

Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

5. BIOS: Secure boot is on, VT-d on, Intel Virtualization Technology on, Execution Disabled bit on, Hyperthreading off (does nt effect, settings for security)
6. Sandbnox is running wo problems.
7. Hyper-V, Virtual Machine Platform, Windows Hypervisor Platform installed, (as far as i can tell they run (except for Nested Network Virtualization).

ah, and i dont need NNV, would prefer to turn it off or make it work.

Could nt find any hardware requirements for l1vhlwf other than VT-d. the only problem i could think of which is not documented well.

Thanks.

***moved from Windows / Windows 11 / Performance and system failures***

Answer 1

Hi,

It seems hypervisor is running normally on your machine. Please run bcdedit.exe in CMD and make sure the hypervisorlaunchtype is set to auto.

What is l1vhlwf.sys? I can find nothing about that. If this is a third-party driver you may need to contact the driver developer.

Answer 2

Hi Ian_Xue,

it's a driver also known as nnvdrv.sys and its signature is verified Microsoft.

Do you work in Microsoft?

Thanks for the support!!

Answer 3

My Surface Pro was upgraded to Windows 24H2 with no new/unknown event errors being presented, but this wasn't the same as on my other main desktop machine.

I checked what features were installed on both and Windows Hypervisor Platform wasn't enabled on the Surface Pro where as it was enabled on my other machine which was getting the "l1vhlwf" and OneCore-DeviceAssociationService errors in the event logs.

Tests:

I preceded to enable the feature "Windows Hypervisor Platform" on my Surface Pro and rebooted as soon as it booted back online I was presented with the following two errors.

Event Errors:

1. OneCore-DeviceAssociationService - Error ID 3503
2. The l1vhlwf service failed to start due to the following error: A hypervisor feature is not available to the user. - Error ID - 7000

What I noticed with WHP feature enabled it creates a new service called "l1vhlwf" this is only visible in the following registry location [Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\l1vhlwf]/

Even after removing the WHP feature on my Surface Pro it left behind the "l1vhlwf" service which continues to throw the above two errors.

My work around:

I set the service l1vhlwf to disabled state "4" in the registry and shutdown PC and then restarted.

Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\l1vhlwf

Once I disabled the service in the registry this stopped the errors for both "OneCore-DeviceAssociationService " and "l1vhlwf" service.

It appears there is some issue with the ""Windows Hypervisor Platform" and the new service that is created "l1vhlwf" when upgrading to Window's 24H2.

My advise:

If you have upgraded and do not specifically use this WHP feature then remove the feature and disable "l1vhlwf" service and wait for Microsoft to fix the issue.

Problem Driver: l1vhlwf

Description: Nested Network Virtualisation

Filename - l1vhlwf.sys / Original filename - nnvdrv.sys

Problem Feature: Windows Hypervisor Platform

If you haven't upgraded yet to Windows 24H2, then remove the WHP feature if enabled before you attempt to upgrade to the latest Windows release - I will be testing this approach later.

Note: However if you use virtualisation software using WSL (Windows Subsystem for Linux) then disabling WHP will break its functionality.

UPDATE :(

Unfortunately I am being presented with the above errors after removing Windows Hypervisor Platform before I upgraded another desktop machine from 23H2 to Windows 24H2, so something else is causing the issue.

OneCore-DeviceAssociationService - Error ID 3503   

The l1vhlwf service failed to start due to the following error:    

  	A hypervisor feature is not available to the user. - Error ID - 7000  

To remove the errors I used my work around and disabled the Windows service l1vhlwf.

I will continue to investigate the following errors with Windows 24H2

Answer 4

I hope Microsoft will fix this issue, I got these errors on a new MSI.. it is just 2 weeks old!! 😏

Answer 5

I have a different scenario that generates this event and usually a BSOD shortly after. It happens either:

1. I am fully booted into Win11 and I power up an external eSATA RAID5 unit OR
2. I power the RAID5 unit up before the system, in which case the system goes to BSOD "MACHINE_CHECK_EXCEPTION" sometime during POST and pre-boot OS loading.

The external RAID5 was working (for years) with a Win10 workstation until I de-commisioned it the day before I attempted to get the new system up and running.

---

OS Name Microsoft Windows 11 Pro for Workstations Version 10.0.26100 Build 26100 Other OS Description Not Available OS Manufacturer Microsoft Corporation System Name [REMOVED FOR PARANOID PRIVACY CONCERNS] System Manufacturer HP System Model HP Z8 G5 Workstation Desktop PC System Type x64-based PC System SKU 3F0Q3AV Processor Intel(R) Xeon(R) Silver 4410Y, 2000 Mhz, 12 Core(s), 24 Logical Processor(s) Processor Intel(R) Xeon(R) Silver 4410Y, 2000 Mhz, 12 Core(s), 24 Logical Processor(s) BIOS Version/Date HP U60 Ver. 01.02.14, 11/6/2024 SMBIOS Version 3.5 Embedded Controller Version 18.03 BIOS Mode UEFI BaseBoard Manufacturer HP BaseBoard Product 88C0 BaseBoard Version KBC Version 12.03.20 Platform Role Workstation Secure Boot State On PCR7 Configuration Elevation Required to View Windows Directory C:\Windows System Directory C:\Windows\system32 Boot Device \Device\HarddiskVolume8 Locale United States Hardware Abstraction Layer Version = "10.0.26100.1"

I DO NOT have Hyper-V selected in CP Programs and Features "Turn Windows features on or off". However, "Virtual Machine Platform" is on while "Windows Hypervisor Platform is OFF.

At about the same time "The l1vhlwf service failed to start due to the following error: A hypervisor feature is not available to the user" appears the "Application" event log shows:

---

Log Name: Application Source: LanWlanWwanSwitchingServiceDSU Date: 1/25/2025 7:00:33 PM Event ID: 0 Task Category: (2) Level: Information Keywords: Classic User: N/A Computer: [REMOVED FOR PARANOID PRIVACY CONCERNS] Description: The description for Event ID 0 from source LanWlanWwanSwitchingServiceDSU cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

However, I think some Win11 and HP enhanced BIOS/TPM security interplay may be playing into this because some of their description talk of using "virtualization" to check BIOS/boot blocks against some supposed secure copies of same before actually executing. Since I never turned on any type of Hyper-V or virtualization, I figured it is coming from all the added security stuff.

Sure would be nice to get a fix.