VMware Workstation Device Credential Guard Incompatibility

Yes, VMware Workstation and Device Credential Guard are not compatible on the same Windows host. When Windows’ Device Guard or Credential Guard (virtualization-based security) is enabled, VMware Workstation cannot start virtual machines and instead shows the well-known error: “VMware Workstation and Device/Credential Guard are not compatible.” This article explains why the conflict happens, how to check whether it affects your system, and what you can do about it.

Background: What Device Credential Guard Is

Device Guard and Credential Guard are Windows security features that use virtualization-based security (VBS) to isolate critical parts of the operating system. Credential Guard protects NTLM password hashes and Kerberos tickets by running them in a separate virtualized environment, so that even if malware gets kernel-level access, it cannot easily steal those credentials. Device Guard uses Hyper-V and code integrity policies to block unsigned or untrusted drivers and executables.

Both features rely on the Windows Hypervisor Platform, which means the Windows hypervisor (Hyper-V) is running underneath the OS. VMware Workstation is a type-2 hypervisor that expects to run on bare metal with full access to the CPU’s virtualization extensions. When Hyper-V is active, VMware Workstation cannot use those extensions directly, causing the incompatibility.

Why the Conflict Happens

VMware Workstation uses hardware virtualization features (Intel VT-x/EPT or AMD-V/RVI) to run guest operating systems. When Windows enables VBS, it takes exclusive control of those features through Hyper-V. VMware Workstation then has no way to reach the hardware virtualization layer, so it falls back to a compatibility mode that does not work with modern 64-bit guests.

The error message appears at VM power-on, not at installation. You can install VMware Workstation fine, but when you try to start a VM, you get the “not compatible” popup. The conflict is not a bug in VMware; it is a fundamental design difference between how Windows uses the CPU and how VMware Workstation expects to use it.

How to Check if Credential Guard Is Running

Before making changes, verify whether Device/Credential Guard is actually enabled on your system. Open PowerShell as Administrator and run:

msinfo32

In the System Summary, look for “Virtualization-based security” and “Credential Guard” lines. If they say “Running” or “Enabled”, that is the cause. You can also run this command in an elevated PowerShell:

Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard

If the output shows SecurityServicesRunning with a value of 2 (Credential Guard) or 1 (Hypervisor Enforced Code Integrity), then it is active.

How to Fix the Incompatibility

You have two main paths: disable the security features, or switch to a hypervisor that coexists with Hyper-V. The right choice depends on whether you need those Windows security features.

Option 1: Disable Device/Credential Guard (Temporary or Permanent)

If you do not need VBS, you can turn it off. The most reliable method is via Group Policy or the registry, then a reboot. Here are the steps:

1. Open the Local Group Policy Editor (gpedit.msc).
2. Go to Computer Configuration → Administrative Templates → System → Device Guard.
3. Double-click Turn On Virtualization Based Security and set it to Disabled.
4. Alternatively, open an elevated Command Prompt and run:

bcdedit /set hypervisorlaunchtype off

This disables the Hyper-V hypervisor at boot. Then reboot. After that, VMware Workstation should work normally. To re-enable later, run bcdedit /set hypervisorlaunchtype auto.

Note that simply turning off Hyper-V in Windows Features may not be enough if Credential Guard is already running. You must also disable the security features and reboot.

Option 2: Use VMware Workstation 15.5.5 or Newer

Starting with Workstation 15.5.5, VMware added support for running alongside Windows Hypervisor Platform (WHP). If you enable WHP in Windows Features, newer VMware Workstation versions can use it as a backend instead of direct hardware virtualization. This allows you to keep Credential Guard enabled.

To enable WHP:

1. Open Control Panel → Programs → Turn Windows features on or off.
2. Check Windows Hypervisor Platform.
3. Reboot.

Then update VMware Workstation to the latest version. The VM should start, though performance may be slightly lower than with native hardware virtualization.

Common Problems and Misconceptions

Many users think the error means they must uninstall VMware or disable Hyper-V entirely. That is not true if you use the WHP approach. Another misconception is that the problem only affects 64-bit guests; in practice, even 32-bit guests may fail because VMware Workstation cannot access the virtualization extensions at all.

A common issue after disabling VBS is that Windows may re-enable it after an update. If you want to keep it off permanently, you may need to disable the relevant services or use the registry. Also, if you are using Windows Sandbox, WSL2, or Hyper-V VMs, disabling the hypervisor will break those features. You cannot have both VMware Workstation (with native virtualization) and Hyper-V-based features at the same time.

Alternatives to VMware Workstation

If you cannot disable VBS and do not want to use WHP, consider other hypervisors that work with Hyper-V:

• Hyper-V itself – Windows built-in hypervisor can run VMs, but it lacks some of VMware’s features like snapshots and USB passthrough.
• VirtualBox – Recent versions also support Hyper-V as a backend, but performance and stability can vary.
• WSL2 – For Linux development, WSL2 runs on Hyper-V and does not conflict.

Each has trade-offs. Hyper-V is free and integrated, but its management interface is less user-friendly than VMware Workstation. VirtualBox is free but may not support all guest features when running on Hyper-V.

How to Choose the Right Solution

Ask yourself two questions:

• Do you need Credential Guard or Device Guard for work or security compliance? If yes, use WHP with VMware Workstation 15.5.5+ or switch to Hyper-V.
• Do you need VMware-specific features like nested virtualization, advanced networking, or broad guest support? If yes, you may need to disable VBS.

For most home users, disabling VBS is safe because Credential Guard mainly benefits enterprise environments with domain-joined machines. For corporate users, check your security policy before disabling.

Frequently Asked Questions

Will uninstalling Hyper-V fix the issue?

Not always. If Credential Guard is running, it will keep the hypervisor active even if you uninstall Hyper-V from Windows Features. You must disable VBS via Group Policy or the registry and reboot.

Does this affect VMware Workstation Player too?

Yes, Workstation Player uses the same virtualization engine and will show the same error. The fixes are identical.

Can I run VMware Workstation and Hyper-V VMs at the same time?

Only if you use WHP with a recent VMware version. Even then, you cannot run both simultaneously; you must stop one before starting the other.

Is there a performance penalty with WHP?

Yes, there can be a slight performance hit compared to native virtualization, but it is usually acceptable for development and testing. The penalty is more noticeable with I/O-heavy workloads.

What if I need Credential Guard for work but also need VMware?

Use the WHP method. If your VMware version is older than 15.5.5, update it. If your company policy forbids disabling VBS, you may need to use Hyper-V instead.

Will a Windows update re-enable Credential Guard?

Occasionally, feature updates may re-enable VBS if it was previously disabled. You can check after major updates and re-apply the registry or policy change if needed.

Related

• Ban or Unban a Player on Core Keeper Server
• Rivals Events Schedule: Dates, Modes & Rewards
• Ease of Access: What It Means & How to Use It