Hypervisor / VBS Troubleshooting

Fix “Hypervisor / VBS is running”

The Plus loader blocks loading when its VBS/HVCI checks trigger. VBS means Virtualization-Based Security; HVCI is Memory Integrity. Start with the in-app Disable & Reboot button. If the banner returns, use the diagnostic below to see which check is triggering.

For the complete bootloader requirements and loading sequence, follow the Plus Setup Guide.

Download and run the diagnostic

Download check_vbs.bat

1. Save check_vbs.bat on your PC.
2. Right-click it and select Run as administrator. Elevated access is needed for reliable WMI and boot configuration results.
3. Read the VERDICT block and its Source of truth line.
4. If you need help, copy the full script output into your support ticket.

The supplied batch file queries WMI, registry settings, boot configuration and the Hyper-V feature state. It prints diagnostics and pauses so you can read them; it does not change these settings or reboot your PC.

What the checks mean

The supplied script describes its rules as matching the loader’s checks. The website does not independently verify the loader implementation.

• Primary source: WMI / CIM → ROOT\Microsoft\Windows\DeviceGuard → Win32_DeviceGuard.
• VBS trigger: VirtualizationBasedSecurityStatus == 2 (running). A value of 0 means disabled; 1 means enabled but not running.
• HVCI trigger: SecurityServicesRunning contains 2, and the VBS trigger is active. This is how the supplied script calculates its verdict.
• Fallback if WMI fails: registry values DeviceGuard\EnableVirtualizationBasedSecurity and DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity\Enabled. The script treats 0x1 as enabled and applies the same VBS condition to HVCI.

Read the VERDICT block

A clean result from a successful WMI query looks like:

Source of truth : WMI
VBS running     : 0
HVCI running    : 0

[CLEAN] Neither VBS nor HVCI is running. Loader should NOT block.

A VBS trigger looks like:

[TRIGGER] VBS is running  --> loader will show the red banner.
          Reason: Win32_DeviceGuard.VirtualizationBasedSecurityStatus = 2

An HVCI trigger also reports that SecurityServicesRunning contains 2. The raw service list helps identify the security features involved:

• 1 — Credential Guard (CredGuard / CG).
• 2 — Memory Integrity (HVCI).
• 3 — System Guard Secure Launch (SysGuard).
• 4 — SMM Firmware Measurement.
• 5 — Kernel-mode Hardware-enforced Stack Protection (KernelHWStack).
• 7 — Hypervisor-Enforced Paging Translation (HVPT).

CodeIntegrityPolicyEnforcementStatus is a separate App Control / WDAC signal, not a trigger in this script. A value of 2 means that policy is enforced; it does not by itself show HVCI is running. See Microsoft’s Win32_DeviceGuard field reference.

If VBS returns after reboot

Something may be enabling the hypervisor or enforcing VBS again: Credential Guard, Group Policy / Intune, Hyper-V, WSL2, Sandbox, Docker dependencies or OEM security defaults.

1. Try Disable & Reboot in the loader first. After restarting, run the diagnostic again.
2. Check Memory Integrity. Open Windows Security → Device security → Core isolation details → Memory integrity and set it to Off.
3. Check Credential Guard. There is no universal “Credential Guard: Off” switch in Windows Security. If the output includes service 1, review the device’s policy with support or your administrator.
4. Check Windows features. Press Win + R, enter OptionalFeatures.exe, and uncheck enabled virtualization components you are disabling for this setup: Hyper-V, Windows Hypervisor Platform, Virtual Machine Platform, Windows Sandbox and Windows Subsystem for Linux. Available items vary by Windows edition. WSL2 and some Docker backends depend on these features.
5. Check the boot setting. In an administrator PowerShell or Command Prompt, run:

   bcdedit /set hypervisorlaunchtype off

   Restart after applying the changes.
6. Check policy if settings come back. Where available, open rsop.msc and review Computer Configuration → Administrative Templates → System → Device Guard. Intune policy may also apply. Ask the administrator to review enforced settings.
7. Check firmware virtualization. Follow the Plus firmware setup for Intel VT-x / VT-d or AMD SVM / IOMMU. Ask support about unfamiliar settings before changing them.

After the final restart, rerun check_vbs.bat. If a successful WMI query reports VBS/HVCI off but the loader still blocks, include the full diagnostic output and a screenshot of the loader in your support ticket.