VirtualBox VERR_VMX_NO_VMX

How to enable 64bit guest support

...while keeping following components installed! In your case the procedure could be shorter. Just omit the steps not relevant to your setup.

• Intel 6th gen processor (Skylake). i5-6300U in my case (on 8th gen this is not an issue anymore)
• Win10 1703 (Build 15063.1631)
• UEFI Secure Boot
• Bitlocker
• TrendMicro OfficeScan antivirus (This one is actually not conflicting anymore)
• VirtualBox 6.0.4
• Hyper-V

Related errors

• "VT-x is not available" VERR_VMX_NO_VMX
• VERR_SUPDRV_NO_RAW_MODE_HYPER_V_ROOT
• seeing just 32bit OS versions in "new machine" wizard dialog

The culprit is Virtualization Based Security (VBS), which uses Windows embedded virtualization hypervisor (which doesn't conflict with HyperV). This how-to does not describe, how to run Hyper-V and VirtualBox simultaneously, nor how to run VirtualBox on top of Hyper-V hypervisor (as stated in Changelog 6.0.0), according to the Forum, this does not work on Win10 1703.

You will be able to switch between HyperV and VBS working versus VirtualBox requiring a reboot.

Remark: If you use BitLocker, have prepared your recovery key on a paper beforehand! :-] It shouldn't be required though. Control Panel -> BitLocker -> Backup Recovery Key

Here's the how-to:

1. Temporarily suspend BitLocker (=without decryption) - this means till next reboot
2. Reboot, enter BIOS, (check VT-x is turned on), disable Secure Boot, save&quit, (BitLocker PIN entry should be omitted)
3. Login to Windows, temporarily suspend BitLocker again
4. Sanity check:
   • Task Manager: Performance: You should see Virtualization Enabled
   • start->msinfo: you should see "System Summary" -> "Device Guard Virtualization Based Security" running
   • VirtualBox should not list Acceleration: "Nested Paging" and "VT-x" in your guest machine's System details page.
5. start->GPedit

   Computer Config > Admin Templates > System > Device Guard > Virtualization Based Security: Disabled
   

6. admin PowerShell: run this official Device Guard Readiness Tool from Microsoft: https://www.microsoft.com/en-us/download/details.aspx?id=53337

   DG_Readiness_Tool_v3.6.ps1 -Disable
   

   The -disable option adds a boot option to disable VBS and sets bootmgr to boot into it once. This is why we turned off SecureBoot once and why in turn we needed to suspend BitLocker.
7. In regedit delete the following value

   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\LsaCfgFlags
   

8. admin cmd:

   bcdedit /set hypervisorlaunchtype off
   

   This disables the hypervisor and allows VirtualBox to run.
9. Reboot, enter BIOS, Enable Secure Boot, save&quit, (BitLocker PIN entry is omitted again), (Secure Boot should allow us to boot our newly created correctly signed bootloader)
10. Press F3 to disable Credential Guard, press F3 to disable VBS (You have to be quick! There is like 10s silent time-out!!)
11. Computer reboots, BitLocker should ask you for your PIN, Secure Boot should not be complaining about anything
12. Sanity check:
    • start->msinfo: you should see "Device Guard Virtualization Based Security" not running
    • VirtualBox should now list Acceleration: "Nested Paging" and "VT-x"

Now you can switch between Hyper-V (and VBS running) and VirtualBox by bcdedit /set hypervisorlaunchtype auto and bcdedit /set hypervisorlaunchtype off respectively and rebooting. Don't ask me why VBS is running again despite the GPedit setting when hypervisorlaunchtype is auto - there might be some corporate settings and magic involved. Nevertheless, VirtualBox's VT-x is working :)

I definitely don't recommend leaving VBS turned off, as it could have something to do with Mimikatz / Kekeo protection which is quite an issue nowadays. Let's hope this wourkaround won't be necessary in a near future.