VMware Workstation and Device/Credential Guard are not compatible

Question

I have been running VMware for the last year no problems, today I opened it up to start one of my VM and get an error message, see screen shot.

I did follow the link and went through the steps, on step 4 I need to mount a volume using "mountvol". when I try to mount a volume using mountvol X: \\?\Volume{5593b5bd-0000-0000-0000-c0f373000000}\ it keeps saying The directory is not empty. I even created a partition with 2GB and still the same message.

My Questions:

How can I mount the volume that is not empty even though it is?

Why did this Device/Credential Guard auto enable itself and how can I get rid of it or disable it.

CMD:

Solution 1

Device/Credential Guard is a Hyper-V based Virtual Machine/Virtual Secure Mode that hosts a secure kernel to make Windows 10 much more secure.

...the VSM instance is segregated from the normal operating system functions and is protected by attempts to read information in that mode. The protections are hardware assisted, since the hypervisor is requesting the hardware treat those memory pages differently. This is the same way to two virtual machines on the same host cannot interact with each other; their memory is independent and hardware regulated to ensure each VM can only access it’s own data.

From here, we now have a protected mode where we can run security sensitive operations. At the time of writing, we support three capabilities that can reside here: the Local Security Authority (LSA), and Code Integrity control functions in the form of Kernel Mode Code Integrity (KMCI) and the hypervisor code integrity control itself, which is called Hypervisor Code Integrity (HVCI).

When these capabilities are handled by Trustlets in VSM, the Host OS simply communicates with them through standard channels and capabilities inside of the OS. While this Trustlet-specific communication is allowed, having malicious code or users in the Host OS attempt to read or manipulate the data in VSM will be significantly harder than on a system without this configured, providing the security benefit.

Running LSA in VSM, causes the LSA process itself (LSASS) to remain in the Host OS, and a special, additional instance of LSA (called LSAIso – which stands for LSA Isolated) is created. This is to allow all of the standard calls to LSA to still succeed, offering excellent legacy and backwards compatibility, even for services or capabilities that require direct communication with LSA. In this respect, you can think of the remaining LSA instance in the Host OS as a ‘proxy’ or ‘stub’ instance that simply communicates with the isolated version in prescribed ways.

And Hyper-V and VMware didn't work the same time until 2020, when VMware used Hyper-V Platform to co-exist with Hyper-V starting with Version 15.5.5.

How does VMware Workstation work before version 15.5.5?

VMware Workstation traditionally has used a Virtual Machine Monitor (VMM) which operates in privileged mode requiring direct access to the CPU as well as access to the CPU’s built in virtualization support (Intel’s VT-x and AMD’s AMD-V). When a Windows host enables Virtualization Based Security (“VBS“) features, Windows adds a hypervisor layer based on Hyper-V between the hardware and Windows. Any attempt to run VMware’s traditional VMM fails because being inside Hyper-V the VMM no longer has access to the hardware’s virtualization support.

Introducing User Level Monitor

To fix this Hyper-V/Host VBS compatibility issue, VMware’s platform team re-architected VMware’s Hypervisor to use Microsoft’s WHP APIs. This means changing our VMM to run at user level instead of in privileged mode, as well modifying it to use the WHP APIs to manage the execution of a guest instead of using the underlying hardware directly.

What does this mean to you?

VMware Workstation/Player can now run when Hyper-V is enabled. You no longer have to choose between running VMware Workstation and Windows features like WSL, Device Guard and Credential Guard. When Hyper-V is enabled, ULM mode will automatically be used so you can run VMware Workstation normally. If you don’t use Hyper-V at all, VMware Workstation is smart enough to detect this and the VMM will be used.

System Requirements

To run Workstation/Player using the Windows Hypervisor APIs, the minimum required Windows 10 version is Windows 10 20H1 build 19041.264. VMware Workstation/Player minimum version is 15.5.5.

To avoid the error, update your Windows 10 to Version 2004/Build 19041 (Mai 2020 Update) and use at least VMware 15.5.5.

Solution 2

There is a much better way to handle this issue. Rather than removing Hyper-V altogether, you just make alternate boot to temporarily disable it when you need to use VMWare. As shown here...

http://www.hanselman.com/blog/SwitchEasilyBetweenVirtualBoxAndHyperVWithABCDEditBootEntryInWindows81.aspx

C:\>bcdedit /copy {current} /d "No Hyper-V" 
The entry was successfully copied to {ff-23-113-824e-5c5144ea}. 

C:\>bcdedit /set {ff-23-113-824e-5c5144ea} hypervisorlaunchtype off 
The operation completed successfully.

note: The ID generated from the first command is what you use in the second one. Don't just run it verbatim.

When you restart, you'll then just see a menu with two options...

• Windows 10
• No Hyper-V

So using VMWare is then just a matter of rebooting and choosing the No Hyper-V option.

If you want to remove a boot entry again. You can use the /delete option for bcdedit.

First, get a list of the current boot entries...

C:\>bcdedit /v

This lists all of the entries with their ID's. Copy the relevant ID, and then remove it like so...

C:\>bcdedit /delete {ff-23-113-824e-5c5144ea}

As mentioned in the comments, you need to do this from an elevated command prompt, not powershell. In powershell the command will error.

update: It is possible to run these commands in powershell, if the curly braces are escaped with backtick (`). Like so...

C:\WINDOWS\system32> bcdedit /copy `{current`} /d "No Hyper-V"

Solution 3

I'm still not convinced that Hyper-V is The Thing for me, even with last year's Docker trials and tribulations and I guess you won't want to switch very frequently, so rather than creating a new boot and confirming the boot default or waiting out the timeout with every boot I switch on demand in the console in admin mode by

bcdedit /set hypervisorlaunchtype off

Another reason for this post -- to save you some headache: You thought you switch Hyper-V on with the "on" argument again? Nope. Too simple for MiRKoS..t. It's auto!

Have fun!
G.

Solution 4

To make it super easy:

1. Just download this script directly from Microsoft.

2. Run your Powershell as an admin and then execute following commands:

   • To Verify if DG/CG is enabled DG_Readiness.ps1 -Ready
   • To Disable DG/CG. DG_Readiness.ps1 -Disable

Solution 5

For those who might be encountering this issue with recent changes to your computer involving Hyper-V, you'll need to disable it while using VMWare or VirtualBox. They don't work together. Windows Sandbox and WSL 2 need the Hyper-V Hypervisor on, which currently breaks VMWare. Basically, you'll need to run the following commands to enable/disable Hyper-V services on next reboot.

To disable Hyper-V and get VMWare working, in PowerShell as Admin:

bcdedit /set hypervisorlaunchtype off

To re-enable Hyper-V and break VMWare for now, in PowerShell as Admin:

bcdedit /set hypervisorlaunchtype auto

You'll need to reboot after that. I've written a PowerShell script that will toggle this for you and confirm it with dialog boxes. It even self-elevates to Administrator using this technique so that you can just right click and run the script to quickly change your Hyper-V mode. It could easily be modified to reboot for you as well, but I personally didn't want that to happen. Save this as hypervisor.ps1 and make sure you've run Set-ExecutionPolicy RemoteSigned so that you can run PowerShell scripts.

# Get the ID and security principal of the current user account
$myWindowsID = [System.Security.Principal.WindowsIdentity]::GetCurrent();
$myWindowsPrincipal = New-Object System.Security.Principal.WindowsPrincipal($myWindowsID);

# Get the security principal for the administrator role
$adminRole = [System.Security.Principal.WindowsBuiltInRole]::Administrator;

# Check to see if we are currently running as an administrator
if ($myWindowsPrincipal.IsInRole($adminRole))
{
    # We are running as an administrator, so change the title and background colour to indicate this
    $Host.UI.RawUI.WindowTitle = $myInvocation.MyCommand.Definition + "(Elevated)";
    $Host.UI.RawUI.BackgroundColor = "DarkBlue";
    Clear-Host;
}
else {
    # We are not running as an administrator, so relaunch as administrator

    # Create a new process object that starts PowerShell
    $newProcess = New-Object System.Diagnostics.ProcessStartInfo "PowerShell";

    # Specify the current script path and name as a parameter with added scope and support for scripts with spaces in it's path
    $newProcess.Arguments = "-windowstyle hidden & '" + $script:MyInvocation.MyCommand.Path + "'"

    # Indicate that the process should be elevated
    $newProcess.Verb = "runas";

    # Start the new process
    [System.Diagnostics.Process]::Start($newProcess);

    # Exit from the current, unelevated, process
    Exit;
}

Add-Type -AssemblyName System.Windows.Forms


$state = bcdedit /enum | Select-String -Pattern 'hypervisorlaunchtype\s*(\w+)\s*'


if ($state.matches.groups[1].ToString() -eq "Off"){

    $UserResponse= [System.Windows.Forms.MessageBox]::Show("Enable Hyper-V?" , "Hypervisor" , 4)

    if ($UserResponse -eq "YES" ) 
    {

        bcdedit /set hypervisorlaunchtype auto
        [System.Windows.Forms.MessageBox]::Show("Enabled Hyper-V. Reboot to apply." , "Hypervisor")

    } 

    else 

    { 

        [System.Windows.Forms.MessageBox]::Show("No change was made." , "Hypervisor")
        exit

    }

} else {

    $UserResponse= [System.Windows.Forms.MessageBox]::Show("Disable Hyper-V?" , "Hypervisor" , 4)

    if ($UserResponse -eq "YES" ) 
    {

        bcdedit /set hypervisorlaunchtype off
        [System.Windows.Forms.MessageBox]::Show("Disabled Hyper-V. Reboot to apply." , "Hypervisor")

    } 

    else 

    { 

        [System.Windows.Forms.MessageBox]::Show("No change was made." , "Hypervisor")
        exit

    }

}

View more solutions

Comments

[Adam E.]

My Windows 10 (Anniversary Update) is at version 14393.351 and out of the two highlighted features I had only "Hyper-V Hypervisor", but not "Isolated User Mode". I was able to fix the VMware issue by uninstalling only the "Hyper-V Hypervisor" feature. I am glad I didn't have to go through the manual steps VMware had in their KB

[magicandre1981]

@dashrendar ok, this is the issue with Win10. With each feature upgrade they change/rename some options/features. The blog was written at a time were 1511 was the current version.

[MaciejLisCK]

Note: Run commands in administrators command line, in PowerShell it does not work.

[user1751825]

There's no need to disable Hyper-V this way, or to install any 3rd party utilities. Hyper-V can be turned on and off as required simply using alternate boot options with the builtin bcdedit command (see my answer).

[user3402754]

This worked for me, but how can I rollback the action above?

[user1751825]

You can use the /delete option for bcdedit, to delete the cloned entry. I'm updated my answer above.

[asliwinski]

The solution doesn't seem to work for Win10 Creators Update.

[magicandre1981]

@endriu what is not working? The picture is from v1511, not 1703. Simply uninstall Hyper-V

[asliwinski]

@magicandre1981 In my case I had to additionally run: bcdedit /set hypervisorlaunchtype off

[magicandre1981]

@endriu this is done automatically during uninstall. you had some issues removing it

[Dror 'Yitzhakov]

This is the best answer IMHO

[Mohamed El-Beltagy]

It works, specially if you need to have both (instead of uninstalling the whole Hyper-V Hypervisor). I keep on switching between the two for playing around with both technologies. That's why I prefer this way.

[user3162901]

and bcdedit /set hypervisorlaunchtype auto if you need to turn it back on.

[user6741701]

I found the easiest solution was to use HyperVSwitch.exe. It requires no dual boot because it toggles the settings and then reboots. I use this on Windows 10 where I try to run VMware and Docker-for-windows. github.com/ygoe/HyperVSwitch (or download directly from here: unclassified.software/en/apps/hypervswitch)

[Monku]

This is definitely a better answer than the accepted one.

[j1rjacob]

Does this solution works also in Windows Server 2016?

[magicandre1981]

@AmatVictoriaCuram use Server Manager to remove Hyper-V role

[Mtxz]

I also needed to uninstall windows feature "Linux sub-system" and reboot to make this error go away.

[Justin]

I have tried every option listed and I still can't get this working on windows 10 v1803

[TOOGAM]

Is the only reason that PowerShell is not working just that people are not placing the backtick (`) character before the curly braces?

[Chetan]

I needed to reboot to be able to run VM.

[steampowered]

One more step required for it to work on my system: Disable the Group Policy setting used to enable Windows Defender Credential Guard (Computer Configuration -> Administrative Templates -> System -> Device Guard -> Turn on Virtualization Based Security).

[Pegues]

Would be more helpful if you provided information on how to properly use the script that you say to download. Every time someone posts a script for Powershell, they never explain properly how to use it.

[Nicholas K]

If the above answer didn't work then try 1. bcdedit /set hypervisorlaunchtype off 2. restart windows

[Razikh]

In my case, I could not execute the script as script execution was disabled. I had to enable script execution first with the following command: Set-ExecutionPolicy unrestricted On reboot, I got the prompt to disable Device Guard. Thanks for the Solution!

[Hemanth Savasere]

This is the most simple and sweet solution, Thanks a lot.

[user1751825]

@TOOGAM Yes, that is it. I just tried it, and can confirm that the commands work fine in powershell as long as the curly braces are escaped wtih backticks.

[Violet Giraffe]

I have both of the suggested features turned off, and yet Hyper-V virtualization works and VMWare doesn't. What's enable is "Windows hypervisor platform".

[magicandre1981]

@VioletGiraffe also disable Device Guard/Windows Sandbox. Also disable Hypervisor platform

[AJcleverprogrammer]

if that doesn't work follow these steps : computerz.solutions/…

[Vishnudev K]

did you just copied your entire answer from communities.vmware.com/message/2753727#2753727 ? Give the credit at least.

[SomethingSomething]

I ran the first command and got error: The specified entry identifier is not valid. The parameter is incorrect.

[user1751825]

@SomethingSomething You need to run the command from an elevated command prompt. Right click and choose "Run as administrator".

[Shailen]

Well, that did not work for me. (Windows 10 v1809, VMware WS Pro 15.5.1) I tried pretty much everything out there. This CG_DG problem cannot be cured easily.

[Alexandru Dicu]

Short and does the trick without changing anything in Windows Registry or by disabling Windows features. Thank you.

[Bernhard]

the tech preview 20h1 also works on 1809. Extract it with "/x" switch and directly install from %temp%

[Zythyr]

Thanks for sharing this solution. Although slightly unrelated, this also fixed the issue of the super slow sluggish performance in Virtualbox. Prior to this solution, attempt to install Win10 guest OS in Virtualbox was super slow. Virtualbox never give me the warning of turning off hypervisor, which led to investigate VMWare. I found your solution and it solved my issues in both VMWare and Virtualbox.

[user889030]

why so much deep article on it , why not simply tell how to disable it , the answer is confusing

[magicandre1981]

@user889030 that are the rules, to post deeper answers and not simple comments as answer. Users who registered nearly 9 years ago should know this

[douggard]

I unticked all the boxes in the registry and it was still throwing errors. This script worked for me. Finally got the prompts on reboot to disable device guard and some other protection.

[Shawn Melton]

Sadly even with v2004 update on Windows 10 this will make VMware Workstation work again, but if prevents Docker for Windows from running....it seems Docker is what enables this setting.

[atripes]

That's golden and worked perfectly! Can you maybe share a thought on the implications of disabling Hyper-V? Is this a security issue in Win10? Thanks!

[J. Blackadar]

@atripes No problem! Disabling Hyper-V is disabling a Windows system service which provides an interface for other programs to virtualize your hardware. So disabling this service is no security issue, since it only stops a service from starting. In this particular case, the service is actually preventing virtualization from happening elsewhere, so it’s exactly what we want!

[Admin]

Thank You, it helped me

[Henke]

Reference: WooHoo fix for VMware.

[Dave]

Running the bcdedit command did not work. It is not that simple in my case. Not sure why it still does not work.

[Dave]

Only thing that worked for me on here! Thank you.