Enabling Windows Virtualization-Based Security

[uncanonical]

Hello,

I have multiple Windows 11 24H2 guests with virtio-win-0.1.266 drivers installed, and QEMU agents.

Virtualization of all sorts is enabled in server BIOS, and CPU is set to host for these virtual machines, as to ensure that they can nest virtual machines inside due to business requirements.

Still, I cannot enable Credential Guard, - virtualization-based security seems unable to enable, confirmed by msinfo, where it states that VBS is "Enabled but not running", despite being forced by group policies from a Windows Active Directory.

This seems related to Proxmox configuration, seeing as identical virtual machines function without issue in our VMware environment. This seems a critical problem in securing virtual machines on Proxmox if not currently possible.

Please advise on if there is a solution to this problem, or if this is expected behavior.

 

[wbedard]

See if the thread linked below doesn't help you make some progress. If you need additional help, feel free to follow-up either here or in the linked thread (preferred):

D

Thread 'Virtualization based security in Windows guests'

May 10, 2024

Good morning,
I'm trying to get VBS working in Windows guests. This feature is working on VMware vSphere hosts, but I'm running into some issues with Proxmox. I'm able to enable it in Windows guest if I configure it with vIOMMU option set to VirtIO. However that leads to really high CPU usage, and unrecognized PCI device showing up in device manager, with no drivers available for it. Hardware id PCI\VEN_1AF4&DEV_1057&SUBSYS_11001AF4&REV_01. Vendor id comes up as Red Hat, but device id is a mystery.

If vIOMMU is set to intel, mysterious device disappears, CPU usage goes back to normal, but...

• dorseymet
• Replies: 12
• Forum: Proxmox VE: Installation and configuration