I can't disable VirtualizationBasedSecurity (VBS). WHY?

Question

My specs: Windows 10 Pro, AMD Ryzen 5000. Joined domain. Please see my screenshot https://i.stack.imgur.com/IqkPO.png

1. I tried turn off Memory Integrity in the Window Security panel with admin privilege, it still become on after I restarted my PC. ( I tried more than 10 times)
2. I executed sfc /scannow to fix any integrity issue.
3. I turned-off and turned-on AWD-V several times but it's still the same.

I need to disable this security features to run my GNS3 VM. Please help. Any more solutions?

Answer 1

After doing almost everything and losing hope that my pc couldn't run nested virtualization due to VBS not turning off.

I found this.

Before you start. I did a fresh install of windows, and I mean a fresh install. I created a bootable USB and downloaded windows 11. Personally, I used rufus Rufus - Create bootable USB drives the easy way

Once booted up you can start to disable VBS.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity = 0
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\DeviceGuard\EnableVirtualizationBasedSecurity = 0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuardRequirePlatformSecurityFeatures = 0

Don't forget to turn core integrity to off

Open PowerShell as an administrator

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" -Name "EnableVirtualizationBasedSecurity" -Value 0

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" -Name "Enabled" -Value 0

Disable Hypervisor

bcdedit /set hypervisorlaunchtype off

However msinfo32 still shows running.

Next Disable credential guard from elevated CMD (Line by line)

mountvol X: /s

copy %WINDIR%\System32\SecConfig.efi X:\EFI\Microsoft\Boot\SecConfig.efi /Y

bcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d “DebugTool” /application osloader

bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} path “\EFI\Microsoft\Boot\SecConfig.efi”

bcdedit /set {bootmgr} bootsequence {0cb3b571-2f2e-4343-a879-d86a476d7215}

bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO

bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X:

mountvol X: /d

bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS

bcdedit /set vsmlaunchtype off

bcdedit /set hypervisorlaunchtype off

dism /online /disable-feature /featurename:Microsoft-hyper-v-all

Restart the computer to apply changes

Restart-Computer

After a reboot your BIOS will ask you if you would like to turn off Device Guard/ Credential Guard.

Answer 2

I might have the solution, from my testing Hyper-V or anything related features aren't required to run in VBS mode.

Let's say there are two ways to enable VBS, the 'normal' enabled mode (1) and enabled with UEFI lock (2)

The problem with UEFI lock is that you have to clear or change a variable called 'VbsPolicy' in your actual firmware (don't ask how I found that out)

Potentially steps to fix this issue:

Phase one: turn off all VBS features:

• since you are domain-joined, make sure no policies regarding Device Guard, VBS, or anything similar is enabled/configured
• execute "gpupdate /force"
• after that, remove these values from the registry:

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DeviceGuard]

• RequirePlatformSecurityFeatures
• ConfigureKernelShadowStacksLaunch
• ConfigureSystemGuardLaunch
• MachineIdentityIsolation
• LsaCfgFlags
• HVCIMATRequired
• HypervisorEnforcedCodeIntegrity
• EnableVirtualizationBasedSecurity

[HKEY_LOCAL_MACHINE\System\ControlSet001\Control\DeviceGuard]

• Locked
• EnableVirtualizationBasedSecurity

[HKEY_LOCAL_MACHINE\System\ControlSet001\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity]

• Locked
• HVCIMATRequired
• Enabled

[HKEY_LOCAL_MACHINE\System\ControlSet001\Control\DeviceGuard\Scenarios\KernelShadowStacks]

• Enabled
• execute "bcdedit /set hypervisorlaunchtype off" in cmd.exe

Phase two: the possible more difficult part, removing the EFI variable:

• there are really two ways to accomplish this, deactivating this the MS way and actually removing the variable

The Microsoft way:

• open cmd.exe with administrative privileges (not PowerShell (important))
• type the following commands and reboot
• after the system posts, windows will load into a tool that asks you if you really want to disable Device guard and VBS

"mountvol X: /s"
"copy %WINDIR%\System32\SecConfig.efi X:\EFI\Microsoft\Boot\SecConfig.efi /Y"
"bcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d "DebugTool" /application osloader"
"bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} path "\EFI\Microsoft\Boot\SecConfig.efi""
"bcdedit /set {bootmgr} bootsequence {0cb3b571-2f2e-4343-a879-d86a476d7215}"
"bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS"
"bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X:"
"mountvol X: /d"

for reference

Using the EFI SHELL:

• boot into your embedded EFI Shell or download a bootable image from this github (you might need to deactivate SecureBoot temporarily)
• enter the shell so it says something like "Shell>"
• type 'dmpstore -d VbsPolicy'
• this will remove the EFI variable called VbsPolicy, which stores said configuration
• reboot and done

Answer 3

Hello I have the same issue could you able to resolve?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity = 0
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\DeviceGuard\EnableVirtualizationBasedSecurity = 0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuardRequirePlatformSecurityFeatures = 0
vsmlaunchtype is off

However msinfo32 still shows running.

This actually happens when i enabled Core isolation at first, after that when i want to disable it, i couldn't do it anymore.

Answer 4

It worked for me. Thanks.

Answer 5

Hi ,

I am Ivan, I will help you with this.

Have you unchecked the Hyper-V and Virtualization Platform service in the control panel?

Control Panel > Programs > Turn Windows Features On or Off > Virtual Machine Platform, Hyper-V and Hypervisor Platformt you uncheck and restart the computer.

Independent Advisor - Community

Thanks