Virtualization Based Security

Question

I configured the turn on Virtualization Based Security as folows:

• Select Platform Security Level: Secure Boot and DMA Protection
• Virtualization Based Protection of Code Integrity: Enabled without lock
• Credential Guard Configuration: Enabled without lock
• Machine Identity Isolation Configuration: Enabled in enforcement mode
• Secure Launch Configuration: Enabled
• Kernel-mode Hardware-enforced Stack Protection: Enabled in enforcement mode

Is it a good configuration? Is it good to enable Virtualization Based Security? Are there nay downsides? Can I disable it after?

Answer 1

Yes, with your powerful setup (Intel Core Ultra 7 155H and 32 GB RAM), you should be fine to apply the full VBS configuration as you've listed.

This configuration will maximize security on your laptop, and your hardware should handle it smoothly, even with occasional VM usage. If you do notice any specific performance issues, you can always adjust individual settings, but with your setup, it’s likely to be well.

If you find my support helpful in some way, I kindly ask you to log in to the account where you posted the topic and select “Yes” under the post that offers a solution or “Mark as answer” my reply via “Advanced Tools”.

I really appreciate it.

Answer 2

Hello,

thank you for all your help.

I seen online some people say I should keep it off as I can lose 10-15% of my performance. Is that true should I still enable it? I have a new laptop that I want to enable vbs on.

Answer 3

Thank you for your reply.

Let me first explain to you that testing VBS in a virtual machine is indeed a wise practice as it helps users to understand and experience the effect of the configuration first. However, there are some key differences between a virtual machine environment and a physical machine that result in VBS that may not be fully functional.

Because virtual machines lack access to physical hardware, so when it comes to security features such as Secure Boot, DMA protection, and hardware encryption. Virtualized environments can only emulate a portion of the hardware functionality, so features like System Guard and Secure Launch may not be fully functional in a virtual machine.

Here are the answers to your questions.

1. Should I apply it on my physical computer?

Yes, if you make sure the hardware supports it. On a physical machine, VBS can take advantage of hardware features such as Secure Boot and DMA protection provided by the BIOS or UEFI to ensure a higher level of security. So enabling VBS results in a more comprehensive and reliable configuration that enhances system integrity and provides advanced defenses against kernel-level malware.

And practically speaking, assuming that your physical machine has high hardware performance, the load on the system after enabling VBS is relatively low and will not affect daily use too much.

It should be noted, however, that some applications and drivers may not be fully compatible with VBS. It is wise to investigate known compatibility issues with specific applications or drivers.

2. In the VM system guard doesn't work, does it relate to the fact it's a VM?

System guard relies on specific hardware features, such as secure boot and certain memory protections, that a virtual machine typically cannot fully emulate. Some VBS features, such as safe boot or system guards, cannot be fully enabled because the VM does not have direct access to the underlying physical hardware. This is the reason why system protectors do not work in virtual machines, which is normal behavior in virtualized environments.

3. when I tried disabling vbs even with group policy disabled in defender it said managed by administrator - is this ok?

If you see “Managed by Administrator” when trying to disable VBS via Group Policy or Defender, this could mean that a higher level policy is managing these settings. This can sometimes happen if an organization's policy (via AD Domain Control or Group Policy) is enforcing security settings, or if certain security settings are applied at the BIOS level.

This is considered normal.

4. Also does enabling vbs impact the use of bitlocker or fingerprint sensor (windows hello)?

Enabling VBS usually complements BitLocker. In fact, VBS adds additional protection for encryption keys in memory, thus strengthening the security of BitLocker without affecting its core functionality.

The fingerprint sensor should work fine, but in some cases you may experience a slight delay in the authentication process.Windows Hello is designed to be compatible with VBS, but if you experience a specific problem, it may be a hardware compatibility issue.

However, there have been known issues in some recent releases related to the fingerprint sensor, which may sometimes be affected by the version resulting in a situation where it does not work properly.

Overall, make sure that your device hardware supports VBS-related features and that you back up your important data.

Turn it on according to your actual situation.

I personally recommend making sure you backup all important data or create a restore point before enabling it to avoid possible compatibility issues or other problems that we can quickly restore the system.

As a Support Specialist, I understand the expectations of the users and the concerns behind every issue. It is my honor to help you and I hope that my efforts will be helpful to you.

If you find my support helpful in some way, I kindly ask you to log in to the account where you posted the topic and select “Yes” under the post that offers a solution or “Mark as answer” my reply via “Advanced Tools”. This small gesture will not only provide better access to information for other users who have the same problem as you, but will also allow us to work together to build a more friendly and supportive community.

Thank you for your understanding and cooperation! We look forward to your feedback.

Answer 4

Hello,I tried the configuration above in a VM.

1. Should I apply it on my physical computer?
2. In the VM system guard doesn't work, does it relate to the fact it's a VM?
3. When I tried disabling vbs even with group policy disabled in defender it said managed by administrator - is this ok?
4. Also does enabling vbs impact the use of bitlocker or fingerprint sensor (windows hello)?

Answer 5

Hi lelieee

Welcome to Microsoft Community.

Based on your description, I understand that you want to ask if these following virtualization security related configurations are available and have some related questions, and I understand your feelings very well!

I will answer your questions in the order in which you asked them, and I hope these responses will help you!

1. Is it a good configuration?

From the configuration information, it seems that your configuration can indeed effectively enhance system security, and enabling VBS can combine various protection measures to greatly reduce the attack surface and enhance the ability of the operating system to resist various threats.

2. Is it good to enable Virtualization Based Security? Are there nay downsides?

I will describe the advantages and disadvantages.

(1) Advantages of enabling Virtualization Based Security.

From the security point of view, we can effectively enhance the overall system security against advanced attacks (especially malware targeting the kernel).

Improve isolation of sensitive data and system components.

Defend against memory-based attacks (e.g., buffer overflows).

(2) Of course this configuration comes with some drawbacks.

Potential performance overhead, especially when running on resource-limited hardware. Assuming that our hardware is not that powerful, at this point it will be partially occupied due to the security feature being turned on.

May cause compatibility problems with some applications or drivers not designed for VBS.

3. Can I disable it after?

Normally it is possible to disable virtualization-based security after it is enabled. However, you should consider the implications of disabling these security features, as this may expose your system to vulnerabilities that VBS helps to mitigate. If you need to disable it, it is generally recommended that you clearly understand the reasons and implications.

Please note: But again, as an everyday Windows user, I would recommend assuming that you need to make the relevant configuration changes. Before making changes, try to make a complete backup of important data and make a system restore point!

All in all, though, it does significantly increase safety and improve security from a safety standpoint.

I sincerely hope that the above solution will solve your problem. Please feel free to contact me if you have any problems or still can't solve them. (Photos related to the question would be great!).

I am looking forward to hearing back from you. 

Best Regards

Arthur Sheng | Microsoft Community Support Specialist