PowerShell: Check Device Guard / VBS Status
Need to check whether Virtualization Based Security (VBS) - the foundation for Device Guard and Credential Guard - is enabled and running? This one-liner pulls it straight from the system.
Prerequisites:
- Privileges: None
- Module: Built-in, no import needed
Quick Command:
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object VirtualizationBasedSecurityStatusExample Output:
VirtualizationBasedSecurityStatus
----------------------------------
0📦
Want all of them at once?
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
How It Works:
- Get-CimInstance queries a dedicated namespace (root\Microsoft\Windows\DeviceGuard) specifically for Device Guard/VBS data - like TPM, this isn't part of the standard root/cimv2 namespace, since it's a specialized security subsystem.
- VirtualizationBasedSecurityStatus returns a numeric status: 0 = not enabled, 1 = enabled but not running, 2 = enabled and running.
- Device Guard and Credential Guard both rely on Virtualization Based Security (VBS) as their underlying technology - this property tells you whether that foundation is active at all, before checking individual features on top of it.