> For the complete documentation index, see [llms.txt](https://docs.ionos.com/cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ionos.com/cloud/backup-and-storage/images-snapshots/public-images/deactivate-vbs-hvci-microsoft-windows-server-2025.md).
# Deactivate Virtualization-Based Security and Hypervisor-Enforced Code Integrity
Windows Server 2025 running on KVM-based hypervisors can experience significant performance degradation. The Windows features Virtualization-Based Security (VBS) and Hypervisor-Enforced Code Integrity (HVCI) rely on nested virtualization. When activated, this leads to measurable performance issues, particularly for CPU-intensive workloads.
## Key behavior
* VBS and HVCI capability is active by default in Windows Server 2025.
* Windows handles activation automatically based on application requirements and the installed roles and features.
* Activation may occur silently after role installation or configuration changes.
## Known triggers
The following triggers VBS or HVCI activation:
* **Remote Desktop Session Host (Terminal Server):** Installing this role automatically enables Credential Guard, which depends on VBS to isolate authentication credentials in a hardware-protected enclave.
* **Windows Subsystem for Linux (WSL):** WSL 2 runs a lightweight Hyper-V VM under the hood; it activates the virtual machine platform feature, which brings up the Windows hypervisor stack and triggers VBS.
* **Microsoft SQL Server 2025:** SQL Server 2025 activates HVCI as part of its hardened execution environment to protect against code injection and memory tampering at the kernel level.
## Deactivate VBS and HVCI
To deactivate VBS and HVCI on Windows Server 2025, follow these steps:
{% hint style="info" %}
**Prerequistes:**
* Administrator access to the Windows Server 2025 instance.
* Access to space.vars.ionos\_cloud to perform a full VM restart. It is the necessary permission to perform the optional, Step 5 to deactivate VBS and HVCI.
{% endhint %}
{% stepper %}
{% step %}
### Deactivate Credential Guard or VBS
Deactivate the policy that enables VBS by default. Choose one of the following methods:
* **Via Group Policy:**
Navigate to **Computer Configuration > Administrative Templates > System > Device Guard** and set the policy to **Disabled**.
* **Via Registry:**
```bash
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LsaCfgFlags /t REG_DWORD /d 0 /f
```
To revert: Remove the registry key or set the **Group Policy** to **Not Configured**.
{% endstep %}
{% step %}
### Deactivate HVCI (Memory integrity)
These registry keys deactivate HVCI (kernel code integrity enforcement) and Credential Guard (credential isolation), both of which rely on VBS and contribute to nested virtualization overhead on KVM.
HVCI enforces that only trusted, signed code runs in kernel memory; deactivating it removes the code integrity check that triggers nested virtualization on KVM.
```bash
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 0 /f
```
Credential Guard isolates authentication credentials in a VBS-protected enclave; disabling it prevents the associated hypervisor from launching on KVM.
```bash
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" /v Enabled /t REG_DWORD /d 0 /f
```
{% hint style="info" %}
Additional scenarios may exist depending on which roles are running on the server. Usually, you must not change anything for `KeyGuard`. The two commands above cover Terminal Server scenarios.
{% endhint %}
To revert: set the `Enabled` values back to `1`.
{% endstep %}
{% step %}
### Prevent the hypervisor from launching at start
```bash
bcdedit /set hypervisorlaunchtype off
bcdedit /set vsmlaunchtype off
```
It prevents the Windows hypervisor and Virtual Secure Mode from starting during system start.
To revert: Set both values back to `auto`.
{% endstep %}
{% step %}
### Restart
Restart the server to apply the changes. It improves performance.
{% endstep %}
{% step %}
### Full VM restart using IONOS CLOUD (Optional)
For maximum effect, perform a full VM cycle to remove residual nested virtualization detection at the hypervisor level:
1. Shut down the guest OS.
2. Stop the VM in space.vars.ionos\_cloud.
3. Start the VM in space.vars.ionos\_cloud.
{% endstep %}
{% endstepper %}
{% hint style="success" %}
**Result:** The VM has completed a full power cycle. Any residual nested virtualization detection at the hypervisor level has been cleared, and VBS/HVCI are fully deactivated.
{% endhint %}
## Verification
### Method 1: System Information
Run `msinfo32.exe` and confirm:
* **Virtualization-based security** shows **Not enabled**.
* You do not see the message "A hypervisor has been detected...".
### Method 2: PowerShell
```powershell
(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning
```
If VBS and HVCI are deactivated, `SecurityServicesRunning` returns `0`.
{% hint style="info" %}
**Note:** The workaround does not affect other security features such as firmware startup protection or TPM 2.0. All steps are fully reversible.
{% endhint %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.ionos.com/cloud/backup-and-storage/images-snapshots/public-images/deactivate-vbs-hvci-microsoft-windows-server-2025.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.