Skip to content

Commit 56b400d

Browse files
adrelanosadrelanos
committed
Merge remote-tracking branch 'ArrayBolt3/arraybolt3/hyper-v-disable'
2 parents e042aa8 + eb7d6d6 commit 56b400d

File tree

3 files changed

+465
-6
lines changed

3 files changed

+465
-6
lines changed

‎DisableHyperV.bat‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,193 @@
1+
@echo off
2+
setlocal ENABLEEXTENSIONS
3+
4+
REM Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
5+
REM See the file COPYING for copying conditions.
6+
7+
REM Detect if we are running on a version of Windows earlier than 10. Those
8+
REM versions of Windows are end-of-life, and don't feature
9+
REM virtualization-based security, thus users shouldn't be using those
10+
REM versions of Windows and probably won't run into Hyper-V issues if they are
11+
REM still using them.
12+
13+
REM See:
14+
REM https://stackoverflow.com/questions/13212033/get-windows-version-in-a-batch-file
15+
16+
for /f "tokens=4-5 delims=. " %%i in ('ver') do set WINVER=%%i.%%j
17+
if not "%WINVER%" == "10.0" (
18+
echo This system is not running Windows 10 or higher. Hyper-V generally does not need to be disabled on these systems.
19+
pause
20+
exit
21+
)
22+
23+
REM Apparently the best way for a script to check if it is running as
24+
REM administrator on Windows is to attempt to run a command that does
25+
REM "nothing" but requires administrator privileges. "net session" is one such
26+
REM command. See:
27+
REM https://stackoverflow.com/a/11995662
28+
29+
net session >nul 2>&1
30+
if not %errorlevel% == 0 (
31+
echo This script must be run as administrator. Right-click it, and click "Open as administrator".
32+
pause
33+
exit
34+
)
35+
36+
REM There is no way to disable the "Terminate batch job?" prompt that appears
37+
REM when the user presses Ctrl+C. Such a feature will probably not ever be
38+
REM added to Windows, see
39+
REM https://github.com/microsoft/terminal/issues/217#issuecomment-404240443
40+
41+
echo WARNING: Please read this entire message before proceeding, or you may unintentionally lock yourself out of your system!
42+
echo NOTE: To exit this script, press Ctrl+C, then answer "Y" when asked if you want to terminate a batch job.
43+
echo.
44+
echo This tool will disable Hyper-V on your Windows 10 or 11 device. This may improve Whonix performance.
45+
echo.
46+
echo Several Windows features depend on Hyper-V in order to function. These features will be disabled:
47+
echo - Windows Hello
48+
echo - Windows Subsystem for Linux (WSL2)
49+
echo - Memory Integrity
50+
echo - Credential Guard
51+
echo - Virtualization-based security
52+
echo - System Guard Secure Launch
53+
echo - Windows Hypervisor Platform
54+
echo - Hyper-V Manager
55+
echo.
56+
echo Additionally, the system may present a BitLocker recovery screen on the next reboot.
57+
echo.
58+
echo Disabling the above features will reduce the overall security of your system (although it will not substantially
59+
echo affect the security of Whonix). If this is unacceptable, you should not proceed with this script.
60+
echo.
61+
echo Before proceeding, please ensure:
62+
echo - You can log into Windows without Windows Hello
63+
echo - If device encryption or BitLocker is enabled, you can access your recovery key
64+
echo - You do not use or need any of the features listed above
65+
echo.
66+
echo This script is not able to modify Group Policy, Intune, or App Control settings, nor can it disable Credential
67+
echo Guard if it is enabled with UEFI lock.
68+
echo.
69+
pause
70+
echo.
71+
echo FINAL CONFIRMATION: Are you sure you want to disable Hyper-V?
72+
echo.
73+
pause
74+
echo.
75+
echo OK, disabling Hyper-V.
76+
echo.
77+
78+
REM "timeout" is subtly broken and not usable for short sleeps, but it is
79+
REM reasonably usable in this script. See:
80+
REM https://stackoverflow.com/questions/1672338/how-to-sleep-for-five-seconds-in-a-batch-file-cmd#comment16795532_1672375
81+
82+
echo =========================================================================
83+
echo -------------------------------------------------------------------------
84+
echo =========================================================================
85+
echo Setting "hypervisorlaunchtype" in Boot Configuration Data to "auto", then to "off", by running:
86+
echo bcdedit /set hypervisorlaunchtype auto
87+
echo bcdedit /set hypervisorlaunchtype off
88+
timeout 10 /nobreak
89+
bcdedit /set hypervisorlaunchtype auto
190
bcdedit /set hypervisorlaunchtype off
91+
echo.
92+
93+
echo =========================================================================
94+
echo -------------------------------------------------------------------------
95+
echo =========================================================================
96+
echo Uninstalling Hyper-V Manager, by running:
97+
echo dism /Online /Disable-Feature:Microsoft-Hyper-V /NoRestart
98+
echo NOTE: This command may print error messages if you are using Windows Home. This is expected and can be safely ignored.
99+
timeout 10 /nobreak
2100
dism /Online /Disable-Feature:Microsoft-Hyper-V /NoRestart
101+
echo.
102+
103+
echo =========================================================================
104+
echo -------------------------------------------------------------------------
105+
echo =========================================================================
106+
echo Uninstalling Windows Subsystem for Linux, by running:
107+
echo dism /Online /Disable-Feature:Microsoft-Windows-Subsystem-Linux /NoRestart
108+
timeout 10 /nobreak
109+
dism /Online /Disable-Feature:Microsoft-Windows-Subsystem-Linux /NoRestart
110+
echo.
111+
112+
echo =========================================================================
113+
echo -------------------------------------------------------------------------
114+
echo =========================================================================
115+
echo Uninstalling Windows Hypervisor Platform, by running:
116+
echo dism /Online /Disable-Feature:HypervisorPlatform /NoRestart
117+
timeout 10 /nobreak
3118
dism /Online /Disable-Feature:HypervisorPlatform /NoRestart
119+
echo.
120+
121+
echo =========================================================================
122+
echo -------------------------------------------------------------------------
123+
echo =========================================================================
124+
echo Uninstalling Virtual Machine Platform, by running:
125+
echo dism /Online /Disable-Feature:VirtualMachinePlatform /NoRestart
126+
timeout 10 /nobreak
4127
dism /Online /Disable-Feature:VirtualMachinePlatform /NoRestart
128+
echo.
129+
130+
echo =========================================================================
131+
echo -------------------------------------------------------------------------
132+
echo =========================================================================
133+
echo Disabling Memory Integrity, by running:
134+
echo reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity
135+
echo /v Enabled /t REG_DWORD /d 0 /f
136+
echo reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity
137+
echo /v WasEnabledBy /t REG_DWORD /d 2 /f
138+
timeout 10 /nobreak
5139
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0 /f
6140
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v WasEnabledBy /t REG_DWORD /d 2 /f
141+
echo.
142+
143+
echo =========================================================================
144+
echo -------------------------------------------------------------------------
145+
echo =========================================================================
146+
echo Disabling Virtualization-Based Security in the registry, by running:
147+
echo reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity /f
148+
echo reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard /v RequirePlatformSecurityFeatures /f
149+
echo NOTE: These commands may print error messages. They may be safely ignored.
150+
timeout 10 /nobreak
7151
reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity /f
8152
reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard /v RequirePlatformSecurityFeatures /f
153+
echo.
154+
155+
echo =========================================================================
156+
echo -------------------------------------------------------------------------
157+
echo =========================================================================
158+
echo Disabling Virtualization-Based Security in boot configuration data, by running:
159+
echo bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS
160+
echo bcdedit /set vsmlaunchtype off
161+
echo NOTE These commands may print error messages. They may be safely ignored.
162+
timeout 10 /nobreak
163+
bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS
164+
bcdedit /set vsmlaunchtype off
165+
echo.
166+
167+
echo =========================================================================
168+
echo -------------------------------------------------------------------------
169+
echo =========================================================================
170+
echo Disabling Credential Guard in registry, by running:
171+
echo reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags /t REG_DWORD /d 0 /f
172+
echo reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags /t REG_DWORD /d 0 /f
173+
timeout 10 /nobreak
9174
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags /t REG_DWORD /d 0 /f
10175
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags /t REG_DWORD /d 0 /f
176+
echo.
177+
178+
echo =========================================================================
179+
echo -------------------------------------------------------------------------
180+
echo =========================================================================
181+
echo Disabling System Guard Secure Launch, by running:
182+
echo reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard
183+
echo /v Enabled /t REG_DWORD /d 0 /f
184+
timeout 10 /nobreak
185+
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard /v Enabled /t REG_DWORD /d 0 /f
186+
echo.
187+
188+
echo =========================================================================
189+
echo -------------------------------------------------------------------------
190+
echo =========================================================================
191+
echo All done. Hyper-V should now be disabled.
192+
echo Reboot your system for the above changes to take effect.
193+
pause

‎QueryHyperVStatus.bat‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
@echo off
2+
setlocal ENABLEEXTENSIONS
3+
4+
REM Copyright (C) 2025 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
5+
REM See the file COPYING for copying conditions.
6+
7+
REM Detect if we are running on a version of Windows earlier than 10. Those
8+
REM versions of Windows are end-of-life, and don't feature
9+
REM virtualization-based security, thus users shouldn't be using those
10+
REM versions of Windows and probably won't run into Hyper-V issues if they are
11+
REM still using them.
12+
13+
REM See:
14+
REM https://stackoverflow.com/questions/13212033/get-windows-version-in-a-batch-file
15+
16+
for /f "tokens=4-5 delims=. " %%i in ('ver') do set WINVER=%%i.%%j
17+
if not "%WINVER%" == "10.0" (
18+
echo This system is not running Windows 10 or higher. This script is likely irrelevant for this system.
19+
pause
20+
exit
21+
)
22+
23+
REM Apparently the best way for a script to check if it is running as
24+
REM administrator on Windows is to attempt to run a command that does
25+
REM "nothing" but requires administrator privileges. "net session" is one such
26+
REM command. See:
27+
REM https://stackoverflow.com/a/11995662
28+
29+
net session >nul 2>&1
30+
if not %errorlevel% == 0 (
31+
echo This script must be run as administrator. Right-click it, and click "Open as administrator".
32+
pause
33+
exit
34+
)
35+
36+
echo This script will display information about several Hyper-V related features that may be present on the system. The
37+
echo logs from this script may be useful for determining if Hyper-V has been disabled on the system or not.
38+
echo.
39+
echo Some of the commands this script runs may print error messages. These are not bugs and can be safely ignored.
40+
echo.
41+
pause
42+
echo.
43+
44+
echo =========================================================================
45+
echo -------------------------------------------------------------------------
46+
echo =========================================================================
47+
echo BEGIN Boot Configuration Data
48+
bcdedit
49+
echo END Boot Configuration Data
50+
echo.
51+
52+
echo =========================================================================
53+
echo -------------------------------------------------------------------------
54+
echo =========================================================================
55+
echo BEGIN Hyper-V Manager Status
56+
dism /Online /Get-FeatureInfo /FeatureName:Microsoft-Hyper-V
57+
echo END Hyper-V Manager Status
58+
echo.
59+
60+
echo =========================================================================
61+
echo -------------------------------------------------------------------------
62+
echo =========================================================================
63+
echo BEGIN Windows Subsystem for Linux Status
64+
dism /Online /Get-FeatureInfo /FeatureName:Microsoft-Windows-Subsystem-Linux
65+
echo END Windows Subsystem for Linux Status
66+
echo.
67+
68+
echo =========================================================================
69+
echo -------------------------------------------------------------------------
70+
echo =========================================================================
71+
echo BEGIN Windows Hypervisor Platform Status
72+
dism /Online /Get-FeatureInfo /FeatureName:HypervisorPlatform
73+
echo END Windows Hypervisor Platform Status
74+
echo.
75+
76+
echo =========================================================================
77+
echo -------------------------------------------------------------------------
78+
echo =========================================================================
79+
echo BEGIN Virtual Machine Platform Status
80+
dism /Online /Get-FeatureInfo /FeatureName:VirtualMachinePlatform
81+
echo END Virtual Machine Platform Status
82+
echo.
83+
84+
echo =========================================================================
85+
echo -------------------------------------------------------------------------
86+
echo =========================================================================
87+
echo BEGIN Memory Integrity Status
88+
echo Displaying registry key
89+
echo "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity",
90+
echo value "Enabled"
91+
reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled
92+
echo Displaying registry key
93+
echo "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity",
94+
echo value "WasEnabledBy"
95+
reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v WasEnabledBy
96+
echo END Memory Integrity Status
97+
echo.
98+
99+
echo =========================================================================
100+
echo -------------------------------------------------------------------------
101+
echo =========================================================================
102+
echo BEGIN Virtualization-Based Security Status
103+
echo Displaying registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard",
104+
echo value "EnableVirtualizationBasedSecurity"
105+
reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity
106+
echo Displaying key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard",
107+
echo value "RequirePlatformSecurityFeatures"
108+
reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard /v RequirePlatformSecurityFeatures
109+
echo END Virtualization-Based Security Status
110+
echo.
111+
112+
echo =========================================================================
113+
echo -------------------------------------------------------------------------
114+
echo =========================================================================
115+
echo BEGIN Credential Guard Status
116+
echo Displaying registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa", value "LsaCfgFlags"
117+
reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags
118+
echo Displaying registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard", value "LsaCfgFlags"
119+
reg query HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags
120+
echo END Credential Guard Status
121+
echo.
122+
123+
echo =========================================================================
124+
echo -------------------------------------------------------------------------
125+
echo =========================================================================
126+
echo BEGIN System Guard Secure Launch Status
127+
echo Displaying registry key
128+
echo "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard", value "Enabled"
129+
reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard /v Enabled
130+
echo END System Guard Secure Launch Status
131+
echo.
132+
133+
echo =========================================================================
134+
echo -------------------------------------------------------------------------
135+
echo =========================================================================
136+
echo All done. Relevant information about Hyper-V-related security features is displayed above.
137+
pause

0 commit comments

Comments
 (0)