Cannot Disable Windows Hypervisor - Stuck on "A Hypervisor has been detected"

You are aware the hypervisor is used by Defender for hardware based security not just HyperV?

If you get totally disable the hypervisor your pc is less secure.

cereberus said:

You are aware the hypervisor is used by Defender for hardware based security not just HyperV?

If you get totally disable the hypervisor your pc is less secure.

Click to expand...

Not sure if this is the case, but hypervisor should be used only when running virtual machines and you have the Core Isolation enabled. This however incurs a performance penalty in older unsupported computers and it is recommended to be disabled anyway. In that case you can disable the hypervisor without any change in security. I know modern VMWare versions can work with Hyper-V enabled, but older versions would warn you to turn it off before installing or running them.

Ehhh... Isn't VBS still a thing to disable if you wanna use nested virtualization? I had to disable it to get that feature even on newer VMWare versions.

spapakons said:

Not sure if this is the case, but hypervisor should be used only when running virtual machines and you have the Core Isolation enabled. This however incurs a performance penalty in older unsupported computers and it is recommended to be disabled anyway. In that case you can disable the hypervisor without any change in security. I know modern VMWare versions can work with Hyper-V enabled, but older versions would warn you to turn it off before installing or running them.

Click to expand...

As I said Defender uses hardware based security which is hypervisor based.

My motherboard doesn't have a TPM module or equivalent software functionality, but I have no problem using Windows Defender. So I am pretty sure Windows Defender can work with Hypervisor disabled. It might not be very fast, but it can work. Also like I said Memory Integrity is protection in virtual machines that share hardware devices with the host. For an old fashioned virtual machine that emulates all devices rather than virtualize real hardware is useless and consumes valuable system resources slowing down your system even when not running virtual machines! It was a known issue for AMD systems back in Windows 11 22H2. It might not affect Intel systems, but I have it disabled anyway. I don't want to take chances. Also avoid assigning more than 50% of your system RAM to a single virtual machine. This will definitely slow down your system. Most virtual machines work fine with as low as 4GB RAM.

spapakons said:

My motherboard doesn't have a TPM module or equivalent software functionality, but I have no problem using Windows Defender. So I am pretty sure Windows Defender can work with Hypervisor disabled. It might not be very fast, but it can work. Also like I said Memory Integrity is protection in virtual machines that share hardware devices with the host. For an old fashioned virtual machine that emulates all devices rather than virtualize real hardware is useless and consumes valuable system resources slowing down your system even when not running virtual machines! It was a known issue for AMD systems back in Windows 11 22H2. It might not affect Intel systems, but I have it disabled anyway. I don't want to take chances. Also avoid assigning more than 50% of your system RAM to a single virtual machine. This will definitely slow down your system. Most virtual machines work fine with as low as 4GB RAM.

Click to expand...

The hypervisor is not only used for vms. It provides an abstract layer harder to hack the HOST OS.

Sure you can run defender without the hypervisor but it removes a layer of protection as you lose the additional protection of the hypervisor layer.

Just google "is defender hardware protection useful" for more information

My system is unsupported anyway, so by definition is more vulnerable to attacks than a Windows 11 compliant system. That's why I keep Windows Defender updated and I watch where I click. I rather close a popup window by clicking on CANCEL or even close the respective tab, than blindly click OK just to get rid of that window. I use common sense as everyone even with a compliant computer should. Yes, Microsoft provides extra protection with certain features (usually at the expense of performance), but unless the user is also careful he will eventually be infected at least once and will need to format and lose his data! I have seen that happen many times since the MS-DOS era. Being careful allows us retro-gaming and retro-computing and even work on old systems running Windows 7 or even Windows XP. My work PC is an old socket 478 Intel Celeron 2.8GHz (older than Pentium 4 3.0GHz Prescott) running Windows 7 32-bit. Running these old systems in a virtual machine is safer but not as safe as being careful what you do online.

Ev5 said:

Update:

...
To finally fix the virtualization loop, I decided to perform a Repair Install of Windows 11 (reinstalling Windows while keeping files and apps).

After the Repair Install finished, I ran the official Microsoft Device Guard and Credential Guard Hardware Readiness Tool (DG_Readiness_Tool_v3.6.ps1 -Disable) one last time.
...
It seems the Repair Install reset whatever system policies or corrupted files were forcing the settings to revert. I will monitor it for a few days, but for now, it is finally fixed.

Click to expand...

I was down the exact same rabbit hole as you, and even though the dg readiness tool initially resolves it, subsequent reboots would just see the hypervisor enabled again, exactly as you experienced. Then I tried that same repair/reinstall option you mentioned and exactly as you said, it's now persistent across reboots. Thanks!