Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Help diagnose VBS requirements #604

Open
verdy-p opened this issue Sep 23, 2021 · 0 comments
Open

Help diagnose VBS requirements #604

verdy-p opened this issue Sep 23, 2021 · 0 comments
Assignees
Labels
checks Check improvement or new check. PRO To be included in Enterprise Edition

Comments

@verdy-p
Copy link

verdy-p commented Sep 23, 2021

Describe the bug

Please help diagnose the requirements for VBS

To Reproduce

Steps to reproduce the behavior:

  1. Go to https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs
  2. Scan the list of features, and their requirements
  3. Help identify the features that do not work (the Microsoft doc does not explain anything to end users but jsut drives to very technical documentations for OEMs)

Expected behavior

If a VBS feature is missing, idenify which one it is precisely, according to the model of CPU, this may be a problem of BIOS, or a problem in UEFI settings in the EFI BIOS, or a driver update missing, or a setting of the OS itself in the registry (including OS startup mode, conflicting (but unused) drivers that forces VBS to be turned off (notably when Windwos PnP tries to identify if a driver is appropriate to use, the self-test may use unsecure means such as DMA tests; this includes notably the simple presence of an Intel non-DCH drivers (*.INF + their declared *.SYS)) on the system, that MUST be uninstalled/deleted from the DriverStore, EVEN if these devices are NOT present on the PC or have been compeltely disabled in BIOS settings: these drivers still makes Wndows's PnP to tryt loading them and performing device presence/activation tests)

Desktop (please complete the following information):

  • OS: Windows 10 or 11
  • Version: (any version in Release, Insiders Beta and Dev channels)

Note that Microsoft, CPU vendors and BIOS and PC manufacturers use different terminologies: it is not easy at all to see if we have enabled "SLAT", or IOMMU or SMMMU. Often, BIOS manufacturers (all branches), do not detail these settings or oversmplify it, e.g: "security device", "safe boot", "secure boot", "hardware virtualization", energy settings (including Wake on LAN, S0/S1/S+ power modes, ErP). as well Windows stioll does not allow seeing EFI ios settings (notably if they expose their "firmware support for SMM protection" with the "WMST" table, or "IMAT". As well Windows provides NO help at all to allow identifying the device drivers that cause windows to NOT run VBS, even if it was configured.

A tool like MSINFO32.EXE does not help much as well

@micwoj92 micwoj92 added the checks Check improvement or new check. label Sep 23, 2021
@rcmaehl rcmaehl self-assigned this Sep 23, 2021
@rcmaehl rcmaehl added the PRO To be included in Enterprise Edition label Nov 13, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
checks Check improvement or new check. PRO To be included in Enterprise Edition
Projects
None yet
Development

No branches or pull requests

3 participants