Windows 10 host where Credential Guard or Device Guard is enabled fails when running Workstation (2146361)

To disable Device Guard or Credential Guard on Itanium based computers:

1. Disable the group policy setting that was used to enable Credential Guard.
   
   
   1. On the host operating system, click Start > Run, type gpedit.msc, and click Ok. The Local group Policy Editor opens.
   2. Go to Local Computer Policy > Computer Configuration > Administrative Templates > System > Device Guard > Turn on Virtualization Based Security.
   3. Select Disabled.
      
      
2. Go to Control Panel > Uninstall a Program > Turn Windows features on or off to turn off Hyper-V.
3. Select Do not restart.
4. Delete the related EFI variables by launching a command prompt on the host machine using an Administrator account and run these commands:
   
   mountvol X: /s
   copy %WINDIR%System32SecConfig.efi X:EFIMicrosoftBootSecConfig.efi /Y
   bcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d "DebugTool" /application osloader
   bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} path "EFIMicrosoftBootSecConfig.efi"
   bcdedit /set {bootmgr} bootsequence {0cb3b571-2f2e-4343-a879-d86a476d7215}
   bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS
   bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X:
   mountvol X: /d
   
   Note: Ensure X is an unused drive, else change to another drive.
   
   
5. Restart the host.
6. Accept the prompt on the boot screen to disable Device Guard or Credential Guard.

 

If you have a machine with Legacy BIOS boot:

1. Open the command prompt as Administrator on host.
2. Run this command:
   
   bcdedit /set hypervisorlaunchtype off
   
   
3. Reboot the host.

Note: To find EFI or BIOS type msinfo32.exe in the Run tab.

 

https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2146361