Great info as usual, have one or two questions though.

My laptop supports virtualisation-based security but it is not enabled by default.

Secure Boot and TPM are on and enabled.

The question is whether to go into BIOS and enable virtualisation-based security, what advantages it gives, and whether there are any performance hits by doing so.

Thanks!

Specs. if needed:

Win 10 Pro v. 1803

RAM: 16GB

CPU: Intel(R) Core(TM) i7-8750H CPU @ 2.20GHz, 2208 Mhz, 6 Core(s), 12 Logical Processor(s)

Hello @Rubi,

You would need to enable virtualization for your CPU in your BIOS settings.

Afterwards, the tutorial below can show you how to enable the Device Guard feature, but it's only available for Windows 10 Enterprise and Windows 10 Education editions.

Enable or Disable Device Guard in Windows 10 | Tutorials

If virtualization is enabled for your CPU in BIOS, you would be able to use Hyper-V if wanted.

Hyper-V virtualization - Setup and Use in Windows 10 | Tutorials

You're most welcome.

Brink said:

Hello @Rubi,

You would need to enable virtualization for your CPU in your BIOS settings.

Afterwards, the tutorial below can show you how to enable the Device Guard feature, but it's only available for Windows 10 Enterprise and Windows 10 Education editions.

Enable or Disable Device Guard in Windows 10 | Tutorials

You cannot enable Device Guard but you can enable Virtualization Based Security so that your command in powershell returns:

VirtualizationBasedSecurityStatus : 2

This enables IOMMU which provides many security benefits. With that enabled, the latest version of Windows claims that it provides:

Base Virtualization Support, Secure Boot, DMA Protection, UEFI Code Readonly, SMM Security Mitigations 1.0, Mode Based Execution Control

I highly recommend enabling this whether you're running Windows or Linux. I am not sure what support Apple provides for security through IOMMU.

TO be clear: You still have to go into the Group Policy Editor and you can turn on the virtualization based security under Device Guard, even with Windows 10 Pro. have not tried on Home but it is supposedly supported as well:

###########################################################################
Readiness Tool Version 3.4 Release.
Tool to check if your device is capable to run Device Guard and Credential Guard.
###########################################################################
###########################################################################
OS and Hardware requirements for enabling Device Guard and Credential Guard
1. OS SKUs: Available only on these OS Skus - Enterprise, Server, Education, Enterprise IoT, Pro, and Home
2. Hardware: Recent hardware that supports virtualization extension with SLAT
To learn more please visit: https://aka.ms/dgwhcr
###########################################################################

Hello @Brink,

Another great Tutorial as always.

I have been doing some work on this as part of a project that I am working on and found that there are a few entries that can be added for completeness.

AvailableSecurityProperties:

0. If present, no relevant properties exist on the device.
1. If present, hypervisor support is available.
2. If present, Secure Boot is available.
3. If present, DMA protection is available.
4. If present, Secure Memory Overwrite is available.
5. If present, NX protections are available.
6. If present, SMM mitigations are available.
7. If present, MBEC/GMET is available.
8. If present, APIC virtualization is available.

RequiredSecurityProperties:

0. Nothing is required.
1. If present, hypervisor support is needed.
2. If present, Secure Boot is needed.
3. If present, DMA protection is needed.
4. If present, Secure Memory Overwrite is needed.
5. If present, NX protections are needed.
6. If present, SMM mitigations are needed.
7. If present, MBEC/GMET is needed.

SecurityServicesConfigured:

0. No services are configured.
1. If present, Windows Defender Credential Guard is configured.
2. If present, memory integrity is configured.
3. If present, System Guard Secure Launch is configured.
4. If present, SMM Firmware Measurement is configured.

SecurityServicesRunning:

0. No services running.
1. If present, Windows Defender Credential Guard is running.
2. If present, memory integrity is running.
3. If present, System Guard Secure Launch is running.
4. If present, SMM Firmware Measurement is running.

VirtualizationBasedSecurityStatus:

0. VBS isn't enabled.
1. VBS is enabled but not running.
2. VBS is enabled and running.

I hope this helps.

Paul Black said:

Hello @Brink,

Another great Tutorial as always.

I have been doing some work on this as part of a project that I am working on and found that there are a few entries that can be added for completeness.

I hope this helps.

Thank you Paul. Now updated.