Windows Device Guard and Credential Guard and Virtualbox

[kennyhyun]

Latest Windows 10/11 introduced Device Guard and Credential Guard turned on by default and it seems that those are not work well along with Virtualbox.

• 6.1.28 does not start the instance
• 6.1.30 launches the instance but it consumes more CPU power and some task was failing
  • eg. yarn installing in docker image build using build-kit failed

PS C:\WINDOWS\system32> Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard


AvailableSecurityProperties                  : {1, 3, 4, 5...}
CodeIntegrityPolicyEnforcementStatus         : 0
InstanceIdentifier                           : 4ff40742-2649-41b8-bdd1-e80fad1cce80
RequiredSecurityProperties                   : {0}
SecurityServicesConfigured                   : {3, 4}
SecurityServicesRunning                      : {3, 4}
UsermodeCodeIntegrityPolicyEnforcementStatus : 0
Version                                      : 1.0
VirtualizationBasedSecurityStatus            : 2
PSComputerName                               :

VirtualizationBasedSecurityStatus : 2 should be 0 or 1

and

PS C:\WINDOWS\system32> systeminfo
...
Hyper-V Requirements:      A hypervisor has been detected. Features required for Hyper-V will not be displayed

Should be like

Hyper-V Requirements:      VM Monitor Mode Extensions: Yes
                           Virtualization Enabled In Firmware: Yes
                           Second Level Address Translation: Yes
                           Data Execution Prevention Available: Yes

https://docs.microsoft.com/en-us/troubleshoot/windows-client/application-management/virtualization-apps-not-work-with-hyper-v

[kennyhyun]

VirtualizationBasedSecurityStatus : 2 should be 0 or 1

[kennyhyun]

I'll integrate this script into setup.ps1 to disable Defender Credential Guard

DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot

As instructed here

[kennyhyun]

To Disable Device guard for Virtualbox,

1. Download readiness https://www.microsoft.com/en-my/download/details.aspx?id=53337
2. unzip and open powershell in admin mode
3. run command

./DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot

You must run the readiness tool in front of machine with keyboard, and it will reboot the machine.
During the reboot, F3 or Windows key should be pushed 4 times.