A script for disabling VBS, Hyper-V and HVCI on your own testing host, not a target machine.
Windows features like Virtualization-Based Security (VBS), Credential Guard and Memory Integrity (HVCI) can conflict with nested virtualization, GPU passthrough or third-party hypervisors on a testing VM host — the machine you run your own lab VMs on, not a client system.
This script disables all of them so a testing host behaves predictably. Run it as administrator on your own machine and reboot afterwards.
# Disable hypervisor launchbcdedit /set hypervisorlaunchtype off
# Remove Hyper-V and related virtualization features$features = @( "Microsoft-Hyper-V-All", "HypervisorPlatform", "IsolatedUserMode", "VirtualMachinePlatform", "WindowsHypervisorPlatform", "Containers-DisposableClientVM", "Windows-Defender-ApplicationGuard", "Windows-Sandbox")foreach ($f in $features) { DISM /Online /Disable-Feature /FeatureName:$f /NoRestart}
# Disable Device Guard and Credential Guardreg add "HKLM\System\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /freg add "HKLM\System\CurrentControlSet\Control\Lsa" /v LsaCfgFlags /t REG_DWORD /d 0 /freg delete "HKLM\System\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /f
# Disable VBS via policyreg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /freg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
# Disable HVCI / Memory Integrityreg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 0 /freg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy" /v Enabled /t REG_DWORD /d 0 /f
# Disable mode-based execution controlreg add "HKLM\System\CurrentControlSet\Control\Lsa" /v ConfiguredRemoteAttestationLevel /t REG_DWORD /d 0 /fA reboot is required for all of these changes to take effect.
