7

I'm trying to run a VMWare VM on my windows 10 device, but am getting an error that it is not compatible with Device Guard. I was directed to this page: https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2146361

What are the instructions there actually doing?

mountvol X: /s
copy %WINDIR%\System32\SecConfig.efi X:\EFI\Microsoft\Boot\SecConfig.efi /Y
bcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d "DebugTool" /application osloader
bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} path "\EFI\Microsoft\Boot\SecConfig.efi"
bcdedit /set {bootmgr} bootsequence {0cb3b571-2f2e-4343-a879-d86a476d7215}
bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS
bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X:
mountvol X: /d

Note: Ensure X is an unused drive, otherwise change to another drive.

11

mountvol X: /s

Mounts the EFI system partition on to Drive X:

copy %WINDIR%\System32\SecConfig.efi X:\EFI\Microsoft\Boot\SecConfig.efi /Y

Copies the C:\Windows\System32\SecConfig.efi to X:\EFI\Microsoft\Boot\SecConfig.efi overwriting the file if it exists. This file is the boot image for windows' security configuration tool.

bcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d "DebugTool" /application osloader

Creates a new option in the boot menu called "DebugTool" with the ID {0cb3b571-2f2e-4343-a879-d86a476d7215}

bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} path "\EFI\Microsoft\Boot\SecConfig.efi"

Sets the boot option you created to boot to \EFI\Microsoft\Boot\SecConfig.efi

bcdedit /set {bootmgr} bootsequence {0cb3b571-2f2e-4343-a879-d86a476d7215}

Tells the boot manager to make the new entry the default for the next reboot, after that reboot it should go back to normal boot.

bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS

Tells the bootloader to pass the options DISABLE-LSA-ISO,DISABLE-VBS to the efi file when it launches the file.

bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X:

Sets the partition for the booted drive to the X: drive.

mountvol X: /d

Unmounts the X Drive.

Now when you next reboot your computer it should restart with the "Debug Tool" option, every reboot after that should boot back in to normal windows.

  • Thanks! So if I want, I can boot to a configuration that still had the Device Guard enabled(I would still need to enable it in GPEDIT)? Additionally, when they say that I should use an unused drive, does this mean a blank drive or a drive not used by windows? – Douglas Gaskell Sep 15 '16 at 18:24
  • you would turn it off and on by going in to "DebugTool" in the boot menu. When it says a unused drive it just means a letter that is not currently mapped by windows. – Scott Chamberlain Sep 15 '16 at 21:44
  • This helps to figure out how to set it all back. Thanks. – Tatiana Racheva Oct 15 '17 at 16:52
  • @TatianaRacheva if you want to remove it all you need to do is bcdedit /delete {0cb3b571-2f2e-4343-a879-d86a476d7215} – Scott Chamberlain Oct 16 '17 at 13:30
  • I don't remember if I figured out to delete that or not, but my system is back to normal :D – Tatiana Racheva Dec 7 '17 at 21:15

protected by Community May 23 '18 at 1:46

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.