How to Configure Virtualization-Based Security (VBS) in Windows 11 Using PowerShell

Modern kernel-level threats and sophisticated rootkits attempt to compromise operating system execution at ring-0 privilege levels. To counteract kernel exploitation, Windows 11 implements Virtualization-Based Security (VBS). VBS leverages the Windows Hypervisor to create an isolated, hardware-enforced memory enclave known as Virtual Secure Mode (VSM). By decoupling security-critical assets from the standard operating system kernel, VBS prevents kernel memory manipulation even if an attacker gains root administrator privileges.

Understanding VBS and HVCI Architecture

VBS serves as the foundational security bedrock for advanced Windows 11 protections:

• Virtual Secure Mode (VSM): The hypervisor creates an isolated partition running at Virtual Trust Level 1 (VTL 1), while the normal Windows operating system and kernel operate at VTL 0. VTL 0 cannot access or modify VTL 1 memory directly.
• Hypervisor-Protected Code Integrity (HVCI): Also known as Memory Integrity; uses VSM to evaluate kernel-mode drivers and executables before they are permitted to run in kernel space, completely preventing unsigned or compromised driver injection.
• Credential Guard: Runs LSASS security operations inside VTL 1 to shield password hashes and Kerberos tickets from memory dumping utilities.

Auditing Active VBS Status via PowerShell

Before modifying system security parameters, query the host’s current VBS configuration using native WMI cmdlets in PowerShell:

# Query Device Guard security configuration
$dg = Get-CimInstance -Namespace root\Microsoft\Windows\DeviceGuard -ClassName Win32_DeviceGuard

# Display active VBS status
[PSCustomObject]@{
    VBS_Enabled           = ($dg.VirtualizationBasedSecurityStatus -eq 2)
    Security_Services_Configured = $dg.SecurityServicesConfigured
    Security_Services_Running    = $dg.SecurityServicesRunning
    Code_Integrity_Policy        = $dg.UsermodeCodeIntegrityPolicyEnforcementStatus
} | Format-List

A VirtualizationBasedSecurityStatus value of 2 confirms that VBS is actively running and guarding the system.

Enforcing VBS and Memory Integrity via Registry Policies

To enforce VBS and HVCI programmatically across enterprise images using PowerShell:

# Define Device Guard policy registry keys
$regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard"

# Create key path if absent
if (-not (Test-Path $regPath)) {
    New-Item -Path $regPath -Force | Out-Null
}

# Enforce VBS enablement
Set-ItemProperty -Path $regPath -Name "EnableVirtualizationBasedSecurity" -Value 1 -Type DWord

# Enforce Hypervisor-Protected Code Integrity (Memory Integrity) with UEFI lock
$scenPath = "$regPath\Scenarios\HypervisorEnforcedCodeIntegrity"
if (-not (Test-Path $scenPath)) {
    New-Item -Path $scenPath -Force | Out-Null
}
Set-ItemProperty -Path $scenPath -Name "Enabled" -Value 1 -Type DWord
Set-ItemProperty -Path $scenPath -Name "Locked" -Value 1 -Type DWord

Write-Host "VBS and HVCI successfully enforced in registry." -ForegroundColor Green

Locking HVCI ensures that policy settings cannot be disabled without physical access to UEFI firmware menus, providing tamper-resistant protection against firmware attacks.

Validating Hardware Prerequisites

Verify that your CPU features Intel VT-x or AMD-V virtualization, Second Level Address Translation (SLAT), and TPM 2.0. Enforcing VBS on Windows 11 establishes bulletproof hardware-backed security across enterprise workstations.