Hi Declan,
Yes, there is a viable configuration, but it depends on what you need to run inside the VMware Workstation VMs.
Since VMware Workstation 15.5.5 and later, Workstation can run on Windows hosts where Hyper-V/VBS/Credential Guard is enabled by using the Windows Hypervisor Platform (WHP) instead of taking direct control of VT-x/AMD-V. Broadcom documents this behavior, and Workstation 17 supports Hyper-V-enabled Windows hosts.
So with your company GPO enforcing Credential Guard and HVCI/Memory Integrity, you should generally be able to run normal VMware Workstation VMs without disabling those corporate security controls.
The important limitation is nested virtualization.
When Workstation is operating through the Windows Hyper-V/WHP layer, hardware virtualization extensions may not be available for Workstation to expose to the guest. If you enable VM Settings → Processors → Virtualize Intel VT-x/EPT or AMD-V/RVI, the VM may fail with Virtualized Intel VT-x/EPT is not supported on this platform.
Broadcom documents this specifically as a consequence of Windows Hyper-V/VBS owning the hardware virtualization extensions.
Therefore:
- Normal Windows/Linux VMs: should work.
- Nested ESXi: likely problematic/not available in this configuration.
- EVE-NG/GNS3 appliances requiring nested virtualization: may not work as expected.
- Hyper-V/WSL2/VBS inside the VMware guest: requires nested virtualization and is therefore where you'll encounter limitations.
- Performance: may also be lower than when Workstation has direct access to VT-x/AMD-V. Broadcom documents increased CPU/I/O overhead when Workstation runs with Windows VBS/Hyper-V active.
Since Credential Guard and HVCI are enforced by your company's Group Policy, I wouldn't disable them locally as a workaround. Even if you temporarily change the settings, domain policy may restore them, and you'd be bypassing an organizational security control.
First try Workstation 17 with the security controls left enabled and ensure nested virtualization is disabled for the VM.
You can also check vmware.log for Monitor Mode
Broadcom documents CPL0 as direct VMware virtualization and UML as operation through the Windows Hyper-V API.
If your actual requirement is nested ESXi or another workload requiring VT-x/EPT inside the VM, there isn't a clean Workstation setting that bypasses the host's enforced VBS/Credential Guard architecture. You'd need to discuss an exception or an alternative lab environment with your IT/security team.