--- SUMMARY / CURRENT STATUS UPDATE ---
I am trying to completely disable the Windows Hypervisor and VBS to run
VMware Workstation in Native Mode.
Edit: I Managed to
disable VBS but
Hyper-V no
No matter what I do,
msinfo32 persistently shows:
A hypervisor has been detected. Features required for Hyper-V will not be displayed.
---
My Hardware
*
CPU: i7-12700K
*
Motherboard: MSI MPG Z690 EDGE WIFI
*
OS: Windows 11 (Build 26200)
*
BIOS: 7D31v1M (Latest)
---
The Critical Context
I updated to BIOS version
7D31v1M hoping it would solve this issue, as I was already unable to disable the Hypervisor on the previous version. Unfortunately, the update did not help.
The changelog for this new version specifically notes:
“Security enhancement: Enable Pre-boot DMA Protection, VT-d, and IOMMU Pre-boot defaults. (CVE-2025-14303)”
To make matters worse, immediately after this update my boot configuration corrupted (
0x00000f). I had to repair the boot using
bcdboot, which completely reset my BCD.
I have since re-applied all disable commands, but I still cannot shake the Hypervisor.
---
What I Have Tried (and Failed)
I followed this guide from the Broadcom / VMware community
to the letter:
[https://community.broadcom.com/vmw...ion/how-to-disable-hyper-v-in-windows-11-24h2(
- VMware Cloud Foundation
---
BIOS Settings
Since the update forced DMA protection, I went back into BIOS and explicitly
DISABLED:
* VT-d
* Kernel DMA Protection
* Secure Boot (keys deleted / Custom Mode)
*
VT-x is Enabled (required for VMware)
---
BCD Configuration
Re-ran the disable commands after the boot repair:
Code:
bcdedit /set hypervisorlaunchtype off
bcdedit /set vsmlaunchtype off
---
Registry & Group Policy
In Group Policy,
Turn on Virtualization Based Security is set to
Disabled.
---
Registry Dump
Code:
[HKLM\SYSTEM\CurrentControlSet\Control\Lsa]:
auditbasedirectories REG_DWORD 0x0
auditbaseobjects REG_DWORD 0x0
crashonauditfail REG_DWORD 0x0
LimitBlankPasswordUse REG_DWORD 0x1
NoLmHash REG_DWORD 0x1
IsPplAutoEnabled REG_DWORD 0x1
RunAsPPL REG_DWORD 0x2
RunAsPPLBoot REG_DWORD 0x2
LsaPid REG_DWORD 0x580
LsaCfgFlagsDefault REG_DWORD 0x0
SecureBoot REG_DWORD 0x1
ProductType REG_DWORD 0x6
disabledomaincreds REG_DWORD 0x0
everyoneincludesanonymous REG_DWORD 0x0
forceguest REG_DWORD 0x0
restrictanonymous REG_DWORD 0x0
restrictanonymoussam REG_DWORD 0x1
SamConnectedAccountsExist REG_DWORD 0x1
LsaCfgFlags REG_DWORD 0x0
Code:
[HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard]:
EnableVirtualizationBasedSecurity REG_DWORD 0x0
HVCIMATRequired REG_DWORD 0x0
LsaCfgFlags REG_DWORD 0x0
HypervisorEnforcedCodeIntegrity REG_DWORD 0x0
RequirePlatformSecurityFeatures REG_DWORD 0x0
ConfigureSystemGuardLaunch REG_DWORD 0x0
Code:
[HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard]:
CachedDrtmAuthIndex REG_DWORD 0x0
WasEnabledBy REG_DWORD 0x1
HyperVVirtualizationBasedSecurityOptout REG_DWORD 0x1
EnableVirtualizationBasedSecurity REG_DWORD 0x0
Locked REG_DWORD 0x0
Unlocked REG_DWORD 0x1
LsaCfgFlags REG_DWORD 0x0
RequirePlatformSecurityFeatures REG_DWORD 0x0
Code:
[HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities]:
HyperVEnabled REG_DWORD 0x0
SMMProtections REG_DWORD 0x0
SecureMOR REG_DWORD 0x0
Code:
[HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard]:
Enabled REG_DWORD 0x0
Code:
[HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity]:
Enabled REG_DWORD 0x0
HVCIMATRequired REG_DWORD 0x0
Locked REG_DWORD 0x0
Code:
[HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks]:
AuditModeEnabled REG_DWORD 0x0
Enabled REG_DWORD 0x0
WasEnabledBy REG_DWORD 0x4
---
Current Status
Despite BCD showing
hypervisorlaunchtype Off and VT-d being disabled in BIOS, the OS
ignores these settings on cold boot.
Code:
Windows Boot Loader
-------------------
identifier {current}
device partition=C:
path \Windows\system32\winload.efi
description Windows 11
locale en-us
inherit {bootloadersettings}
isolatedcontext Yes
allowedinmemorysettings 0x15000075
osdevice partition=C:
systemroot \Windows
resumeobject {d43ddc3a-f7eb-11f0-a68a-ef66b23841a7}
nx OptIn
bootmenupolicy Standard
hypervisorlaunchtype Off
vsmlaunchtype Off
---
Driver Check
Code:
Filter Name Num Instances Altitude Frame
---
bindflt 1 409800 0
UCPD 11 385250.5 0
WdFilter 11 328010 0
storqosflt 0 244000 0
wcifs 0 189900 0
CldFlt 4 180451 0
bfs 13 150000 0
FileCrypt 0 141100 0
luafv 1 135000 0
UnionFS 0 130850 0
npsvctrig 1 46000 0
Wof 9 40700 0
FileInfo 11 40500 0
---
Additional Verification
*
Core Isolation / Memory Integrity: OFF
To prove the Hypervisor is hijacking the CPU, I tested with
SecurAble:
* When I briefly managed to disable it (using the Device Guard tool before the reboot reverted everything), SecurAble showed:
Hardware Virtualization: Yes
* Now that
msinfo32 shows *“A hypervisor has been detected”*, SecurAble shows:
Hardware Virtualization: No
---
How to force-disable Hyper-V?
---
