Disabling core isolation: why registry-based and not via BCD?

[koitsu]

Why this?

	{
		  reg.exe add "HKLM\System\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 0 /f;
		  reg.exe add "HKLM\System\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f;
		  reg.exe add "HKLM\System\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "EnabledBootId" /t REG_DWORD /d 0 /f;
		  reg.exe add "HKLM\System\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "WasEnabledBy" /t REG_DWORD /d 0 /f;
	};

Why not simply use bcdedit /set isolatedcontext No and be done with it?

Sources:

• https://forums.virtualbox.org/viewtopic.php?t=103177
• Boot process and BCD store related documentation lacking MicrosoftDocs/feedback#1745 (comment)

[cschneegans]

Thanks, I did not know about the isolatedcontext option, it sounds promising. I had previously tried to disable VBS by running bcdedit /set hypervisorlaunchtype off without success, though.

On 25H2, running bcdedit /set isolatedcontext No in an elevated console window gives this error:

An error has occurred setting the element data.
The value is protected by Secure Boot policy and cannot be modified or deleted.

Using SYSTEM privileges (via psexec.exe) does not help.

[koitsu]

Thanks. I don't use Windows 11 nor Secure Boot, so -- much like you learning about isolatedcontext -- this failing under those conditions is news to me. How unfortunate. I guess the registry entries are overall safer then.