Skip to content

Instantly share code, notes, and snippets.

@avoidik

avoidik/disable-protection.cmd

Created October 18, 2025 19:44
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save avoidik/3978e5a21f2d61e163f382c1822da9b7 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save avoidik/3978e5a21f2d61e163f382c1822da9b7 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. avoidik created this gist Oct 18, 2025.
    29 changes: 29 additions & 0 deletions disable-protection.cmd
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,29 @@
    @echo off

    REM Disable VBS with registry settings

    REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /f
    REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" /v "RequirePlatformSecurityFeatures" /f

    REM Disable Credential Guard with registry settings

    REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" /v "LsaCfgFlags" /t REG_DWORD /d "0" /f
    REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard" /v "LsaCfgFlags" /t REG_DWORD /d "0" /f

    REM Disable Credential Guard with UEFI lock

    mountvol X: /s
    copy %WINDIR%\System32\SecConfig.efi X:\EFI\Microsoft\Boot\SecConfig.efi /Y
    bcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d "DebugTool" /application osloader
    bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} path "\EFI\Microsoft\Boot\SecConfig.efi"
    bcdedit /set {bootmgr} bootsequence {0cb3b571-2f2e-4343-a879-d86a476d7215}
    bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS
    bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X:
    mountvol X: /d

    REM Deactivate VSM and Hyper-V

    bcdedit /set vsmlaunchtype off
    bcdedit /set hypervisorlaunchtype off

    REM Reboot and press F3 twice