param(
[switch] $Force = $false
)
function Find-FreeDriveLetter(){
$reserved="ABCZ".ToCharArray()
$drvlist=(Get-PSDrive -PSProvider filesystem).Name
foreach ($drvletter in [char[]](65..90)) {
if ($drvletter -notin $reserved -and $drvlist -notcontains $drvletter) {
return "${drvletter}:"
}
}
throw "no free, unreserved drive letters"
}
function DisableFeature($FeatureName) {
$Feature = Get-WindowsOptionalFeature -FeatureName $FeatureName -Online
if ($Feature.State -eq 'Disabled') {
Write-Host "$FeatureName is already disabled"
return $true;
}
if ($Feature) {
Disable-WindowsOptionalFeature -FeatureName $FeatureName -Online -NoRestart
}
return $true;
}
function DisableVBS() {
$DeviceGuard = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard
Write-Host "VirtualizationBasedSecurityStatus $($DeviceGuard.VirtualizationBasedSecurityStatus)"
if ($DeviceGuard.VirtualizationBasedSecurityStatus -eq 0) {
Write-Host "VirtualizationBasedSecurityStatus already disabled";
exit 0
}
if (!$Force) {
do {
Write-Host 'Configuration of Windows for TwinCAT - especially Deactivation of Virtualization Based Security (VBS) as part of the DeviceGuard
PLEASE NOTE:
The TwinCAT runtime environment cannot be started within a Hyper-V environment. As soon as a component of the computer uses Hyper-V, only the engineering environment (XAE) can be used on this computer, but not the runtime environment (XAR).
In addition to software solutions for virtual machines, Hyper-V can also be used by operating system tools (Device Guard, Credential Guard, VBS,...) or other Hyper-V programs.
Further Information about TwinCAT requirements: https://infosys.beckhoff.com/english.php?content=../content/1033/tc3_overview/6162419083.html
WARNING:
This script helps to configure the system accordingly and will disable VBS, which are critical for protecting your system against advanced threats.
Consultation required: Please consult with your IT department or the end customer before proceeding to ensure this action
aligns with security policies.
PROCEED WITH CAUTION:
Understand the risks and seek guidance if necessary. By continuing, you accept responsibility for these changes.'
$Confirm = Read-Host -Prompt "Do you want to disable Virtualization Based Security [y/n]"
if ($Confirm -eq 'n') {
exit 1
}
} while($Confirm -ne 'y')
}
# Feature which require a disable
foreach ($Feature in @('Containers-DisposableClientVM', 'Microsoft-Hyper-V', 'VirtualMachinePlatform', 'Windows-Defender-ApplicationGuard')) {
if (!(DisableFeature $Feature)) {
Write-Host "Abort the process"
exit 1
}
}
# Disable VBS via registry
New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" -Force | Out-Null
New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" `
-Name "EnableVirtualizationBasedSecurity" `
-PropertyType DWORD `
-Value 0 `
-Force | Out-Null
# Disable VBS when UEFI lock might be set
$FreeDrive = Find-FreeDriveLetter
& mountvol $FreeDrive /s
try {
Copy-Item 'C:\Windows\System32\SecConfig.efi' "$FreeDrive\EFI\Microsoft\Boot\SecConfig.efi" -Force
& bcdedit /create { 0cb3b571-2f2e-4343-a879-d86a476d7215 } /d "DisableVBS" /application osloader
& bcdedit /set { 0cb3b571-2f2e-4343-a879-d86a476d7215 } path '\EFI\Microsoft\Boot\SecConfig.efi'
& bcdedit /set { bootmgr } bootsequence { 0cb3b571-2f2e-4343-a879-d86a476d7215 }
& bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS
& bcdedit /set vsmlaunchtype off
& bcdedit /set { 0cb3b571-2f2e-4343-a879-d86a476d7215 } device partition=$FreeDrive
}
finally {
& mountvol $FreeDrive /d
}
# Disable Core Isolation
New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" -Force | Out-Null
New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" `
-Name "Enabled" `
-PropertyType DWORD `
-Value 0 `
-Force | Out-Null
}
DisableVBS
Write-Host "Please restart your PC"
