AWS workspaces: Credential Guard/VBS disabled when nested virtualization is enabled
Summary
Added note on automatic disablement of Credential Guard and VBS when nested virtualization is activated due to hardware conflicts.
Security assessment
The evidence line addresses a security weakness: enabling nested virtualization disables critical security features (Credential Guard/VBS), increasing vulnerability to credential theft attacks.
Evidence
+When you enable nested virtualization on a Windows WorkSpace, Credential Guard and VBS are automatically disabled.
Diff
diff --git a/workspaces/latest/adminguide/credential-guard-vbs.md b/workspaces/latest/adminguide/credential-guard-vbs.md index 6b8a30b6f..65b0fbb60 100644 --- a//workspaces/latest/adminguide/credential-guard-vbs.md +++ b//workspaces/latest/adminguide/credential-guard-vbs.md @@ -10,0 +11,4 @@ Windows WorkSpaces can utilize Credential Guard and Virtualization-Based Securit +###### Note + +When you enable nested virtualization on a Windows WorkSpace, Credential Guard and VBS are automatically disabled. This is required because nested virtualization uses the hardware virtualization extensions that VBS relies on. If you need both Credential Guard and nested virtualization, they cannot be enabled on the same WorkSpace simultaneously. For more information, see [Nested virtualization for WorkSpaces Personal](https://docs.aws.amazon.com/workspaces/latest/adminguide/nested-virtualization.html) and [Use nested virtualization to run hypervisors in Amazon EC2 instances](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/amazon-ec2-nested-virtualization.html). +