VirtualBox Compatibility with Device Guard/Credential Guard

Discussions related to using VirtualBox on Windows hosts.
Locked
Dan M
Posts: 1
Joined: 7. Apr 2016, 18:06

VirtualBox Compatibility with Device Guard/Credential Guard

Post by Dan M »

One of the new security features in Windows 10 is Credential Guard. It essentially virtualizes the LSA to isolate security operations (opposed to credentials being stored in process memory like in traditional LSA). To make use of this, you must enable the Hyper-V Hypervisor, which always conflicts with VirtualBox. Does anyone know if it is possible to enable this feature while still using VirtualBox?
BillG
Volunteer
Posts: 5104
Joined: 19. Sep 2009, 04:44
Primary OS: MS Windows 10
VBox Version: PUEL
Guest OSses: Windows 10,7 and earlier
Location: Sydney, Australia

Re: VirtualBox Compatibility with Device Guard/Credential Guard

Post by BillG »

No, it won't be possible. The hypervisor loads before the OS and assigns hardware virtualization to the hypervisor, not the host OS. VirtualBox cannot use hardware virtualization if the Hyper-V hypervisor is active.
Bill
JellisO
Posts: 1
Joined: 19. Jan 2017, 04:20

Re: VirtualBox Compatibility with Device Guard/Credential Guard

Post by JellisO »

You could try this:

On the host operating system, click Start > Run, type gpedit.msc, and click Ok. The Local group Policy Editor opens.
Go to Local Computer Policy > Computer Configuration > Administrative Templates > System > Device Guard > Turn on Virtualization Based Security.
Select Disabled.

Had me fix 2 problems:

Crashing Windows 10 when starting a Guest VM in VirtualBox
Still being able to use Hyper-V
socratis
Site Moderator
Posts: 27329
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: VirtualBox Compatibility with Device Guard/Credential Guard

Post by socratis »

JellisO wrote:Still being able to use Hyper-V
How exactly were you able to use Hyper-V and VirtualBox? Could you explain that? I can see the Virtualization Based Security option, but I can't see how Hyper-V would be enabled and VirtualBox running. Maybe you meant:
JellisO wrote:Still being able to use Hyper-V VirtualBox
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
pingnu
Posts: 1
Joined: 19. Jan 2017, 13:47

Re: VirtualBox Compatibility with Device Guard/Credential Guard

Post by pingnu »

Hi

I assume if you enable hyper-v on Windows 10 you can no longer use virtualbox

which appeared to be the case with xpmode running under windows7.
I have a windows10 Pro with 50gig of ram and have been using Virtualbox for sometime without a problem.
I had a old windowsXP image I ran when I was using Windows7 xp mode and wondered if it would still work with Hyper-V I enabled hyper-v then disabled it now virtualbox will not work I get the error

AMD-V is not available (VERR_SVM_NO_SVM).


Result Code:
E_FAIL (0x80004005)
Component:
ConsoleWrap
Interface:
IConsole {872da645-4a9b-1727-bee2-5585105b9eed}

I noticed if I ran xpmode in Windows 7 it would not run virtualbox untill I rebooted.
I have a asus M5A99X motherboard and trying to run a Debian image Virtualbox version Version 5.1.14 r112924 (Qt5.6.2)
Carl
socratis
Site Moderator
Posts: 27329
Joined: 22. Oct 2010, 11:03
Primary OS: Mac OS X other
VBox Version: PUEL
Guest OSses: Win(*>98), Linux*, OSX>10.5
Location: Greece

Re: VirtualBox Compatibility with Device Guard/Credential Guard

Post by socratis »

pingnu wrote:xpmode running under windows7.
Your problem seems to have nothing in common with the title of this thread "VirtualBox Compatibility with Device Guard/Credential Guard", but with XP-Mode. Please pick an appropriate thread, or even better, open a new one...
Do NOT send me Personal Messages (PMs) for troubleshooting, they are simply deleted.
Do NOT reply with the "QUOTE" button, please use the "POST REPLY", at the bottom of the form.
If you obfuscate any information requested, I will obfuscate my response. These are virtual UUIDs, not real ones.
Locked