How to Detect a Hypervisor Using Windows Registry

Detecting whether a Windows operating system is running inside a virtual machine rather than on bare-metal hardware can be done by examining specific keys and strings stored in the Windows Registry. This guide outlines the exact registry paths and identifiers associated with common hypervisors—such as VMware, VirtualBox, Hyper-V, KVM, and Xen—allowing you to quickly verify the virtualization status of a machine using regedit.

1. BIOS and System Hardware Information

The most direct way to check for a hypervisor is to inspect the system BIOS description strings that hardware and virtualization platforms register during boot.

• Path: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS

Check the following string values: * SystemManufacturer * SystemProductName * BaseBoardManufacturer * BaseBoardProduct * BIOSVendor

Hypervisor Indicators

• VMware: Strings will contain VMware, VMware, Inc., or VMware Virtual Platform.
• VirtualBox: Strings will contain innotek GmbH, VirtualBox, or Oracle Corporation.
• Hyper-V: Strings will show Microsoft Corporation under manufacturer and Virtual Machine under product name.
• KVM / QEMU: Strings will contain QEMU, Red Hat, or KVM.
• Xen: Strings will contain Xen.

2. Disk and Storage Device Enumeration

Hypervisors typically attach virtual storage drives that identify themselves using virtual vendor IDs.

• Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\IDE
• Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\SCSI

Expand the subkeys under these locations and look at the device names:

• VirtualBox: Look for entries containing DiskVBOX_HARDDISK or VBOX_CD-ROM.
• VMware: Look for entries containing DiskVMware_Virtual_S or VMware_Virtual_IDE_Hard_Drive.
• QEMU / KVM: Look for entries containing QEMU_HARDDISK or VirtIO.
• Hyper-V: Look for Msft_Virtual_Disk or VMBUS identifiers.

3. Installed Virtual Machine Integration Services

Virtualization platforms install guest tools and integration drivers to provide clipboard sharing, time synchronization, and optimized display drivers.

• Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Look for specific driver/service subkeys:

• VMware: VMTools, vmvss, vmhgfs, vmmouse, vm3dmp
• VirtualBox: VBoxGuest, VBoxMouse, VBoxService, VBoxSF
• Hyper-V: vmbus, vmguest, vmicshutdown, vmicheartbeat, vmicvss
• Xen: XenNet, XenVBD, XenSys

4. ACPI and Motherboard Tables

Hypervisors generate ACPI (Advanced Configuration and Power Interface) tables with hypervisor-specific vendor strings.

• Path: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT
• Path: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\FADT

Inspect the folder and key names inside these locations: * VMware: Keys typically begin with or contain VMW___ or VMWARE. * VirtualBox: Keys contain VBOX__. * QEMU / KVM: Keys contain BOCHS_ or BXPC.