Microsoft has officially deprecated the VBS Enclaves feature – a virtualization-based security technology that was heavily promoted in mid-2024. Surprisingly, this feature has been out for less than a year, yet it has already been removed from Windows 11 23H2 and older versions and Windows Server 2022. Meanwhile, Windows Server 2025 and newer versions will continue to support it.
What is VBS Enclaves and why was it once considered a breakthrough?
VBS Enclaves is an extension of the Virtualization-Based Security (VBS) mechanism – a core technology in Windows 11 that helps run the operating system inside a secure virtual machine using Microsoft’s Hyper-V hypervisor.
This feature allows for the creation of memory regions that are more secure than the operating system itself, used to store and process sensitive code segments within applications. Dynamic Link Libraries (DLLs) can be loaded into the enclave environment, helping to encrypt or execute security tasks without fear of OS interference or exploitation by malware.
Microsoft once called VBS Enclaves a “major leap in software security,” especially in virtualized environments and enterprise systems.
Why was it deprecated after less than 12 months?
Microsoft has not provided a clear reason, but according to many experts, the deprecation of VBS Enclaves is related to:
- The rapid development cycle of Windows 11, with major updates every year and numerous monthly patches causing disruption.
- Compatibility issues, as VBS Enclaves requires Windows Build 26100.2314 or higher – exceeding the 23H2 version.
- Maintenance costs, due to the need to maintain the feature on older platforms that are no longer supported long-term.
According to Microsoft documentation, this feature will remain functional until it is completely removed, but it will no longer receive new development or updates.
What should businesses do if they rely on VBS Enclaves?
Windows 11 23H2 will reach end of support in November this year, so Microsoft expects users to upgrade to newer versions. However, for businesses currently deploying security systems based on VBS Enclaves, this could cause disruptions if not properly prepared.
Therefore, IT admins should:
- Identify which applications are currently using VBS Enclaves.
- Plan an upgrade to Windows 11 Build 26100.2314 or higher.
- Consider switching to Intel SGX API or the new enclave models proposed by Microsoft.
Microsoft’s removal of the VBS Enclaves feature from older Windows 11 versions raises many questions about the development direction of this operating system. This is a wake-up call for businesses – they need to quickly adapt to the rapid update cycles and sudden “deprecation” policies of Microsoft in the modern Windows era.
