Uploaded August 2025 | Updated September 2026, 43 minutes ago

---

To benefit from hotpatch updates in your organization, you will first need to enable virtualization-based security, or VBS. VBS enhances Windows security by leveraging virtualization to isolate critical system processes and protect against malware. Watch this quick guide to enabling VBS for multiple devices in your organization using Microsoft Intune.

In this demo, we mention that you can verify that VBS is running on a device using PowerShell. To confirm if VBS is running on your system, you can use the following command:
Get-CimInstance -ClassName Win32_DeviceGuard | Select-Object -ExpandProperty SecurityServicesRunning

If the output includes 2, it indicates that VBS is enabled and running.
If the output is empty or does not include 2, VBS is not running.

Alternatively, you can also check the status with:
(Get-CimInstance -ClassName Win32_DeviceGuard).VirtualizationBasedSecurityStatus

A value of 1 means VBS is enabled.
A value of 0 means VBS is not enabled.

These commands provide a quick and reliable way to verify the VBS status on your Windows system.

For more information on enabling VBS at scale, visit https://aka.ms/EnableVBSAtScale