Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Turn On Virtualization Based Security

This computer policy controls Virtualization-based Security (VBS) and several protections that use it.

since 0.9.8.11

Purpose

Show registry keys (7)
  • HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\EnableVirtualizationBasedSecurity
  • HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\RequirePlatformSecurityFeatures
  • HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\HypervisorEnforcedCodeIntegrity
  • HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\HVCIMATRequired
  • HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\LsaCfgFlags
  • HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ConfigureSystemGuardLaunch
  • HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\ConfigureKernelShadowStacksLaunch

<br>

This computer policy controls Virtualization-based Security (VBS) and several protections that use it. VBS uses hardware virtualization and the Windows hypervisor to create a secure environment isolated from the normal operating system. Windows can host security services in this environment and protect selected resources even if the regular operating-system kernel is compromised.

The listed entries are REG_DWORD values. EnableVirtualizationBasedSecurity is the main VBS switch: 1 enables VBS and 0 disables it. The remaining values select platform requirements and individual VBS-based services:

  • RequirePlatformSecurityFeatures defines the required platform security level. 1 requires Secure Boot; 3 requires Secure Boot and DMA protection. DMA protection also depends on suitable hardware and a supported IOMMU or SMMU.
  • HypervisorEnforcedCodeIntegrity controls Hypervisor-protected Code Integrity (HVCI), also known as memory integrity. 1 enables it with UEFI lock and 2 enables it without the lock. 0 can turn off a configuration that was previously enabled without UEFI lock.
  • HVCIMATRequired determines whether HVCI requires a UEFI Memory Attributes Table. 1 requires the table and 0 does not. The table reports the code and data regions used by UEFI runtime services so that Windows can apply appropriate write and execution protections.
  • LsaCfgFlags controls Credential Guard. 1 enables Credential Guard with UEFI lock and 2 enables it without the lock. 0 can turn off Credential Guard if it was previously enabled without UEFI lock.
  • ConfigureSystemGuardLaunch controls System Guard Secure Launch. 0 leaves the feature unmanaged, 1 enables it when the hardware supports it, and 2 disables it.
  • ConfigureKernelShadowStacksLaunch controls Kernel-mode Hardware-enforced Stack Protection. 1 selects enforcement mode, 2 selects audit mode, and 3 disables the feature. Audit mode records detected violations without enforcing the protection.

Notes

Additional effects

HVCI moves kernel code-integrity decisions into the isolated VBS environment. Kernel binaries and drivers must pass code-integrity validation before execution, and executable kernel-memory pages cannot simultaneously remain writable.

Credential Guard isolates secrets such as NTLM password hashes, Kerberos Ticket Granting Tickets, and domain credentials stored by applications from the normal operating system. This prevents software running with local administrative privileges from directly reading the protected secrets.

On supported systems, System Guard Secure Launch uses a hardware-based Dynamic Root of Trust for Measurement (DRTM). It can establish a trusted system state without relying exclusively on every firmware component that ran earlier in the boot sequence.

Kernel-mode Hardware-enforced Stack Protection maintains a hardware-protected shadow stack for each kernel call stack. Windows can compare return addresses and detect attempts to redirect execution. The feature requires VBS, HVCI, and a processor supporting Intel Control-flow Enforcement Technology or AMD Shadow Stacks.

Security

The policy can strengthen several separate security boundaries. HVCI helps prevent malicious or modified code from executing in the kernel. Credential Guard reduces access to reusable authentication secrets and mitigates credential-theft techniques such as pass-the-hash and pass-the-ticket. Secure Launch strengthens resistance to bootkits and compromised early-boot components. Kernel shadow stacks impede return-address manipulation used in Return-Oriented Programming attacks.

UEFI lock prevents HVCI or Credential Guard from being disabled solely through changes made by the running operating system or a subsequent policy update. A service protected by UEFI lock therefore cannot be remotely reversed in the same way as a configuration created without the lock.

VBS provides the isolated security platform; it does not, by itself, prove that every related service is active. Credential Guard, HVCI, Secure Launch, and kernel shadow stacks run only when their respective settings, operating-system support, firmware, and hardware requirements are satisfied.

Possible side effects

Drivers that do not meet memory-integrity requirements might be prevented from loading or might malfunction. Microsoft also documents that incompatible applications or hardware drivers can, in rare cases, cause boot failures or system crashes.

Kernel-mode Hardware-enforced Stack Protection blocks drivers known to be incompatible with shadow stacks. If such a driver is already installed, Windows might be unable to enable the protection. In enforcement mode, a return-address mismatch causes a system bug check to stop potentially hijacked kernel control flow.

Credential Guard can affect applications or administration workflows that attempt to read protected credentials, depend on legacy authentication behavior, or use unsupported forms of credential delegation.

VBS and HVCI can add performance overhead. The effect is generally greater on older processors that must emulate relevant memory and execution controls than on newer processors with dedicated hardware support.

Notes

The available options vary with the Windows release and the installed Administrative Templates. Kernel-mode Hardware-enforced Stack Protection is intended for Windows 11 version 22H2 and later and for supported server platforms, and it requires compatible processor hardware.

Changes to VBS and its dependent services commonly take effect only after a restart. A configured registry value does not establish that a protection is running when the system cannot meet its hardware or firmware prerequisites.

Microsoft documentation

Microsoft Learn: Policy CSP – DeviceGuard

Microsoft Learn: Policy CSP – VirtualizationBasedTechnology

Microsoft Learn: Virtualization-based Security (VBS)

Microsoft Learn: Enable memory integrity

Microsoft Learn: Configure Credential Guard

Microsoft Learn: Kernel-mode Hardware-enforced Stack Protection

See also