When VirtualBox won’t let you start 64bit VMs: Windows Defender Device Guard

Virtualbox refusing 64bit VMs is something that happens to a lot of people it would seem. A quick search reveals hundreds, thousands, even millions of cries for help on this one…

Usually, two culprits are quickly offered and quite often, they are indeed the offending party:

1. Disable HyperV
   • Enabling HyperV will make HyperV “grab” the virtualization hardware and it won’t play nice and share it with anyone else. To be frank, this is not a HyperV only issue, most (if not all) virtualization tools will do this: choose one solution for all your VM needs.
2. Enable hardware virtualization in BIOS/UEFI
   • Yup, usually this is enabled, but sometimes this gets disabled and effectively blocks access to hardware virtualization.

But I am not going to talk about these two because many, many other have done so already. This blog will tell you about a third bandit that might be stealing away your access to hardware virtualization.

But before we do that, let’s explain that last sentence: when you cannot start 64bit VMs, it means that your CPU either does not support 64bit applications (which is possible, but exceedingly rare these days), or that you do not have access to the virtualization hardware in your CPU. In this case, your computer will allow you to run 32bit virtual machines using software only virtualization. But since this is a software approach, it will be quite slow and mostly unusable because of that.

Device Guard

Windows Defender in Windows 10 has something called “Device Guard”, this is an enterprise-level feature that probably only is present in the “Pro” version of windows 10 but I have not tested this hypothesis.

Device Guard will lock down access to hardware devices to run only “trusted” applications. More information can be found here: https://docs.microsoft.com/en-us/windows/device-security/device-guard/device-guard-deployment-guide

I found a knowledge base article on the VMWare site that explained how VMWare workstation is “incompatible” with Device Guard here: https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2146361

In the VMWare KB article, it details how Device Guard refuses access to the virtualization hardware (sometimes causing BSOD). This sounds like something that could definitely get in the way of VirtualBox too, right?

So I followed the steps to disable Device Guard and yes, it did immediately solve my problem. My VirtualBox is humming along nicely now. 🙂

Since things can and do dissapear from the Internet, I’ve copied the KB content below:

To disable Device Guard or Credential Guard:

1. Disable the group policy setting that was used to enable Credential Guard.
   1. On the host operating system, click Start > Run, type gpedit.msc, and click Ok. The Local group Policy Editor opens.
   2. Go to Local Computer Policy > Computer Configuration > Administrative Templates > System > Device Guard > Turn on Virtualization Based Security.
   3. Select Disabled.
2. Go to Control Panel > Uninstall a Program > Turn Windows features on or off to turn off Hyper-V.
3. Select Do not restart.
4. Delete the related EFI variables by launching a command prompt on the host machine using an Administrator account and run these commands:mountvol X: /s
   copy %WINDIR%\System32\SecConfig.efi X:\EFI\Microsoft\Boot\SecConfig.efi /Y
   bcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d “DebugTool” /application osloader
   bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} path “\EFI\Microsoft\Boot\SecConfig.efi”
   bcdedit /set {bootmgr} bootsequence {0cb3b571-2f2e-4343-a879-d86a476d7215}
   bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS
   bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X:
   mountvol X: /d
   
   Note: Ensure X is an unused drive, else change to another drive.
5. Restart the host.
6. Accept the prompt on the boot screen to disable Device Guard or Credential Guard.

Conclusion

Now, to be sure, this is not the ideal situation. Device Guard sounds like a good” thing and simply disabling it is a bit heavy handed. I would assume that both VMWare and Oracle should be able to make their products work with Device Guard, but today this is not the case.