Disabling Memory Integrity and VBS: the real performance gain and the real security cost

Frost LIVESecurityProUndo: YesUpdated Oct 8, 2026View as Markdown

Short answer

Updated Oct 8, 2026

Disabling virtualisation-based security sets EnableVirtualizationBasedSecurity to 0 under SYSTEM\CurrentControlSet\Control\DeviceGuard, and Enabled to 0 under the HypervisorEnforcedCodeIntegrity scenario key. It can return some CPU performance, more on older CPUs, and the gain varies by game. It also removes hypervisor-enforced protection against a real class of attack that uses vulnerable signed drivers to reach the kernel. This is a genuine trade, not a free win.

In the app

Disable VBS / HVCIPRO

Registry

HKLMSYSTEM\CurrentControlSet\Control\DeviceGuard

EnableVirtualizationBasedSecurity10

What the switch writes. Your current value may differ. 2 more changes below.

What it does

Memory Integrity runs Windows' driver code-integrity checks inside a hypervisor-isolated environment, so that even kernel-level code cannot tamper with them. Everything your machine does then runs one layer removed from the hardware.

That isolation has a measurable cost, which is why disabling it shows up in benchmarks.

When it helps, and when it hurts

When it helps

Returns some CPU performance, more on older chips that lack the hardware support Memory Integrity relies on.
Can reduce frame-time variance in CPU-bound games.
Resolves conflicts with a few older utilities that refuse to run alongside it.

When it hurts

You lose protection against the vulnerable-signed-driver attack class, which is actively used in the wild and is how several game-adjacent malware families gain kernel access.
Some anti-cheat systems now prefer or require it turned on.
If the machine handles banking, work accounts or anything you would mind losing, this is a poor trade for a small gain.

What it writes

Exactly what the switch changes, read from the app's source. Switching it off is what the app writes when you turn the tweak off again.

Registry values the switch writes.
Key and value	With the tweak	Switching it off
HKLMSYSTEM\CurrentControlSet\Control\DeviceGuardEnableVirtualizationBasedSecurityStops Windows starting the security hypervisor at boot.	0	1
HKLMSYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrityEnabledDisables Memory Integrity, the code-integrity check that runs inside that hypervisor.	0	1
HKLMSOFTWARE\FrostTweaksPendingHypervisorOffA note the app keeps for itself. Windows doesn't read it, and the tweak doesn't change the hypervisor's boot setting.	1	0

From the app's source (vbsoff.hpp), app 2.0.0, checked Oct 8, 2026.

The same change by hand

You do not need the app for this one. These commands make the changes from the table above. Run them in a Command Prompt opened as administrator, and make a restore point first.

Make the change · CMD

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\FrostTweaks" /v "PendingHypervisorOff" /t REG_DWORD /d 1 /f

Put it back · CMD

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\FrostTweaks" /v "PendingHypervisorOff" /t REG_DWORD /d 0 /f

See what it is set to now · CMD

reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity"

How to undo it

In the app: Yes

Switching it off turns Memory Integrity and virtualization-based security on, even if they were off before.

Set both values back to 1 and reboot, or turn Core Isolation > Memory Integrity back on in Windows Security. Switching it off in Frozen Tweaks sets both values to 1, which turns them on even if they were off before. It is a separate switch: neither game profile and not the one-click run turns it off.

Changing several settings at once? The app's Make a restore point button, on every plan, makes a Windows restore point before you start.

Verdict

Only if the machine is genuinely gaming-only. We list it because pretending the gain does not exist would be dishonest, and we keep it a separate switch because pretending the cost does not exist would be worse.

In the app