Enable Virtualization-Based Security in Mandatory mode

This policy enables the Virtualization-Based Security (VBS) function in Mandatory mode. Mandatory mode is a new functionality introduced to prevent the Windows Downdate attack (and other related downgrading attacks) by forcing the verification of the components of the Secure Kernel and the hypervisor at boot time. Consequently, enabling this functionality can lead to boot failure (and a denial of service) in case of a modification of a core component of the Secure Kernel, hypervisor, or a related dependent module. NOTE: if you already have Virtualization-Based Security enabled with UEFI Lock, this setting will not do anything, as the VBS configuration is already written and locked in a UEFI variable. This variable needs to be deleted using the bcdedit.exe tool before deploying the Mandatory flag and the UEFI Lock. Guidance and more information about this procedure are available here: https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/configure?tabs=reg#disable-virtualization-based-security Enabling this policy will set the Mandatory flag and force the verification of the VBS components at boot time. Enabling this policy with UEFI Lock already enabled will have no effect. Disabling this policy will disable the verification of the components, only if the UEFI Lock is not enabled. Otherwise, disabling this policy will do nothing.