Fix “Virtualized Intel VT-x/EPT (AMD-V/RVI) Is Not Supported on This Platform” in VMware Workstation

Why VMware Workstation can’t expose VT-x/EPT or AMD-V/RVI when Windows VBS/Hyper-V is on, and how to disable it to run nested ESXi.

Short answer: The error means Windows is running its own hypervisor, usually because Virtualization-Based Security (VBS) and memory integrity are on, which is the default on many Windows 10/11 installs. VMware Workstation then runs on the Hyper-V APIs and cannot pass VT-x/EPT or AMD-V/RVI to a guest, so nested ESXi will not power on. Turn off memory integrity, remove the Hyper-V platform features, set hypervisorlaunchtype off, disable VBS, reboot, and confirm VBS shows “Not enabled”.

Why VMware Workstation shows this error

A VM with Virtualize Intel VT-x/EPT or AMD-V/RVI ticked asks Workstation to expose hardware virtualization to the guest. That is required for nested ESXi or Hyper-V inside the VM. Workstation can only do this when it owns the CPU virtualization extensions itself. When Windows boots the Windows hypervisor (for VBS, memory integrity/HVCI, Credential Guard, Hyper-V, WSL2, Windows Sandbox and similar features), Workstation falls back to user-mode operation on top of Hyper-V. In that mode nested virtualization is not available. Broadcom KB 389469 describes the cause and fix.

Typical messages:

  • Virtualized Intel VT-x/EPT is not supported on this platform.
  • Virtualized AMD-V/RVI is not supported on this platform.
  • VMware Workstation and Device/Credential Guard are not compatible.

Check whether VBS or Hyper-V is running

  • msinfo32: at the bottom of System Summary, look at Virtualization-based security. It should read Not enabled.
  • PowerShell (elevated), per Microsoft Learn. VirtualizationBasedSecurityStatus 0 = not enabled, 1 = enabled but not running, 2 = running.
  • vmware.log in the VM folder: search for Monitor Mode. CPL0 means Workstation owns VT-x. ULM means it is running on the Hyper-V APIs.
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
  Select-Object VirtualizationBasedSecurityStatus, SecurityServicesRunning

How to fix it (Windows 10 and 11 host)

Before you start, save your BitLocker recovery key. Changes to boot and security configuration can trigger a recovery prompt.

  1. Open Windows Security > Device security > Core isolation details and turn Memory integrity off.
  2. In Turn Windows features on or off, clear Hyper-V, Virtual Machine Platform, Windows Hypervisor Platform and Windows Sandbox.
  3. From an elevated command prompt, stop the hypervisor from launching at boot and disable VBS (commands below).
  4. Reboot, then confirm in msinfo32 that VBS is Not enabled.
  5. Power on the nested ESXi VM again.
bcdedit /set hypervisorlaunchtype off
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 0 /f

When VBS keeps coming back

  • Group Policy or Intune: Computer Configuration > Administrative Templates > System > Device Guard > Turn On Virtualization Based Security, or the VirtualizationBasedTechnology CSP, will re-enable it. On a managed corporate laptop, ask your security team rather than working around policy.
  • UEFI lock: if memory integrity was enabled with UEFI lock, Microsoft documents that you must go through the UEFI settings (Secure Boot) to turn it off. Registry changes alone will not stick.
  • Dependent features: WSL2, Docker Desktop’s WSL2 backend and Windows Sandbox need the Windows hypervisor. You cannot use them and a nested ESXi VM with virtualized VT-x at the same time.

Nested ESXi on ESXi: expose hardware virtualization

If Workstation (or a nested ESXi) itself runs inside a VM on ESXi, the outer VM needs hardware virtualization exposed. Edit the VM, expand CPU and tick Expose hardware assisted virtualization to the guest OS. Nested ESXi is unsupported by Broadcom and belongs in labs only. For lab sizing ideas, see deploying a minimal VCF 9.0 lab.

Reverting the change

Disabling VBS and memory integrity lowers the host’s protection against kernel-level malware. When you no longer need nested labs, run bcdedit /set hypervisorlaunchtype auto, turn Memory integrity back on in Windows Security, re-add the Windows features you removed, and reboot.

Further reading

Author: Daniel Micanek

Senior Service Architect, SAP/TDL Platform Services Team at Vivicta | vExpert ⭐⭐⭐⭐⭐⭐⭐ | Broadcom Knight: vSphere Kubernetes Service, VCF Networking (NSX), VCF Automation | Broadcom Software Knight: vSphere | Cisco Champion. Notes from running about 1,000 ESXi hosts on Cisco UCS, VCF 9 and SAP HANA on vSphere.