Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / Windows 11 Is Quietly Mandating Enterprise VBS and Credential Guard
Transcript
- Lucas: So Microsoft has been talking about Virtualization-Based Security for years. But with the 2025 Windows 11 feature update — which is rolling out to businesses right now, as of this June — VBS and Credential Guard are no longer optional for new deployments. Luna: Wait — they're actually mandatory? I thought VBS was just a recommended setting in the security baseline. Lucas: It was. But starting with this update, if you're doing a clean install of Windows 11 Enterprise — not an upgrade from an older version — the setup process will enable VBS and Credential Guard by default. You can technically turn them off via Group Policy, but Microsoft is making it harder. They've removed the old 'turn off VBS' toggle from some provisioning tools. Luna: That's a pretty big shift. I mean, VBS essentially runs critical security processes inside a virtualized container, isolated from the main operating system. So if the kernel gets compromised, the attacker can't just grab your credentials. Lucas: Exactly. Credential Guard stores domain passwords and other secrets inside that VBS enclave. Even with full admin access, malware can't extract those hashes. It's a core part of Microsoft's zero-trust architecture for the endpoint. Luna: But there's a catch, right? The performance hit. I've read that enabling VBS can cost anywhere from 5 to 15 percent CPU overhead, depending on the workload. Lucas: Yeah, and that's the tension. Microsoft says the average is around 5 to 7 percent on modern hardware with hardware virtualization features. But if you're running on older machines — say, a six-year-old Dell OptiPlex with a seventh-gen Core i5 — you could see closer to 10 or 15 percent. And it's not just CPU. VBS also demands more memory because it reserves a chunk of RAM for the hypervisor. Luna: So for IT admins who've been procrastinating on hardware refreshes, this update might force their hand. Lucas: Absolutely. And the bigger headache is driver compatibility. VBS requires all kernel-mode drivers to be compatible with Hyper-V — essentially, the driver must be 'enlightened' to work inside a virtualized environment. Some legacy printer drivers, scanner drivers, even input-device utilities from companies like Wacom or Logitech may simply crash or fail to load. Luna: We've seen this before. Remember when Microsoft mandated secure boot and it broke a bunch of older Linux dual-boot setups? Same pattern — improved security, but real-world pain for IT teams. Lucas: Right. And the fix isn't always trivial. For some drivers, the vendor needs to release an updated signed version. For others, you might have to exempt that specific device from Device Guard — which opens a security hole. The recommended approach is to test in a pilot group first, using Microsoft's VBS readiness assessment tools. Luna: What about the hardware requirements? I know Windows 11 already mandates TPM 2.0 and Secure Boot. Does VBS add anything new? Lucas: It doesn't add new hardware requirements per se, but it does place a higher premium on CPU virtualization features. Specifically, Intel's vt x and AMD's SVM need to be enabled in the BIOS. And to get the best performance, you want Intel vPro or AMD Ryzen Pro — those chips have additional hardware security features that offload some of the VBS overhead. Luna: So if you're still running, say, a mix of eighth-gen and tenth-gen Intel chips without vPro, you might see a noticeable slowdown. That could be a big deal for schools or non-profits that stretch hardware lifecycles to five or six years. Lucas: Yep. And there's one more wrinkle: Microsoft is also deprecating the old 'Device Guard' configuration that let admins selectively enable VBS for only certain processes. The new baseline essentially forces it system-wide. So you can't just turn it on for LSASS and leave everything else as-is. Luna: But from a security standpoint, that's actually better. Partial VBS leaves gaps. If you're going to do this, doing it uniformly makes sense. Lucas: I agree — in principle. But the rollout timing concerns me. Enterprise IT teams are still dealing with the fallout from the NTLM deprecation and the Group Policy preferences phase-out. Adding a mandatory VBS requirement in the same update cycle feels like a lot at once. Luna: What about Microsoft's own tools? Are they giving admins enough visibility into which drivers will break? Lucas: There's the Windows Security Center, which has a 'Core Isolation' page that shows device compatibility status. And Microsoft has a PowerShell cmdlet — Get-DeviceGuardRequiredState — that checks if your existing drivers are vbs compatible. But the feedback I'm hearing from IT pros is that those tools only catch about 80 percent of issues. You still need to do real-world testing. Luna: So if I'm an IT admin listening, what's the one thing I should do this week? Lucas: Take one representative machine — preferably one that runs your most critical line of business app — and do a clean install of the latest Windows 11 2025 update with VBS enabled by default. Then run your full application and peripheral test suite. See what breaks. That will give you a realistic timeline for remediation. Luna: And if something does break, what's your first move? Lucas: Check if the vendor has an updated driver. If not, you can temporarily disable VBS via Group Policy — but only as a stopgap. Microsoft has said they'll remove that override in a future release, likely 2026. So the real solution is to push vendors for compatibility, or replace the hardware. Luna: It's interesting — this is such a concrete example of the zero-trust principle applied at the OS level. But it also highlights how much of enterprise IT is still held together by drivers and peripherals from a decade ago. Lucas: Yeah, and that's the thing. Security improvements always have a cost. The question is whether the security gain justifies the operational friction. In this case, I think it does — especially for organizations that have been hit by credential theft attacks. But the timing is tough. Luna: Speaking of timing — if folks are finding this conversation useful, we should mention that keeping these episodes coming relies on listeners chipping in a bit. A couple of dollars a month genuinely helps cover hosting, research, and the occasional coffee that fuels these deep dives. Lucas: Yeah, it's a small thing, but it makes a real difference. If you've gotten something out of the show, buy me a coffee dot com slash fexingo — that's buy me a coffee dot com slash fexingo — is a great way to support the ad-free, deep-dive content. Luna: Exactly. No pressure, but it does keep us going. Back to VBS — one more thing I wanted to ask: what about the interaction with Windows Defender Application Guard? Does VBS enable that automatically? Lucas: Not automatically, but VBS is a prerequisite for WDAG. If you want to run untrusted websites or documents in an isolated Hyper-V container, you need VBS enabled. So this move also nudges organizations toward WDAG adoption — which is another security layer, but also another performance consideration. Luna: So it's part of a broader stack. Microsoft is essentially building a secure foundation that starts with TPM 2.0, adds Secure Boot, then VBS, then Credential Guard, then WDAG, and finally things like Microsoft Defender for Endpoint. Each layer depends on the one below. Lucas: Exactly. And the message is clear: if you want to stay on the supported path, you need to buy into the full stack. That's good for security, but it also means less flexibility for IT teams who want to mix and match. Luna: I think that's the story here. Microsoft is tightening the screws — not just on security, but on configuration diversity. The era of the highly customized Windows image is ending. Lucas: For better or worse, yes. For organizations that have already standardized on modern hardware and cloud-based management, this is painless. For those still running custom images on older machines, this update is a forcing function. Luna: So what's your prediction? Will most enterprises hit the deadline without major issues, or will we see a wave of exceptions and delays? Lucas: I think the first wave — the early adopters who deploy the 2025 update in the next three months — will have the most problems. They're the guinea pigs. By early 2027, most major driver vendors will have updated, and the pain will be a memory. But right now, there's going to be a lot of frantic testing. Luna: And for the listeners who are in the middle of that testing — good luck, and maybe start with that pilot machine this week rather than waiting for the mandatory deadline. Lucas: Absolutely. That's the takeaway. Don't wait until Microsoft enforces it in a future update. Get ahead of it now.