🧱🪟💻🔓ES - Memory Integrity and Credential Guard - Disable
The deliberate off-switch for the handful of devices that genuinely cannot run VBS, so they boot and work instead of failing, and nobody else loses the protection.
What this policy is about 🔓
This is the counter-policy to 🧱🪟💻ES - Memory Integrity and Credential Guard. VBS is the right default, but a few devices simply cannot run it: an unsigned kernel driver that Memory Integrity refuses, a legacy auth path Credential Guard breaks, or hardware without the required virtualization support. On those machines the enable policy causes lost hardware or a device that will not enable the feature cleanly.
For that narrow set, this policy explicitly turns the VBS protections off, and it is assigned only to the exception group. Everyone else stays protected.
Because the enable policy uses UEFI locks, simply removing a device from it does not always bring VBS back down cleanly. This policy states the off position out loud, which is the reliable way to return a specific device to a working state.
🛠️ Configuration
Where: Intune admin center → Devices → Configuration → Create → Windows → Settings catalog → Device Guard.
| Setting | Value |
|---|---|
| Enable Virtualization Based Security | Disabled |
| Virtualization Based Protection of Code Integrity (Memory Integrity) | Disabled |
| Credential Guard Configuration | Disabled |
| Assignment, include | 🛡️🪟💻👈🔓⚙️Group - VBS Incompatible Devices |
| Assignment, exclude | None (only the approved exception group receives this) |
Setting the protections to Disabled is what actively returns these devices to a working state; where a UEFI lock was set, a disable and reboot is needed to release it.
Caveats ⚠️
Assign it narrowly or you have disabled VBS fleet-wide. This belongs on the approved exception group only. Point it any wider and you have quietly switched off one of your strongest defenses everywhere.
It is only half the pair. It has no purpose without the enable policy; the two are designed and reviewed together.
An exception should have an expiry mindset. A device is usually here because of one bad driver or one legacy dependency. When that is fixed or the hardware is replaced, the device should leave the group and get VBS back. Review membership so exceptions do not become permanent.
License and reversibility. Included in Business Premium. Clean-revert: remove a device from the group and it falls back under the enable policy.
🔗 Related
- 🧱🪟💻ES - Memory Integrity and Credential Guard: the default protection this policy carves an exception out of.
- 🛡️🪟💻👈🔓⚙️Group - VBS Incompatible Devices: the documented group this is assigned to.
Turn it off only where it truly cannot run, log why, and give it back the moment the blocker is gone. 🔓