Deactivate Virtualization-Based Security and Hypervisor-Enforced Code Integrity

Windows Server 2025 running on KVM-based hypervisors can experience significant performance degradation. The Windows features Virtualization-Based Security (VBS) and Hypervisor-Enforced Code Integrity (HVCI) rely on nested virtualization. When activated, this leads to measurable performance issues, particularly for CPU-intensive workloads.

Key behavior

• VBS and HVCI capability is active by default in Windows Server 2025.
• Windows handles activation automatically based on application requirements and the installed roles and features.
• Activation may occur silently after role installation or configuration changes.

Known triggers

The following triggers VBS or HVCI activation:

• Remote Desktop Session Host (Terminal Server): Installing this role automatically enables Credential Guard, which depends on VBS to isolate authentication credentials in a hardware-protected enclave.
• Windows Subsystem for Linux (WSL): WSL 2 runs a lightweight Hyper-V VM under the hood; it activates the virtual machine platform feature, which brings up the Windows hypervisor stack and triggers VBS.
• Microsoft SQL Server 2025: SQL Server 2025 activates HVCI as part of its hardened execution environment to protect against code injection and memory tampering at the kernel level.

Deactivate VBS and HVCI

To deactivate VBS and HVCI on Windows Server 2025, follow these steps:

Prerequistes:

• Administrator access to the Windows Server 2025 instance.
• Access to IONOS CLOUD to perform a full VM restart. It is the necessary permission to perform the optional, Step 5 to deactivate VBS and HVCI.

1

Deactivate Credential Guard or VBS

Deactivate the policy that enables VBS by default. Choose one of the following methods:

• Via Group Policy:

Navigate to Computer Configuration > Administrative Templates > System > Device Guard and set the policy to Disabled.

• Via Registry:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags /t REG_DWORD /d 0 /f

To revert: Remove the registry key or set the Group Policy to Not Configured.

2

Deactivate HVCI (Memory integrity)

These registry keys deactivate HVCI (kernel code integrity enforcement) and Credential Guard (credential isolation), both of which rely on VBS and contribute to nested virtualization overhead on KVM.

HVCI enforces that only trusted, signed code runs in kernel memory; deactivating it removes the code integrity check that triggers nested virtualization on KVM.

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 0 /f

Credential Guard isolates authentication credentials in a VBS-protected enclave; disabling it prevents the associated hypervisor from launching on KVM.

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" /v Enabled /t REG_DWORD /d 0 /f

Additional scenarios may exist depending on which roles are running on the server. Usually, you must not change anything for KeyGuard. The two commands above cover Terminal Server scenarios.

To revert: set the Enabled values back to 1.

3

Prevent the hypervisor from launching at start

bcdedit /set hypervisorlaunchtype off
bcdedit /set vsmlaunchtype off

It prevents the Windows hypervisor and Virtual Secure Mode from starting during system start.

To revert: Set both values back to auto.

4

Restart

Restart the server to apply the changes. It improves performance.

5

Full VM restart using IONOS CLOUD (Optional)

For maximum effect, perform a full VM cycle to remove residual nested virtualization detection at the hypervisor level:

1. Shut down the guest OS.
2. Stop the VM in IONOS CLOUD.
3. Start the VM in IONOS CLOUD.

Result: The VM has completed a full power cycle. Any residual nested virtualization detection at the hypervisor level has been cleared, and VBS/HVCI are fully deactivated.

Verification

Method 1: System Information

Run msinfo32.exe and confirm:

• Virtualization-based security shows Not enabled.
• You do not see the message "A hypervisor has been detected...".

Method 2: PowerShell

(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning

If VBS and HVCI are deactivated, SecurityServicesRunning returns 0.

Note: The workaround does not affect other security features such as firmware startup protection or TPM 2.0. All steps are fully reversible.