Windows VBS Registry Key Configuration Guide

Virtualization-Based Security (VBS) in Windows is managed primarily through the DeviceGuard registry key to isolate secure memory regions for critical operating system operations. This guide explains the exact registry path and DWORD values used in the Registry Editor (regedit) to enable, configure, and manage VBS and its associated hardware security requirements.

The Primary VBS Registry Key Path

The central registry location controlling Windows Virtualization-Based Security configuration is:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard

Key DWORD Values for VBS

Inside the DeviceGuard key, several DWORD (32-bit) values dictate how VBS behaves:

1. EnableVirtualizationBasedSecurity
   • 0: Disables Virtualization-Based Security.
   • 1: Enables Virtualization-Based Security.
2. RequirePlatformSecurityFeatures
   • Determines the mandatory hardware security features required to start VBS:
   • 1: Requires Secure Boot only.
   • 3: Requires both Secure Boot and Direct Memory Access (DMA) protection.
3. Locked
   • 0: VBS settings can be modified remotely or via registry.
   • 1: Enables UEFI Lock (requires physical access to UEFI firmware to disable VBS once turned on).

Configuring Memory Integrity (HVCI) via Registry

Hypervisor-Protected Code Integrity (HVCI), a core feature that runs under VBS, is controlled in a related subkey:

• Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity
• Value Name: Enabled
• Value Data: Set to 1 to enable Memory Integrity, or 0 to disable it.

How to Apply the Settings

1. Press Win + R, type regedit, and press Enter to open the Registry Editor.
2. Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard
3. If values such as EnableVirtualizationBasedSecurity or RequirePlatformSecurityFeatures do not exist, right-click an empty area in the right pane, select New > DWORD (32-bit) Value, and name them accordingly.
4. Double-click each value and assign your desired configuration (e.g., set EnableVirtualizationBasedSecurity to 1 to turn on VBS).
5. Restart the computer for the changes to take effect.

Verifying VBS Status

After restarting, open the Run dialog (Win + R), type msinfo32, and press Enter. In the System Summary list, locate Virtualization-based security to confirm whether the status shows as “Running.”