Security

How to Enable Virtualization-Based Security (VBS) in Windows 11

Boost your Windows 11 security by activating Virtualization-Based Security, a powerful feature that creates an isolated memory environment to protect against malware and unauthorized drivers.

By Shivamm 3 min read
How to Enable Virtualization-Based Security (VBS) in Windows 11

Virtualization-Based Security (VBS) is a robust security feature in Windows 11 that creates an isolated memory region to protect your system from malicious code and unauthorized drivers. While it’s a powerful tool for enhancing system security, you might find that it’s not enabled by default on your Windows 11 machine. This guide will walk you through the process of enabling VBS and explain its benefits and potential impacts on system performance.

What is Virtualization-Based Security?

VBS utilizes hardware virtualization features to create a secure, isolated memory environment separate from the main operating system. This isolated environment hosts critical security features, including:

  • Credential Guard: Protects login credentials from theft.
  • Hypervisor-Enforced Code Integrity (HVCI): Prevents the loading of untrusted drivers and executables.
  • System Guard: Verifies the integrity of the Windows boot process.

By running these security features in an isolated environment, VBS significantly reduces the attack surface available to malware and other threats, even if they manage to compromise the main operating system kernel.

Checking VBS Status

Before attempting to enable VBS, it’s a good idea to check if it’s already active on your system. Here’s how:

Step 1: Press the Windows key and type “System Information”, then click on the app when it appears in the search results.

Step 2: In the System Information window, scroll down to find the “Virtualization-based security” entry. If it says “Running”, VBS is already enabled. If it says “Not enabled”, you’ll need to activate it.

Method 1: Enabling VBS through Windows Security

The easiest way to enable VBS is through the Windows Security app:

Step 1: Open the Start menu and type “Windows Security”, then click on the app when it appears.

Step 2: In the Windows Security app, click on “Device security” in the left sidebar.

Step 3: Under the “Core isolation” section, click on “Core isolation details”.

Step 4: Toggle the switch for “Memory integrity” to On. This feature is a key component of VBS.

Step 5: You’ll be prompted to restart your computer. Save any open work and click “Restart now” to apply the changes.

After your computer restarts, VBS should be enabled. You can verify this by checking the System Information app again.

Method 2: Enabling VBS through the Registry Editor

If the Windows Security method doesn’t work, you can try enabling VBS through the Registry Editor. Be cautious when editing the registry, as incorrect changes can cause system instability.

Step 1: Press Windows key + R to open the Run dialog, type “regedit”, and press Enter. Click “Yes” if prompted by User Account Control.

Step 2: In the Registry Editor, navigate to the following key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity

Step 3: Right-click in the right pane, select New > DWORD (32-bit) Value, and name it “Enabled”.

Step 4: Double-click the new “Enabled” value, set its data to 1, and click OK.

Step 5: Close the Registry Editor and restart your computer for the changes to take effect.

VBS Requirements and Considerations

Before enabling VBS, ensure your system meets these requirements:

  • 64-bit processor with Second Level Address Translation (SLAT).
  • CPU virtualization extensions (Intel VT-x or AMD-V) enabled in BIOS/UEFI.
  • Trusted Platform Module (TPM) 2.0.
  • UEFI firmware version 2.3.1 or higher with Secure Boot capability.

Keep in mind that enabling VBS may slightly impact system performance, especially in gaming or other resource-intensive tasks. If you notice significant slowdowns, you might consider disabling VBS temporarily for those activities.

Troubleshooting VBS Issues

If you encounter problems enabling VBS or if it’s enabled but not running, try these steps:

Step 1: Ensure that CPU virtualization is enabled in your BIOS/UEFI settings. The exact steps vary by manufacturer, but you’ll typically find this option in the “Advanced” or “Security” sections.

Step 2: Open an elevated Command Prompt (run as administrator) and type the following command:

bcdedit /set hypervisorlaunchtype auto

Step 3: Restart your computer and check if VBS is now running.

If you still encounter issues, it’s possible that some of your hardware or drivers are incompatible with VBS. In this case, you may need to update your drivers or consult your device manufacturer for further assistance.

Enabling Virtualization-Based Security in Windows 11 adds a powerful layer of protection to your system. While it may require some initial setup and could have a minor impact on performance, the security benefits make it a worthwhile feature for most users. Remember to regularly update your system and drivers to ensure compatibility and optimal performance with VBS enabled.