Windows 10: How to turn off Virtualization-based Security VBS on Windows 11 Pro 24H2?

Hello, I have PC with clear install Windows 11 Pro 24H2. Specs: Gigabyte b650 DS3H, AMD Ryzen 5 7600X, 32 GB RAM, SSD 512 GB.I tried to turn off VBS with these steps:1. bcdedit /set hypervisorlaunchtype off2. Turn off Core isolation on Windows Security3. Restart PC4. VBS still running5. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity = 0HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\DeviceGuard\EnableVirtualizationBasedSecurity = 0 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuardRequirePlatformSecurityFeatures = 06.

:)

 

VBS(Virtualization based security) status in msinfo32 is showing as enabled but not running after enabling device guard.

We have enabled all required settings (Secure Boot, VT-x and VT-d, UEFI). By default, Virtualization based security is in running state in windows 11, after enabling the device guard status is changed to enabled but not running which is incorrect. It is happened after enabling the device guard.

Below are the value of VirtualizationBasedSecurityStatus

-------------------------------------------------------------------

VirtualizationBasedSecurityStatus

This field indicates whether VBS is enabled and running.



Value Description

0. VBS isn't enabled.

1. VBS is enabled but not running.

2. VBS is enabled and running.

--------------------------------------------------------------------

Current Value : 1. VBS is enabled but not running.

Expected Value : 2. VBS is enabled and running.

--------------------------------------------------------------------

When we enable Device Guard , in Event Viewer below lines are getting logged.

"Virtualization-based security (policies: VBS Enabled,VSM Required,Secure Boot,Iommu Protection,Mmio Nx,Strong MSR Filtering,Hvci,Boot Chain Signer Soft Enforced) is disabled due to VBS initialization failure with status: The request is not supported."

"The virtualization-based security enablement policy check at phase 0 failed with status: The request is not supported."

Referred Microsoft Article:

Enable memory integrity

Please please help us in enabling virtualization based security as running after enabling device guard.

Machine info: Windows 11 Enterprise

Version: 21H2

OS build : 22000.1455

 

Factory reset Windows 11 24H2 (build 26100.863)

Hi, I am Dave, I will help you with this.

There are no currently listed problems resetting version 24H2 of Windows 11 and no specific steps you need to perform, are you experiencing any problems with that insider build that is causing you to perform a Windows reset?

 

Windows Security Issue: Missing 'windowsdefender' in Windows 11 24H2 (26100.863)

Chewed on this for a day. My first post as well. Hopefully this finds people in the same boat.

KB5043950: Windows 11, version 24H2 support - Microsoft Support

Known issue

New Windows 11, version 24H2 devices that are intended to be onboarded to Microsoft Defender for Endpoint might require customers to enable the prerequisite feature. This affects all supported architectures.

IT admins might observe devices not being able to be onboarded to the Defender for Endpoint cloud service, and not receiving the expected protection as a result, even if Intune is expected to execute the onboarding sequence by applying an endpoint detection and response (EDR) policy. Intune will also display an error as it is unable to successfully apply the policy. Users may also not be able to connect to corporate resources if a Conditional Access policy is configured to require Defender for Endpoint being enabled and actively reporting in. Compliance status is visible in the Microsoft Intune device compliance dashboard. This might happen in one of the following scenarios.

• A user buys a new device that has the Home SKU. This SKU does not support Defender for Endpoint. Then the user upgrades to Pro using a Pro product key. This process, called “transmog,” does not install Defender for Endpoint, which is by design. The Defender for Endpoint agent is not correctly enrolled in the Defender for Endpoint service, and the device is not protected.
  
• A user buys a new device that has the Pro SKU, and the OEM did not install the required feature.
  

Important Defender for Endpoint has been removed from the base image for Windows 11, version 24H2 and needs to be manually installed whenever a device goes from Home to Pro.

Workaround

Use the Deployment Image Servicing and Management (DISM) command-line tool to install the Windows Sense Client from an elevated command prompt. See the command below.

DISM /online /Add-Capability /CapabilityName:Microsoft.Windows.Sense.Client~~~~

KB5043950: Windows 11, version 24H2 support - Microsoft Support