Hello,
i have a Windows Server VM and for security reasons i want to use VBS and Code Integrity with UEFI Lock
https://learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity?tabs=reg
I set the lock with powershell, but unfortunately it is not working. Using the GUI i can not disable "code integrity", but it is easily possiby by editing registry with regedit. You can change value to 0 and GUI allows disabling. reason is because the VM can not write to UEFI. With a real uefi Lock it should not be possible to deactivate the security features with windows tools.
I think VMWare UEFI is just a rudimentary implementation of uefi with minimal featureset and therefore not writable.
Do you agree or did i miss something? In this case it would be very useful to create a uefi-based security socket which can not be detached even by local administrator.
Thanks,
Hans