VBS Enclaves Archives

Winsage

April 19, 2025

Microsoft is deprecating a ‘revolutionary’ virtualization-based security feature for older versions of Windows 11

Microsoft has announced the deprecation of Virtualization-based Security (VBS) enclaves, a feature introduced in July 2024, in Windows 11 23H2 and earlier versions, as well as in Windows Server 2022 and its predecessors. Support for VBS enclaves will continue in Windows Server 2025 and future versions. VBS enclaves were designed to create secure memory spaces using Microsoft's Hyper-V hypervisor, enhancing security for specific application components. The decision to phase out VBS enclaves may be influenced by the rapid development cycle of Windows 11. Users are expected to transition to newer releases as support for Windows 11 23H2 ends in November. Enterprise customers relying on VBS enclaves may face disruptions if the feature is completely removed.

Winsage

April 19, 2025

Microsoft «kills a feature that protected «older» versions of Windows 11 — and no one knows why

Microsoft will discontinue support for virtualization-based security enclaves (VBS enclaves) in Windows 11 versions 23H2 and 22H2, as well as in Windows Server versions 2022, 2019, and 2016. Support for VBS enclaves will only be retained in Windows 11 version 24H2 and later, and in Windows Server 2025 and later. VBS enclaves enhance memory operation security by creating virtual trust levels within a Trusted Execution Environment. Microsoft previously addressed a privilege escalation vulnerability within VBS enclaves (CVE-2025-21370) and plans to integrate the Rust programming language into the Windows kernel starting with Windows 11 version 23H2 in 2024.

Winsage

April 18, 2025

Microsoft makes Windows 11 24H2 more secure but not how you’d think

Microsoft is deprecating support for Virtualization-Based Security (VBS) enclaves in Windows 11 23H2 and earlier versions as it transitions users to Windows 11 24H2, which retains support for VBS enclaves. Windows 11 24H2 enhances security and is essential for developers to ensure their applications function correctly and securely. Windows 11 23H2 will reach the end of its support lifecycle on November 11, 2025, after which Microsoft will stop providing security updates. Users are encouraged to upgrade to Windows 11 24H2 to maintain access to security features and receive updates.

Winsage

November 4, 2024

Windows Server 2025 released—here are the new features

Microsoft has launched Windows Server 2025, which will be generally available starting November 1, 2024. The new version includes features such as hotpatching, next-gen Active Directory, and SMB over QUIC alternative ports. Windows Server is available through the Long-Term Servicing Channel (LTSC) and the Annual Channel (AC). Key enhancements include: - Hotpatching enabled by Azure Arc for automatic updates and backup options. - NVMe storage performance improvements, offering up to 60% more IOPs compared to Windows Server 2022. - Block cloning support using the ReFS file system. - New Active Directory functionalities, including AD object repair and improved security. - Credential Guard for safeguarding against credential theft. - SMB hardening with secure access to file shares over the Internet. - Delegate Managed Service Accounts (dMSA) for automated password management. - Accelerated Networking (AccelNet) for reduced latency and CPU utilization. - DTrace for real-time system performance monitoring. - Virtualization-based security (VBS) enclaves for enhanced security. - Windows Local Administrator Password Solution (LAPS) for unique password generation and management. Microsoft is investigating known issues, including installation failures and BSOD errors for systems with more than 256 logical processors, boot issues in iSCSI environments, and language display problems during setup. Windows Server 2025 will reach its end of support on October 10, 2029, with extended support ending on October 10, 2034. A free 180-day trial is available through the Microsoft Evaluation Center.

Winsage

October 3, 2024

Understanding VBS Enclaves, Windows’ new security technology

The implementation of a trusted execution environment on personal computers enhances data security by protecting data in use, in addition to traditional data protection methods. Windows 11 features advanced memory integrity tools that create an isolated memory segment called Virtual Trust Level 1 (VTL 1) for a secure version of the Windows kernel, while the standard environment operates at Virtual Trust Level 0 (VTL 0). VBS Enclaves require Windows 11 or Windows Server 2019 or later with VBS enabled, which can be done through Windows security tools, Group Policy, or Intune for Mobile Device Management (MDM). Enabling VBS across all supported devices is recommended to reduce security risks.

Winsage

October 2, 2024

Microsoft Beefs Up Windows Recall’s Security, Users Can Choose To Uninstall – Pokde.Net

Microsoft has announced significant updates to its Recall feature, which will now be opt-in by default, requiring users to enable it during the setup of their Copilot+ PCs. Users can completely uninstall Recall by navigating to the “Optional Features” section in Settings. The feature will now encrypt all data using the Trusted Platform Module (TPM) and require Windows Hello for access. Recall is designed with security measures that isolate it from the operating system and administrative users, and sensitive information will be filtered by default. Content from private browsing sessions will not be recorded, and users can delete or filter specific information.

Winsage

September 30, 2024

Microsoft brings back its most controversial Windows AI feature, with beefed up security

Microsoft's Recall, an AI-driven search tool for Copilot+ PCs, faced delays due to user concerns about unencrypted screenshots potentially exposing sensitive information. In response, Microsoft announced a revamped version with enhanced security features, including: - Encryption of all captured data. - Integration with Windows Hello Enhanced Sign-in Security for controlled access. - An opt-in feature that is not activated by default and can be uninstalled. - Storage of screenshots in a secure VBS Enclave, accessible only when users engage with Recall. These improvements aim to address the security issues identified in the initial rollout.

Winsage

September 29, 2024

Microsoft Lifts Hood on Windows Recall’s Security Guardrails — Redmondmag.com

Microsoft is preparing for the preview release of Windows Recall, a feature for Microsoft Copilot+ PCs that captures user interactions to create a searchable history. Initially set for a June launch, it was delayed to October due to privacy and security concerns. To enhance security, Microsoft has implemented an opt-in model, additional encryption, and requires Windows Hello for access. Recall operates mainly within virtualization-based security (VBS) enclaves, which protect data from unauthorized access. Users can customize privacy settings, including excluding applications, deleting snapshots, and managing retention periods. Recall does not capture data from in-private browsing sessions and filters out sensitive information. It does not share data with Microsoft or third parties, although some diagnostic data may be transmitted. Microsoft conducted extensive reviews and testing to ensure Recall's security and reliability.

Winsage

September 28, 2024

Microsoft explains how it’s tackling security and privacy for Recall

Microsoft's Recall feature for Copilot+ AI PCs was designed to help users locate past activities but faced backlash over security concerns related to constant screenshotting of user activity. In response, Microsoft delayed the rollout for Windows Insider beta testers and announced enhanced security measures, making Recall an opt-in feature by default and integrating Windows Hello biometric authentication. The feature will utilize encryption and VBS Enclaves to protect data, and users can opt to remove Recall entirely. Additional protective measures include rate-limiting and anti-hammering strategies, with a fallback PIN method after configuration. Recall will not retain private browsing data by default and will filter sensitive content. Microsoft has engaged a third-party vendor for penetration testing and security design review, while the Microsoft Offensive Research and Security Engineering team has been testing the feature.

Winsage

July 29, 2024

CrowdStrike—How Microsoft Will Protect 8.5 Million Windows Machines

A CrowdStrike update caused the crashing of millions of Windows machines, leading Microsoft to release an analysis of the incident. CrowdStrike identified a bug in its software as the cause and committed to improving its quality assurance processes. Microsoft confirmed that the issue was a read-out-of-bounds memory safety error in the CSagent.sys driver. Microsoft explained the importance of kernel drivers for security products, noting their role in system-wide visibility and performance, but also acknowledged the complexities and risks associated with kernel-level operations. Following the incident, Microsoft proposed four steps to enhance Windows security, including safe rollout guidance, reducing kernel driver access, improving isolation and anti-tampering capabilities, and implementing zero trust approaches.