Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / Windows 11 Quietly Mandates Enterprise VBS for All
Transcript
- Lucas: If today's tech conversation gave you something usable — hang onto that thought, because we're going to talk about a security feature that Microsoft just made mandatory, and it has a real cost. Luna: Are we talking about Virtualization-Based Security? Because I've been seeing IT admins panic over it on Reddit lately. Lucas: Exactly. VBS. It's been around since Windows 10, but starting with the Windows 11 24H2 feature update — which hit broad rollout in May — Microsoft enabled it by default on every new Enterprise device. No enterprise admin can opt out during initial deployment unless they know exactly where the toggle is. Luna: Right, and the toggle isn't even in Settings. It's a Group Policy deep cut — under Computer Configuration > Administrative Templates > System > Device Guard. You have to turn off 'Turn On Virtualization Based Security' and then also make sure Hypervisor-Protected Code Integrity isn't forced. Lucas: Which is exactly the kind of thing that a busy IT department doesn't catch until after the first hundred machines are already imaged. And once it's on, VBS carves out a portion of RAM, spins up a separate virtual Secure World inside the hypervisor, and isolates critical kernel processes — like Credential Guard and Device Guard — away from the main OS. Luna: So the promise is that even if an attacker gains kernel-level access, they can't touch the LSA secrets or code integrity decisions because those live in a different virtual machine. Lucas: That's the pitch. And it works — Microsoft's own internal data shows that vbs enabled machines have significantly lower rates of credential theft and driver-based rootkits. But here's the number that matters: enterprise benchmarks show a performance hit of about 5 to 15 percent on cpu bound workloads. Some gpu intensive tasks can drop by as much as 25 percent because of the extra hypervisor overhead. Luna: That's not trivial for a company running hundreds of engineering workstations or financial modelling machines. I read a case study from a bank that saw their Monte Carlo simulation throughput drop by 18 percent after VBS was turned on. Lucas: And that's the tension Microsoft is forcing. They believe the security benefit outweighs the performance cost — and for most office workers, you won't notice the difference in Outlook or Excel. But for power users running CAD, video rendering, or heavy analytics, that 10 percent hit is real money. Luna: So what's the alternative? Can you safely run without VBS if you have other mitigations in place? Lucas: Yes — but Microsoft is slowly closing that door. The Windows Security Baseline, which many organizations use as their compliance starting point, now requires VBS for 'High Security' profiles. And if you're doing any government or defense work, you might be contractually bound to follow those baselines. Luna: And on the hardware side, VBS also demands that the CPU supports virtualization — which basically every modern Intel and AMD chip does — and that you have enough RAM to dedicate at least 1 gigabyte to the hypervisor. That's been a non-issue for new machines since 2022. Lucas: But here's the tricky part: third-party drivers. If you have a legacy scanner, a proprietary security camera system, or an old VPN client with a kernel-mode driver, VBS's Hypervisor Code Integrity — HVCI for short — blocks any driver that isn't signed with the Microsoft Hardware Developer Center. We've seen entire fleets of label printers stop working after a 24H2 upgrade. Luna: That's a nightmare for a warehouse or a hospital. So the responsible move for an IT admin right now is to run the HVCI Readiness Tool on every device model in their inventory, then test every line of business app that touches the kernel. Lucas: Absolutely. And the window to do that is shrinking. Microsoft has signaled that 24H2 will become the default OS image on new OEM shipments by October. So if you're not testing now, you're going to get VBS forced on you when you unbox that next batch of Dell or HP hardware. Luna: And that's actually a good segue to something I wanted to mention — a quick honest thing. The reason we can spend this much time digging into a single Windows feature, without any ads, is that a small group of listeners chips in monthly through buy me a coffee dot com slash fexingo. It's not a big operation, but that support literally covers the research and production time. Lucas: Yeah, it's true. We don't have VC funding or a corporate sponsor. It's just us and the coffee model. If you've been getting value out of these deep dives, that's the mechanism that keeps them coming. No pressure, but it does make a difference. Luna: Alright — back to VBS. So assuming you test and find a driver that doesn't work, what's the actual remediation path? Lucas: You have two options. One: ask the vendor for a hvci compatible signed driver. Two: if the device is truly end of life and irreplaceable, you can disable HVCI through Group Policy — but then you lose the main security benefit of VBS. You still get Credential Guard isolation, but the kernel is no longer protected from unsigned code. Luna: And Microsoft has been clear that disabling HVCI is not recommended. They've actually released a document titled 'Windows 11 Enterprise Security Baseline' that explicitly lists HVCI enforcement as a must-have for any organization aiming for a 'Secured-core' designation. Lucas: So the pragmatic takeaway for an IT leader is: budget for hardware refresh if you have any legacy peripherals. And start testing your custom software against the HVCI Readiness Tool today, because by the time 24H2 hits your fleet automatically, you want to be ready. The security upside is real, but only if you don't break your operations in the process. Luna: And one more thing — if you're a developer writing kernel-mode drivers, now is the time to get them signed through the Microsoft Hardware Developer Center. The old cross-signed certificates are being revoked, and any unsigned driver will simply be blocked. Lucas: Good point. That's a whole other layer. But I think the core message for today is: VBS is coming by default, it costs you 5 to 15 percent CPU, and you need to test now. Next week, we should look at how this affects Azure Virtual Desktop and Windows 365, because the performance math is different in the cloud. Luna: I'd love that. There's a whole conversation about nested virtualization overhead that we barely touched. Lucas: Exactly. For now, go check your fleet's HVCI compatibility. We'll see you in the next one.