VBS, a.k.a. Isolated User Mode (IUM) provides a new trust boundary for system software. VBS is included with the Enterprise (including LTSB), Education, and IoT Enterprise editions of Windows 10. It leverages platform virtualization to enhance platform security by limiting access to high-value security assets, even from supervisor mode code (CPL). VBS provides a secure execution environment and protects several Windows 10 services such as LSA credential isolation and Kernel Mode Code Integrity (KMCI). On the server OS, it additionally provides a virtual TPM (vTPM). VBS uses the hypervisor to protect a mini kernel and other important parts/services of the OS by enforcing read, write, and execute permissions across system memory.
By separating these services, it enhances the OS protection against kernel-mode attacks and other attacks. Even if malware...