Microsoft has officially discontinued VBS Enclaves, a virtualization-based security technology that was heavily promoted in mid-2024. The surprise is that the feature launched less than a year ago, yet it has already been removed from Windows 11 23H2 and earlier and from Windows Server 2022. Windows Server 2025 and newer releases, meanwhile, will continue to support it.
What are VBS Enclaves, and why were they once seen as a breakthrough?
VBS Enclaves are an extension of Virtualization-Based Security (VBS), a core Windows 11 technology that runs the operating system inside a secure virtual machine using Microsoft's Hyper-V hypervisor.
The feature lets developers create a memory region that is more secure than the operating system itself, used to store and process sensitive pieces of code inside an application. Dynamic-link libraries (DLLs) can be loaded into the enclave environment to encrypt data or run security tasks without worrying about interference from the OS or exploitation by malware.
Microsoft once called VBS Enclaves a “major step forward in software security,” especially for virtualized environments and enterprise systems.
Why was it discontinued in under 12 months?
Microsoft has not given a clear reason, but according to several experts, the decision to end VBS Enclaves is tied to the following:
- Windows 11's fast development cycle, with a major update every year and many disruptive patches every month.
- Compatibility issues, since VBS Enclaves requires Windows Build 26100.2314 or later, which is beyond version 23H2.
- Maintenance costs, because the feature would have to be kept alive on older platforms that no longer have long-term support.
According to Microsoft's documentation, the feature keeps working until it is fully removed, but it no longer receives development or new updates.
What should businesses do if they depend on VBS Enclaves?
Windows 11 23H2 reaches end of support in November this year, so Microsoft expects users to upgrade to newer versions. For businesses that have deployed security systems built on VBS Enclaves, however, this could cause disruption without careful preparation.
IT admins should therefore:
- Identify which applications use VBS Enclaves.
- Plan an upgrade to Windows 11 Build 26100.2314 or later.
- Consider moving to the Intel SGX API or to the new enclave models Microsoft recommends.
Microsoft's removal of VBS Enclaves from older Windows 11 versions raises many questions about the direction of the operating system. It is a wake-up call for businesses, which need to adapt quickly to the fast update cycle and to Microsoft's habit of abruptly “discontinuing” features in the modern Windows era.
