Some results from a very quick test using Hyper-V on a Windows 10 v21H1 x64 host w/ VBS enabled. All testing was performed in a Generation 2 VM with a fresh Windows 10 v21H1 x64 installation:
- Enabling VBS (aka. Core Isolation) worked with no additional changes. All that was required was enabling Core Isolation via the Windows Security app and rebooting for the requisite Windows support to be installed and enabled. I've attached a screenshot from System Information post-reboot showing VBS enabled in the VM.
- Nested virtualisation also works with a few extra steps. These are documented by Microsoft here. To summarise, you need to enable nested virtualisation for the (outer) VM, disable dynamic memory for the (outer) VM, and enable Hyper-V in the (inner) VM. I was then able to launch a Hyper-V VM inside the guest VM.
So to summarise, it clearly is possible under Hyper-V to use both VBS enabled VMs and nested virtualisation (inc. simultaneously), including on hosts which themselves have VBS enabled. It being technically possible, the next question is does Microsoft expose the necessary public APIs for 3rd-parties to leverage these configurations?
Is anyone from VMware able to comment if such support is on the development roadmap and if there are any major blockers to adding it?
