Windows 11 25H2: Hypervisor detected and VBS running despite Hyper-V, VBS, Credential Guard disabled

DavidBeaumont 5 Reputation points
2026-06-20T02:21:06.03+00:00

(Edited)

Windows 11 Home 25H2 (Build 26200.8655)

I am trying to completely disable VBS and the Windows hypervisor because VirtualBox is running in Hyper-V mode (green turtle icon) and performance is significantly reduced.

I have already disabled:

  • Hyper-V

VirtualMachinePlatform

Windows Hypervisor Platform

Credential Guard

HVCI (Memory Integrity)

Smart App Control

I also set:

hypervisorlaunchtype Off

EnableVirtualizationBasedSecurity = 0

and tested with Secure Boot both enabled and disabled. There was no change.

Current results:

Win32_DeviceGuard:

VirtualizationBasedSecurityStatus = 2

CodeIntegrityPolicyEnforcementStatus = 2

SecurityServicesConfigured = {0}

SecurityServicesRunning = {0}

Registry:

CredentialGuard = 0

HypervisorEnforcedCodeIntegrity = 0

KernelShadowStacks = 0

However:

HyperVisorPresent = True

msinfo32 reports "Virtualization-based security: Running"

msinfo32 reports "Hypervisor detected"

msinfo32 reports "App Control for Business: Enforced"

In addition:

KeyGuard status shows:

IsSecureKernelRunning = 1

KeyGuardEnabled = 1

CredGuardEnabled = 0

This suggests that the Secure Kernel (VTL1) is still running even though Credential Guard and HVCI are disabled.

CiTool --list-policies shows the following policies currently enforced:

Microsoft Windows Virtualization Based Security Policy

Microsoft Windows Endpoint Security Policy

Microsoft Windows Driver Policy

Questions:

Is this expected behavior in Windows 11 25H2 (Build 26200.8655)?

Can Microsoft platform policies keep the hypervisor and Secure Kernel active even when all traditional VBS and Hyper-V controls are disabled?

Is there any supported method to fully disable the Secure Kernel and hypervisor on this build?

I am primarily trying to determine whether this behavior is by design, a bug/regression in 25H2, or the result of a specific platform security policy.

Windows for business | Windows Client for IT Pros | Storage high availability | Virtualization and Hyper-V

2 answers

Sort by: Newest
Most helpful Newest Oldest
  1. davekp 0 Reputation points
    2026-09-05T12:04:36.0366667+00:00

    I the same issue on Windows 11 25H2. Hyper-V, VMP/WHP and Memory Integrity were off, and hypervisorlaunchtype was set to off, but systeminfo still showed VBS running and a hypervisor detected.

    Fix was to use Microsoft’s Device Guard/Credential Guard Readiness Tool https://www.microsoft.com/en-us/download/details.aspx?id=53337

    .\DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot

    On reboot confirm prompts and chose to disable both.

    That shouuld clear it

    Was this answer helpful?

    0 comments
  2. Chen Tran 12,770 Reputation points Independent Advisor
    2026-06-20T03:11:22.4666667+00:00

    Hello David,

    Thank you for posting question on Microsoft Windows Forum!

    Based on the issue description. Well! The plausible explanation to your query is that those active WDAC / Code Integrity policies (.cip and .p7b files) are exactly what is keeping the hypervisor active, even with Secure Boot disabled and standard OS flags turned off. In Windows 11 (especially on newer builds like 25H2 / 26200), Microsoft has heavily decoupled Virtualization-Based Security (VBS) and Hyper-V from simple registry switches or Optional Features when strict code integrity enforcement is mandated at the boot level.

    To further analyzing the provided logs. When Windows detects an active, enforced Windows Defender Application Control (WDAC) or Smart App Control policy during the boot phase, the bootloader overrides your hypervisorlaunchtype Off and manual registry flags. Even if Virtualization-Based Security shows no running security services (SecurityServicesRunning = {0}), the hypervisor must spin up to enforce Hypervisor-Protected Code Integrity (HVCI) or strict kernel-mode WDAC policies.

    Regarding the CodeIntegrityPolicyEnforcementStatus = 2 Status. The value 2 indicates that Code Integrity enforcement is strictly Enabled. Windows requires the secure kernel (and thus the underlying hypervisor) to validate drivers and system binaries against those active .cip and winsipolicy.p7b files you found. On the other hand, the files in S:\EFI\Microsoft\Boot\CIPolicies\Active\ are parsed by the Windows Boot Manager (bootmgfw.efi) before the main OS kernel even loads. It sees an active policy, realizes it needs the hypervisor to securely enforce it, and forces the hypervisor to initialize.

    On Windows 11 Home 25H2, unfortunately, there is no supported way to fully disable them. The only workarounds like switching to Pro/Enterprise or using virtualization software that tolerates Hyper‑V better.

    The following are articles for your further reference regarding the symptom.

    Hope the above information is helpful! If it is. Free feel to hit "Accept Answer" for benefitting others in community having the same query too.

    Was this answer helpful?

    2 people found this answer helpful.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.