Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / Windows 11 Is Quietly Mandating Enterprise Virtualization-Based Security for All
Transcript
- Lucas: Microsoft is making Virtualization-Based Security mandatory for all Windows 11 Enterprise devices with the 2026 feature update. Not optional. Not a recommendation. If you're running Enterprise, VBS will be on by default and IT admins won't be able to turn it off via the old registry hacks. Luna: Wait—VBS as in the thing that carves out a chunk of RAM for a hypervisor to isolate critical processes? That VBS? Lucas: Exactly. Virtualization-Based Security. It uses the CPU's virtualization extensions—Intel vt x or amd v—to create a secure region of memory separate from the normal operating system. Inside that region, Windows runs something called a secure kernel, and it can host security features like Credential Guard and Device Guard. Luna: So it's not a single feature—it's the foundation that other security features rely on. Lucas: Right. And until now, Microsoft recommended it. They'd say VBS is 'strongly recommended' for enterprise deployments. But many IT teams turned it off because of the performance hit—roughly 5 to 10 percent CPU overhead, sometimes more on older hardware. With the 2026 update, that choice goes away. Luna: Is there a hardware requirement? I remember that VBS needs a CPU with second-level address translation—SLAT—and it wants TPM 2.0. Lucas: You've got it. The hardware requirements are: a 64-bit CPU with SLAT, TPM 2.0, Secure Boot enabled, and at least 8GB of RAM. Most machines from the last five years meet those specs. The issue is the performance drag, especially on devices with only 8GB of RAM. That overhead can push a system into swapping, which makes the user experience noticeably sluggish. Luna: So for organizations with a fleet of older but still functional 8GB laptops, this could be a real pain point. Lucas: It is. And Microsoft knows it. They've been gradually tightening the screws. In Windows 11 version 22H2, they started requiring VBS for new security baseline profiles. In 23H2, they added a check that would disable VBS if performance counters showed too much impact. But the 2026 update removes the escape hatch entirely. Luna: What about the registry key? There's always been a registry key to force it off. Lucas: Gone. The 'EnableVirtualizationBasedSecurity' registry value will be ignored on Enterprise editions. Microsoft's argument is that the security gains outweigh the performance costs. And they have data to back that up. According to Microsoft's own telemetry, systems with VBS enabled see about a 60 percent reduction in successful credential theft attacks. Luna: Sixty percent is significant. But I've also seen reports that VBS can increase boot times by up to 30 seconds. Is that still the case? Lucas: It was true in the early days. With Windows 11 and modern CPUs, Microsoft has optimized the boot process. The latest figures show about a 5 to 10 second increase on average. Still noticeable, but not the minute-long waits we saw three years ago. The bigger issue is runtime performance—especially for virtual machines and developer tools that rely on nested virtualization. Luna: Right, if you're running Hyper-V or Docker, VBS can conflict with those scenarios. Lucas: Exactly. VBS takes over the hypervisor role, so running other hypervisors on top becomes more complex. Microsoft has improved compatibility—Windows Sandbox and Windows Defender Application Guard both work with VBS now—but third-party virtualization tools can still have issues. IT admins will need to test thoroughly before rolling out the 2026 update. Luna: Is there any way to mitigate the performance impact? Or are we just accepting the 5 to 10 percent hit? Lucas: There are a few levers. First, make sure you're on a CPU that supports the latest virtualization features—Intel's Mode-Based Execution Control, or MBEC, and AMD's Guest Mode Execute Trap, or GMET. Older CPUs without those features see a bigger performance hit because the hypervisor has to do more software emulation. Second, ensure the system has enough RAM—16GB is a good target. The overhead is less painful when you have headroom. Third, consider using SSD storage, because VBS makes heavy use of memory paging and fast storage helps. Luna: So really, this is another push from Microsoft to get enterprise fleets onto newer hardware. It's like the TPM 2.0 mandate all over again. Lucas: It is. And it fits the broader trend. Microsoft is using Windows 11 as a platform to enforce a zero-trust security model. VBS is a key piece because it enables features like Hypervisor-Protected Code Integrity, which locks down kernel drivers. Without VBS, those protections can't run. So this isn't just about VBS—it's about the whole stack of security features that depend on it. Luna: If today's tech conversation gave you something usable, consider supporting the show. A couple of dollars a month is genuinely what keeps these going—buy me a coffee dot com slash fexingo, if you've gotten something out of them. Lucas: Yeah, it really makes a difference. No pressure, just if you find value here. Back to VBS—the other angle here is that Microsoft is also making Memory Integrity, which is a component of VBS, mandatory on new devices starting with the 2026 update. Memory Integrity checks every driver before it runs, blocking unsigned or vulnerable drivers. Luna: That's going to break a lot of legacy drivers. I can already hear the IT help desk calls. Lucas: Oh, absolutely. Any driver that doesn't meet the Windows Hardware Compatibility Program requirements will be blocked. That includes older printers, scanners, and niche hardware that vendors stopped supporting years ago. IT teams need to audit their driver inventory now, because once the update hits, those devices will simply stop working. Luna: Is there a compatibility mode or a way to whitelist specific drivers? Lucas: Microsoft is providing a mechanism through the Windows Defender Application Control policy. You can create a supplemental policy that allows specific, signed drivers that aren't yet compliant. But it's not as simple as flipping a switch. You have to generate a policy, test it, and deploy it via Group Policy or Intune. And Microsoft has said that even those supplemental policies will be deprecated in a future release. Luna: So it's a gradual squeeze. First VBS becomes mandatory, then Memory Integrity, then eventually even the exceptions go away. Lucas: That's the trajectory. And it's consistent with what we've seen in prior episodes—Microsoft is systematically removing the ability to opt out of security baselines. Group Policy preferences, NTLM authentication, SMB1—each of those was optional at first, then deprecated, then removed. VBS is just the latest. And it's a bigger deal because it impacts performance directly. Luna: One thing I'm curious about: does VBS affect cloud-based virtual desktops like Azure Virtual Desktop or Windows 365? Lucas: Great question. In those environments, the hypervisor is already managed by the cloud provider. Microsoft has said that VBS is not required on Azure Virtual Desktop session hosts because the underlying infrastructure provides equivalent isolation. But for Windows 365 Cloud PCs, which run on the user's endpoint, VBS will be enforced just like on a physical device. Luna: So if you're running Cloud PCs on underpowered hardware, you'll still feel the hit. Lucas: Exactly. And that's where the hardware refresh cycle comes in. If your organization is still deploying 8GB machines, the 2026 update might be the forcing function to move to 16GB. A lot of IT departments I've talked to are already planning that upgrade. Luna: Let's talk about the timeline. When exactly does the 2026 feature update hit? Lucas: Microsoft typically releases the feature update in the fall—September or October. But they've already started preview builds for Windows Insiders in the Enterprise channel. So IT admins can test now. The actual enforcement of mandatory VBS will come with the final release. And there's a grace period: devices upgraded from an older version won't immediately have VBS forced on. They'll get a notification that it's recommended, but the next clean install will enable it by default. Luna: So there's time to prepare, but not forever. What's your advice for IT teams listening? Lucas: Three things. First, audit your hardware: check if every device supports SLAT, TPM 2.0, and has at least 8GB of RAM. Budget for upgrades on anything that falls short. Second, start performance testing with VBS enabled on a representative sample of your fleet. Measure boot time, application launch time, and any virtual machine workloads. Third, work with your software vendors to ensure all drivers and applications are vbs compatible. The Windows Hardware Compatibility Program is the benchmark. Luna: And if a critical application breaks? Lucas: You'll need to engage the vendor early. Microsoft has provided documentation for developers on how to make their software vbs aware. But if a vendor is unresponsive, you may need to consider alternative solutions. This is one of those situations where the security mandate forces a modernization of the entire stack. Luna: It feels like the end of an era for IT admins who liked having full control over every setting. Lucas: It does. Microsoft is moving to a model where the operating system enforces security boundaries regardless of admin preference. That's a philosophical shift. For organizations that already embrace zero-trust and modern management, it's an easy transition. For others, it's going to be a painful but necessary push. Luna: And we'll see how it plays out. Thanks, Lucas. Lucas: Thanks, Luna. We'll keep tracking this as the release gets closer.