Skip to main content

Disable virtualization-based security (VBS)

Apply Now
Works with Windows 10 and 11Works with Windows Vista, XP, 7, 8, 10, 11, and Windows Server 2008 or newer.
  • Windows onlyThis script improves your privacy on Windows
  • Single actionThis page belongs to a script, containing basic changes to achieve a task.
  • Impact: High

    System Functionality / Data Loss Risk: High

    This action improves privacy with high impact when you run the recommended script.

  • Batch (batchfile)These changes use Windows system commands to update your settings.
  • Administrator rights requiredThis script requires privilege access to do the system changes
  • Fully reversible

    You can fully restore this action (revert back to the original behavior) using this website.

    The restore/revert methods provided here can help you fix issues.

Overview​

This script disables Virtualization-based Security (VBS) in Windows.

Virtualization-based security (VBS) uses hardware virtualization to create an isolated, secure environment 1. This environment helps protect vital system and operating system resources, as well as security assets like authenticated user credentials 1. VBS requires Secure Boot to run 1 2.

VBS includes a memory integrity feature 1, also called hypervisor-protected code integrity (HVCI) 1 and hypervisor enforced code integrity 1. It protects Windows by running kernel mode code integrity within the isolated virtual environment 1.

Initially released as part of Defender Device Guard 1 this feature is now part of Defender Application Control 3 4. Although the Device Guard brand is no longer used, it still appears in some Windows registry settings 1 5. VBS and its memory integrity feature now operate independently 5.

This script may enhance privacy by giving you more control over your system. VBS isolates kernel mode drivers and executables, preventing modifications 1. For example, you may want to disable Defender, which collects telemetry and personal data 6. Disabling Defender requires disabling its kernel drivers 7, which are protected by VBS. Disabling VBS allows for deeper system-level changes to improve privacy.

This script may also improve system performance. VBS can slow down apps and games by 5 to 15% 8.

However, disabling VBS has security implications:

  • It reduces protection against credential theft.
  • It makes the system more vulnerable to certain types of malware.
  • If you disable VBS, you will automatically disable Credential Guard, which relies on VBS 9. Credential Guard uses VBS to store credentials and other secrets in a protected environment 10. This environment is isolated from the operating system 10.
Caution

This action may reduce system security by removing protections that block malicious code from accessing critical components.

Technical Details​

This script modifies multiple registry keys to disable VBS and its features:

  • Disables VBS through:
    • HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard!EnableVirtualizationBasedSecurity 8 9 11 12 13 14
    • HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard!EnableVirtualizationBasedSecurity 2
  • Disables Secure Boot and DMA protection 2 9 11 through:
    • HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard!RequirePlatformSecurityFeatures 2 9 11 12 13 14
    • HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard!RequirePlatformSecurityFeatures 2
  • Disables memory integrity 2 11 through:
    • HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity!Enabled 11 12 13 14
  • Disables UEFI lock 11 through:
    • HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard!Locked 11 14
    • HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard!Unlocked 13
    • HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard!NoLock 14
    • HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity!Locked 14
  • Disables boot prevention if VBS modules fail 11 through:
    • HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard!Mandatory 11
  • Disables signature check:
    • HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard!RequireMicrosoftSignedBootChain 12
  • Disable Hypervisor-Protected Code Integrity (HVCI):
    • HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity!HVCIMATRequired 12
    • HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard!HVCIMATRequired 2
  1. Not Advised

    This script should only be used by advanced users.

    This script is not recommended for daily use as it breaks important functionality.

    Consider creating a system restore point before doing any changes.

  2. Security Trade-off

    This action prioritizes privacy over certain security features. It's not recommended and should only be used by advanced users after understanding its implications.

    Increased Privacy

    Enhanced privacy through reduced data collection and tracking

    Decreased Security

    Some security features will be disabled or limited

    This script can be reversed, this action allows you to can restore the system security.

Sources
PrivacyLearn.com maintains strict sourcing standards for accuracy, integrity and up-to-date content. Our content relies on authoritative sources including vendor documentation, industry standards, and verified research. Learn more about our verification process and quality standards in our editorial standards page.

Apply Now​

Choose one of three ways to apply:

Download script​

Download and run the script directly
  • No app needed
  • Offline usage
  • Easy-to-apply
  • Free
  • Open-source
Help

How to apply or restore "Disable virtualization-based security (VBS)" using script​

  • ≈ 2 min to complete
  • Tools: Web Browser
  • Difficulty: Simple
  • ≈ 5 instructions
  1. 1

    Download

    Download the script file by clicking on the   Apply protection  button above.
    Use   Undo protection button above to restore changes.
  2. 2

    Keep the file

    If warned by your browser, keep the file.
  3. 3

    Open

    Open the downloaded file.
  4. 4

    Exit

    Once it's done, press any key to exit the window.
  5. 5

    Restart

    Restart your computer for all changes to take effect.

Apply with privacy.sexy​

Guided, automated application with safety checks
  • Recommended for most users
  • Includes safety checks
  • Free
  • Open-source
  • Popular
  • Offline/Online usage
Open privacy.sexy
Help

How to apply or restore "Disable virtualization-based security (VBS)" using privacy.sexy​

  • ≈ 3 min to complete
  • Tools: privacy.sexy
  • Difficulty: Simple
  • ≈ 4 instructions
privacy.sexy is free and open-source application that lets securely apply this action easily with more advanced options.
  1. 1

    Open or download

    Open or download the desktop application
  2. 2

    Choose script

    1. Search for the script name: Disable virtualization-based security (VBS)
    2. Check the script by clicking on the checkbox.
  3. 3

    Run

    Click on ▶️ Run button at the bottom of the page.

    This button only appears on desktop version (recommended). On browser, use 💾 Save button.

Run commands​

Copy and run commands manually Requires technical knowledge
Apply changes
:: Set the registry value: "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard!EnableVirtualizationBasedSecurity"
PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard'; $data = '0'; reg add 'HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard' /v 'EnableVirtualizationBasedSecurity' /t 'REG_DWORD' /d "^""$data"^"" /f"
:: Set the registry value: "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard!EnableVirtualizationBasedSecurity"
PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard' /v 'EnableVirtualizationBasedSecurity' /t 'REG_DWORD' /d "^""$data"^"" /f"
:: Set the registry value: "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard!RequirePlatformSecurityFeatures"
PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard'; $data = '0'; reg add 'HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard' /v 'RequirePlatformSecurityFeatures' /t 'REG_DWORD' /d "^""$data"^"" /f"
:: Set the registry value: "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard!RequirePlatformSecurityFeatures"
PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard' /v 'RequirePlatformSecurityFeatures' /t 'REG_DWORD' /d "^""$data"^"" /f"
:: Set the registry value: "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard!Locked"
PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard'; $data = '0'; reg add 'HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard' /v 'Locked' /t 'REG_DWORD' /d "^""$data"^"" /f"
:: Set the registry value: "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard!NoLock"
PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard'; $data = '1'; reg add 'HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard' /v 'NoLock' /t 'REG_DWORD' /d "^""$data"^"" /f"
:: Set the registry value: "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard!Unlocked"
PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard'; $data = '1'; reg add 'HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard' /v 'Unlocked' /t 'REG_DWORD' /d "^""$data"^"" /f"
:: Set the registry value: "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity!Locked"
PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity'; $data = '0'; reg add 'HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity' /v 'Locked' /t 'REG_DWORD' /d "^""$data"^"" /f"
:: Set the registry value: "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard!RequireMicrosoftSignedBootChain"
PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard'; $data = '0'; reg add 'HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard' /v 'RequireMicrosoftSignedBootChain' /t 'REG_DWORD' /d "^""$data"^"" /f"
:: Set the registry value: "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity!Enabled"
PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity'; $data = '0'; reg add 'HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity' /v 'Enabled' /t 'REG_DWORD' /d "^""$data"^"" /f"
:: Set the registry value: "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard!HypervisorEnforcedCodeIntegrity"
PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard' /v 'HypervisorEnforcedCodeIntegrity' /t 'REG_DWORD' /d "^""$data"^"" /f"
:: Set the registry value: "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard!Mandatory"
PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard'; $data = '0'; reg add 'HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard' /v 'Mandatory' /t 'REG_DWORD' /d "^""$data"^"" /f"
:: Set the registry value: "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity!HVCIMATRequired"
PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity'; $data = '0'; reg add 'HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity' /v 'HVCIMATRequired' /t 'REG_DWORD' /d "^""$data"^"" /f"
:: Set the registry value: "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard!HVCIMATRequired"
PowerShell -ExecutionPolicy Unrestricted -Command "$registryPath = 'HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard'; $data = '0'; reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard' /v 'HVCIMATRequired' /t 'REG_DWORD' /d "^""$data"^"" /f"
Help

How to apply or restore "Disable virtualization-based security (VBS)" using commands​

  • ≈ 2 min to complete
  • Tools: Command Prompt
  • Difficulty: Medium
  • ≈ 3 instructions
 View step-by-step guide with screenshots
  1. 1

    Open Command Prompt

    Open Command Prompt as Administrator.
  2. 2

    Copy code

    Copy the code:
    Copy Apply Code Copy Revert Code
  3. 3

    Paste & run

    Paste the commands into Command Prompt and press Enter to run.

    Some changes require a system restart to take effect

Similar Guides​

Wider Goal​

Guides below includes this guide to achieve a wider goal.

See other more general settings that includes this one as one of its actions.

These plans combine multiple privacy settings, including this one, for stronger protection.

This category disables features that restrict system modifications in Windows. This enables deeper system modifications, enhancing privacy by allowing the removal ...
Visit category page

Same Goal​

Other guides in Disable system modification restrictions 

See settings that are in the same category as this guide.

Using other actions in the same category may help you achieve your goal better.

Disable Defender System Guard
Disable Defender Antivirus minifilter driver
Disable Defender Antivirus boot driver
Disable security event monitoring
Disable Secure Boot driver
Disable Tamper Protection

About the Creators​

These people have authored this documentation and written its scripts:

  • Avatar of undergroundwires. The creator of PrivacyLearn and privacy.sexy. Black and white portrait showing a person wearing a polka dot tie and suit jacket, reflecting the professional expertise behind the privacy protection tools.
    • Certified security professional
    • 7+ years experience securing banks
    • Open-source developer since 2005
    • EU advisor, Public Speaker, Moderator
    • Hundreds across the globe
    • Testers, reviewers, developers
    • Companies, military agencies
    • Community since 2017
About Us

Reviewed By​

This guide has undergone comprehensive auditing and peer review:

  • Expert review by undergroundwires​

    • Verified technical accuracy and editorial standards
    • Assessed system impact and user privacy risks

  • Public review by large community​

    • Privacy enthusiasts and professionals peer-reviewed
    • Millions of end-users tested across different environments

History​

We continually monitor our guides, their impact and all other privacy options. We update our guides when new information becomes available. On every update, we publicly store who made the change, what has been changed, why the change was made and when the change was made.

Review Change History Our Change Process