Secure Boot, VBS and Hyper-V: Windows security features and game software

Windows 10 and 11 have several security layers that affect how drivers and low-level programs start. Requirements on product pages often mention them, so here is what each one does.

Secure Boot

A UEFI feature that lets only signed bootloaders and drivers start when the PC boots. It is switched in the BIOS/UEFI. Step-by-step: how to disable Secure Boot.

VBS and Memory integrity (HVCI)

Virtualization-based security isolates part of the system in a protected virtual environment. "Memory integrity" (Core isolation) uses it to block unsigned or vulnerable drivers. That is why internal builds often ask to turn it off — see how to disable VBS.

Hyper-V

The Microsoft hypervisor that VBS, WSL2, Windows Sandbox and some emulators rely on. While Hyper-V is active, VBS can stay on even if you disabled Memory integrity, so loaders may ask to disable it too.

TPM 2.0

A security chip required by Windows 11. Some anti-cheat systems check it; game software rarely needs any changes here.

How to check the current state

1. Press Win+R, type msinfo32 and press Enter.
2. In "System Summary" look at Secure Boot State and Virtualization-based security.
3. Memory integrity is in Windows Security → Device security → Core isolation.

Important

These features protect the computer. Change them only if the product requirements really ask for it, and turn them back on when you no longer need it. External builds and DMA setups usually do not require changing them.