Windows 10: Windows 11: Security-feature VBS Enclaves is being deprecated on some systems

GHacks · Apr 17, 2025

Microsoft announced the deprecation of the security feature VBS Enclaves today for earlier versions of Windows 11 and Windows Server. Based on VBS, Virtualized-Based Security, VBS Enclaves were formally introduced by Microsoft in Windows Server 2019. Microsoft improved the feature ever since, for instance by opening it up for third-party apps last year.

The deprecation announcement offers no explanation why the feature is being removed from older versions of Windows 11 and Windows Server.

The details:

VBS Enclaves continue to be supported in Windows 11, version 24H2 and later, or Windows Server 2025 and later.

The feature is deprecated on Windows 11, version 23H2 and earlier, and Windows Server 2022 and earlier.

Note: This has nothing to do with VBScript, which Microsoft deprecated in 2023.

VBS Enclaves explained

VBS Enclaves provide isolated, secure environments for sensitive data on Windows systems. Only a few Microsoft and Windows-specific programs are confirmed to use the feature at the time of writing. Besides Microsoft Azure SQL Database, it is Windows 11's Recall feature and Credential Guard that are making use of it as well.

One advantage of VBS Enclaves is that they do not have hardware dependencies. As long as the VBS Enclaves feature is enabled on a supported Windows PC, it should work fine.

What deprecation means

Deprecation does not mean that the feature is going to be removed immediately. It means that a specific feature will be removed in a future version of the operating system. Or, in this case, in a future update for the affected operating systems. In fact, most home users may not be impacted by this at all. Here is why.

Windows 11, version 23H2 reaches end of support this November. All previous versions of Windows 11 are no longer supported for consumers. Means, Microsoft would have to remove the feature between April 2025 and November 2025 to affect home users. It seems unlikely that this is going to be the case.

Microsoft does not give a reason for the removal, which makes it all the more puzzling. Since the removal does not affect most home users, it is likely business and Enterprise customers that Microsoft is aiming at with the notice of deprecation.

One possible explanation is found on the Secure Enclaves documentation on Microsoft's Windows App Development website. There, Microsoft has added the following note: "Using these APIs for a VBS Enclave requires Windows 11 Build 26100.2314 or later or Windows Server 2025 or later."

It is possible that the deprecation affects third-party apps and they access to the API only and not first-party apps. We asked Microsoft about this but have not heard back at this point. We will update the article when we receive an answer.

Thank you for being a Ghacks reader. The post Windows 11: Security-feature VBS Enclaves is being deprecated on some systems appeared first on gHacks Technology News.

read more...

Brink · Apr 17, 2025

Virtualization-based security (VBS) memory enclaves: Data protection

The escalating sophistication of cyberattacks is marked by the increased use of kernel-level exploits that attempt to run malware with the highest privileges and evade security solutions and software sandboxes. Kernel exploits famously gave the WannaCry and Petya ransomware remote code execution capability, resulting in widescale global outbreaks.

Windows 10 remained resilient to these attacks, with Microsoft constantly raising the bar in platform security to stay ahead of threat actors. Virtualization-based security (VBS) hardens Windows 10 against attacks by using the Windows hypervisor to create an environment that isolates a secure region of memory known as secure memory enclaves.

Figure 1. VBS secure memory enclaves

An enclave is an isolated region of memory within the address space of a user-mode process. This region of memory is controlled entirely by the Windows hypervisor. The hypervisor creates a logical separation between the “normal world” and “secure world”, designated by Virtual Trust Levels, VTL0 and VT1, respectively. VBS secure memory enclaves create a means for secure, attestable computation in an otherwise untrusted environment.

VBS enclaves in Microsoft SQL Server

A key technology that will leverage VBS secure memory enclaves is Microsoft SQL Server. The upcoming SQL Server secure enclave feature ensures that sensitive data stored in an SQL Server database is only decrypted and processed inside an enclave. SQL Server’s use of secure enclaves allows the processing of sensitive data without exposing the data to database administrators or malware. This reduces the risk of unauthorized access and achieves separation between those who own the data (and can view it) and those who manage the data (but should have no access). To learn more about the use of secure enclaves in SQL Server, see the blog post Enabling confidential computing with Always Encrypted using enclaves.

Data protection

One of the major benefits of secure memory enclaves is data protection. Data resident in an enclave is only accessible by code running inside that enclave. This means that there is a security boundary between VTL0 and VTL1. If a process tries to read memory that is within the secure memory enclave, an invalid access exception is thrown. This happens even when a kernel-mode debugger is attached to the normal process – the debugger will fail when trying to step into the enclave.

Code integrity

Code integrity is another major benefit provided by enclaves. Code loaded into an enclave is securely signed with a key; therefore, guarantees can be made about the integrity of code running within a secure memory enclave. The code running inside an enclave is incredibly restricted, but a secure memory enclave can still perform meaningful work. This includes performing computations on data that is encrypted outside the enclave but can be decrypted and evaluated in plaintext inside the enclave, without exposing the plaintext to anything other than the enclave itself. A great example of why this is useful in a multi-tenant cloud computing scenario is described in the Azure confidential computing blog post. This move allowed us to continually make significant innovations in platform security.

Attestation

Attestation is also a critical aspect of secure memory enclaves. Sensitive information, such as plaintext data or encryption keys, must only be sent to the intended enclave that must be trusted. VBS enclaves can be put into debug mode for testing but lose memory isolation. This is great for testing, but in production this impacts the security guarantees of the enclave. To ensure that a production secure enclave is never in debug mode, an attestation report is generated to state what mode the enclave is in (among various other configuration and identity parameters). This report is then verified by a trust relationship between the consumer and producer of the report.

To establish this trust, VBS enclaves can expose an enclave attestation report that is fully signed by the VBS-unique key. This can prove the relationship between the enclave and host, as well as the exact configuration of the enclave. This attestation report can be used to establish a secure channel of communication between two enclaves. In Windows this is possible simply by exchanging the report. For remote scenarios, an attestation service can use this report to establish a trust relationship between a remote enclave and a client application.

One feature that relies on secure memory enclave attestation is Windows Defender System Guard runtime attestation, which allows users to measure and attest to all interactions from the enclave to other capabilities, including areas of runtime and boot integrity.

Figure 2. Windows Defender System Guard runtime attestation

Elevating data security

There are many secure memory enclave technologies in the industry today. Each have pros and cons in capabilities. The benefit of using a VBS secure memory enclave is that there are no special hardware requirements, only that the processor supports hypervisor virtualization extensions:

VBS-capable hardware

OEM hardware configuration

Hypervisor protected code integrity (HVCI) compliant drivers

Additionally, VBS enclaves do not have the same memory constraints as a hardware-based enclave, which are usually quite limited.

VBS secure memory enclaves provide hardware-rooted virtualization-based data protection and code integrity. They are leveraged for new data security capabilities, as demonstrated by Azure confidential computing and the Always Encrypted feature of Microsoft SQL Server. These are examples of the rapid innovation happening all throughout Microsoft to elevate security. This isn’t the last you’ll hear of secure memory enclaves. As Microsoft security technologies continue to advance, we can expect secure memory enclaves to stand out in many more protection scenarios.

Maxwell Renke, Program manager, Windows

Chris Riggs, Principal Program Manager, Microsoft Offensive Security Research
Click to expand...

Source: Virtualization-based security (VBS) memory enclaves: Data protection through isolation Microsoft Secure

Brink · Apr 17, 2025

Virtualization-based security (VBS) memory enclaves: Data protection

The escalating sophistication of cyberattacks is marked by the increased use of kernel-level exploits that attempt to run malware with the highest privileges and evade security solutions and software sandboxes. Kernel exploits famously gave the WannaCry and Petya ransomware remote code execution capability, resulting in widescale global outbreaks.

Windows 10 remained resilient to these attacks, with Microsoft constantly raising the bar in platform security to stay ahead of threat actors. Virtualization-based security (VBS) hardens Windows 10 against attacks by using the Windows hypervisor to create an environment that isolates a secure region of memory known as secure memory enclaves.

Figure 1. VBS secure memory enclaves

An enclave is an isolated region of memory within the address space of a user-mode process. This region of memory is controlled entirely by the Windows hypervisor. The hypervisor creates a logical separation between the “normal world” and “secure world”, designated by Virtual Trust Levels, VTL0 and VT1, respectively. VBS secure memory enclaves create a means for secure, attestable computation in an otherwise untrusted environment.

VBS enclaves in Microsoft SQL Server

A key technology that will leverage VBS secure memory enclaves is Microsoft SQL Server. The upcoming SQL Server secure enclave feature ensures that sensitive data stored in an SQL Server database is only decrypted and processed inside an enclave. SQL Server’s use of secure enclaves allows the processing of sensitive data without exposing the data to database administrators or malware. This reduces the risk of unauthorized access and achieves separation between those who own the data (and can view it) and those who manage the data (but should have no access). To learn more about the use of secure enclaves in SQL Server, see the blog post Enabling confidential computing with Always Encrypted using enclaves.

Data protection

One of the major benefits of secure memory enclaves is data protection. Data resident in an enclave is only accessible by code running inside that enclave. This means that there is a security boundary between VTL0 and VTL1. If a process tries to read memory that is within the secure memory enclave, an invalid access exception is thrown. This happens even when a kernel-mode debugger is attached to the normal process – the debugger will fail when trying to step into the enclave.

Code integrity

Code integrity is another major benefit provided by enclaves. Code loaded into an enclave is securely signed with a key; therefore, guarantees can be made about the integrity of code running within a secure memory enclave. The code running inside an enclave is incredibly restricted, but a secure memory enclave can still perform meaningful work. This includes performing computations on data that is encrypted outside the enclave but can be decrypted and evaluated in plaintext inside the enclave, without exposing the plaintext to anything other than the enclave itself. A great example of why this is useful in a multi-tenant cloud computing scenario is described in the Azure confidential computing blog post. This move allowed us to continually make significant innovations in platform security.

Attestation

Attestation is also a critical aspect of secure memory enclaves. Sensitive information, such as plaintext data or encryption keys, must only be sent to the intended enclave that must be trusted. VBS enclaves can be put into debug mode for testing but lose memory isolation. This is great for testing, but in production this impacts the security guarantees of the enclave. To ensure that a production secure enclave is never in debug mode, an attestation report is generated to state what mode the enclave is in (among various other configuration and identity parameters). This report is then verified by a trust relationship between the consumer and producer of the report.

To establish this trust, VBS enclaves can expose an enclave attestation report that is fully signed by the VBS-unique key. This can prove the relationship between the enclave and host, as well as the exact configuration of the enclave. This attestation report can be used to establish a secure channel of communication between two enclaves. In Windows this is possible simply by exchanging the report. For remote scenarios, an attestation service can use this report to establish a trust relationship between a remote enclave and a client application.

One feature that relies on secure memory enclave attestation is Windows Defender System Guard runtime attestation, which allows users to measure and attest to all interactions from the enclave to other capabilities, including areas of runtime and boot integrity.

Figure 2. Windows Defender System Guard runtime attestation

Elevating data security

There are many secure memory enclave technologies in the industry today. Each have pros and cons in capabilities. The benefit of using a VBS secure memory enclave is that there are no special hardware requirements, only that the processor supports hypervisor virtualization extensions:

VBS-capable hardware

OEM hardware configuration

Hypervisor protected code integrity (HVCI) compliant drivers

Additionally, VBS enclaves do not have the same memory constraints as a hardware-based enclave, which are usually quite limited.

VBS secure memory enclaves provide hardware-rooted virtualization-based data protection and code integrity. They are leveraged for new data security capabilities, as demonstrated by Azure confidential computing and the Always Encrypted feature of Microsoft SQL Server. These are examples of the rapid innovation happening all throughout Microsoft to elevate security. This isn’t the last you’ll hear of secure memory enclaves. As Microsoft security technologies continue to advance, we can expect secure memory enclaves to stand out in many more protection scenarios.

Maxwell Renke, Program manager, Windows

Chris Riggs, Principal Program Manager, Microsoft Offensive Security Research
Click to expand...

Source: Virtualization-based security (VBS) memory enclaves: Data protection through isolation Microsoft Secure

Brink · Apr 17, 2025

Deprecated features in Windows 11 and Windows 10 for November 2023

[table][tr][td]Feature[/td] [td]Details and mitigation[/td] [td]Deprecation announced[/td] [/tr] [tr][td]Steps Recorder (psr.exe)[/td] [td]Steps Recorder is no longer being updated and will be removed in a future release of Windows. For screen recording, we recommend the Snipping Tool, Xbox Game Bar, or Microsoft Clipchamp.[/td] [td]November 2023[/td] [/tr] [tr][td]Tips[/td] [td]The Tips app is deprecated and will be removed in a future release of Windows. Content in the app will continue to be updated with information about new Windows features until the app is removed.[/td] [td]November 2023[/td] [/tr] [tr][td]Computer Browser[/td] [td]The Computer Browser driver and service are deprecated. The browser (browser protocol and service) is a dated and insecure device location protocol. This protocol, service, and driver were first disabled by default in Windows 10 with the removal of the SMB1 service. For more information on Computer Browser, see MS-BRWS Common Internet File System.[/td] [td]November 2023[/td] [/tr] [tr][td]Webclient (WebDAV) Service[/td] [td]The Webclient (WebDAV) service is deprecated. The Webclient service isn't started by default in Windows. For more information on WebDAV, see WebDAV - Win32 apps.[/td] [td]November 2023[/td] [/tr] [tr][td]Remote Mailslots[/td] [td]Remote Mailslots are deprecated. The Remote Mailslot protocol is a dated, simple, unreliable, insecure IPC method first introduced in MS DOS. This protocol was first disabled by default in Windows 11 Insider Preview Build . For more information on Remote Mailslots, see About Mailslots and [MS-MAIL]: Remote Mailslot Protocol.[/td] [td]November 2023[/td] [/tr] [/table]
Source: https://learn.microsoft.com/en-us/wi...cated-features

Windows 10: Windows 11: Security-feature VBS Enclaves is being deprecated on some systems

Windows 11: Security-feature VBS Enclaves is being deprecated on some systems

Windows 11: Security-feature VBS Enclaves is being deprecated on some systems

Windows 11: Security-feature VBS Enclaves is being deprecated on some systems

Windows 11: Security-feature VBS Enclaves is being deprecated on some systems - Similar Threads - Security feature VBS

Windows Server 2022 Features removed or deprecated

List of Features to be Deprecated or Removed in Windows 11

These are the deprecated and removed features of Windows 11

Features being removed or deprecated in Windows 10 version 1903

Windows Server 2019 Removed & Deprecated features

Windows Server 2019: removed and deprecated features

Is Microsoft deprecating the People feature in Windows 10?

Features being removed or deprecated in Windows 10 version 1809

Virtualization-based security (VBS) memory enclaves: Data protection