> ## Content Index
> Fetch the complete content index at: https://www.filipkonopik.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# PowerShell: Check Device Guard / VBS Status
- URL: https://www.filipkonopik.com/powershell-check-device-guard-vbs-status/
- Published: 2026-07-26T16:52:41.000Z
- Updated: 2026-08-06T05:38:00.000Z
- Author: Filip Konopík
- Tags: Security Hardware

Need to check whether Virtualization Based Security (VBS) - the foundation for Device Guard and Credential Guard - is enabled and running? This one-liner pulls it straight from the system.

Prerequisites:

- Privileges: None
- Module: Built-in, no import needed

Quick Command:

```powershell
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object VirtualizationBasedSecurityStatus
```

Example Output:

```powershell
VirtualizationBasedSecurityStatus
----------------------------------
                                0
```

📦

****Want all of them at once?**  
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.

[Get the Complete Bundle for $39](https://gum.co/u/oczvkqdc?ref=filipkonopik.com)

How It Works:

- Get-CimInstance queries a dedicated namespace (root\\Microsoft\\Windows\\DeviceGuard) specifically for Device Guard/VBS data - like TPM, this isn't part of the standard root/cimv2 namespace, since it's a specialized security subsystem.
- VirtualizationBasedSecurityStatus returns a numeric status: 0 = not enabled, 1 = enabled but not running, 2 = enabled and running.
- Device Guard and Credential Guard both rely on Virtualization Based Security (VBS) as their underlying technology - this property tells you whether that foundation is active at all, before checking individual features on top of it.