How Windows 11 Uses VBS to Protect System Processes

Windows 11 utilizes Virtualization-Based Security (VBS) to create a hardware-isolated environment that separates sensitive operating system processes from standard memory space. By leveraging hardware virtualization features, VBS ensures that even if malicious software gains full administrative or kernel-level control over the primary operating system, it cannot access or tamper with critical security assets, authentication credentials, or kernel integrity protections.

The Mechanism of Virtualization-Based Security

VBS relies on the Microsoft Hyper-V hypervisor to divide the computer’s physical hardware into distinct security realms. Instead of running the entire operating system in a single, vulnerable execution tier, VBS creates two Virtual Trust Levels (VTL):

• Virtual Trust Level 0 (VTL0) - Normal World: This is where the standard Windows operating system, user applications, device drivers, and the standard kernel operate.
• Virtual Trust Level 1 (VTL1) - Secure World: This is an isolated, secure execution space known as the Secure Kernel. It runs isolated security services that are strictly partitioned away from VTL0.

Under this model, the hypervisor acts as a gatekeeper. Code running in VTL0 cannot directly read, write, or execute code inside VTL1, establishing a robust boundary enforced by the computer’s CPU rather than traditional software-only security.

Hypervisor-Protected Code Integrity (HVCI)

A primary security feature powered by VBS is Hypervisor-Protected Code Integrity (HVCI), also known as Memory Integrity. In a standard operating system, malicious drivers or kernel exploits can modify kernel memory pages to run unsigned or malicious code.

HVCI prevents this by delegating code validation to the isolated VTL1 environment. Before any kernel-mode code or driver can execute in the normal operating system (VTL0), the hypervisor consults the Secure Kernel to verify its cryptographic signature and integrity. Furthermore, HVCI enforces strict memory permissions—ensuring memory pages are never simultaneously writable and executable—effectively blocking zero-day exploits and buffer-overflow attacks targeting the kernel.

Credential Guard and LSA Isolation

Historically, attackers targeted the Local Security Authority Subsystem Service (lsass.exe) to dump plaintext passwords, NTLM password hashes, and Kerberos tickets directly from system memory.

Windows 11 addresses this vulnerability by using VBS to run Credential Guard. With Credential Guard enabled: 1. The sensitive authentication secrets are moved out of the standard lsass.exe process in VTL0. 2. An isolated process called LsaIso.exe (LSA Isolated) is launched inside the protected VTL1 environment. 3. The standard operating system must send Remote Procedure Calls (RPC) to VTL1 to authenticate users, without ever directly handling or storing the raw credential keys in normal RAM.

Because the master credentials exist exclusively within the hypervisor-protected memory of VTL1, memory-scraping tools and malware running with full administrative privileges in VTL0 cannot extract them.

Hardware-Enforced Requirements

The robust isolation of VBS depends on specific CPU and architecture features enforced by Windows 11:

• Hardware Virtualization (Intel VT-x or AMD-V): Creates the underlying hypervisor partitions.
• Second-Level Address Translation (SLAT): Enforces hardware-level memory management so the hypervisor can isolate address spaces without significant performance degradation.
• Direct Memory Access (DMA) Protection: Prevents malicious external peripherals connected via ports such as Thunderbolt or PCIe from bypassing memory protections and reading system RAM directly.
• Trusted Platform Module (TPM 2.0): Provides hardware-based cryptographic operations and binds the secure boot chain to the platform’s state.

By shifting system defense from traditional software detection to hardware-enforced virtualization, Windows 11 ensures that core security services remain impervious to compromises occurring within the main operating system.