PC users need to be wary of VBS performance impacts on Win 11

Quote:

---

Virtualization-Based Security is going to be a standard feature on new Windows 11 PCs.

---

Read more.

What frustrates me is there doesn't seem to be an easy way to "except" an application from VBS so it's either an on or off globally. This is quite frustrating because VBS is an exceptional way to isolate and protect applications and kernels and prevent malicious software hopping around and between internal resources on the system.

I would love to enable this software globally but without an easy (or possible) way to go "this software/executable path does not need VBS" then it's completely a non-starter for me.

Again, an excellent feature and push by MS for security but poor execution which will overall harm the user.

Microsoft with a badly executed good idea, well there's a first...

Oh no, wait a minute....

Quote:

---

Originally Posted by [GSV]Trig

Microsoft with a badly executed good idea, well there's a first...

Oh no, wait a minute....

---

I know right xD

Hehe :rolleyes:

Quote:

---

Originally Posted by Tabbykatze

What frustrates me is there doesn't seem to be an easy way to "except" an application from VBS so it's either an on or off globally. This is quite frustrating because VBS is an exceptional way to isolate and protect applications and kernels and prevent malicious software hopping around and between internal resources on the system.

I would love to enable this software globally but without an easy (or possible) way to go "this software/executable path does not need VBS" then it's completely a non-starter for me.

Again, an excellent feature and push by MS for security but poor execution which will overall harm the user.

---

The problem is as soon as you allow exceptions you are allowing a vector for something malicious. You know as soon as there is a dialog to allow exceptions someone will either script it or trick someone into ticking it. I may just be getting old but I've given up on the idea that users can be educated. Most just don't want to know and will click anything.

Quote:

---

Originally Posted by cheesemp

The problem is as soon as you allow exceptions you are allowing a vector for something malicious. You know as soon as there is a dialog to allow exceptions someone will either script it or trick someone into ticking it. I may just be getting old but I've given up on the idea that users can be educated. Most just don't want to know and will click anything.

---

It's the tough balancing act between security and usability and there'll always be ways to circumvent through either automation or tricking a user.

However, a line does have to be drawn and on something like this the usability is impacted without recourse except to wholly disable the security, that is unacceptable.

Quote:

---

Originally Posted by Tabbykatze

However, a line does have to be drawn and on something like this the usability is impacted without recourse except to wholly disable the security, that is unacceptable.

---

There's a question how much usability is actually impacted though. If the performance is degraded less than the performance improvement each generation for GPUs then you could make the case for simply waiting another generation if that performance difference crossed the threshold of usability.

I'd be interested to know what hardware mitigations could be put in place in the future to mostly eliminate the losses though - it sounds like there's a bottleneck somewhere that some acceleration either on the CPU or GPU side might be able to help with.

As Tabbykatze said, not all software/processes require or benefit from VBS, so the 'all or nothing' approach doesn't make a whole lot of sense.

Time to let the early-adopters suss things out on real-world hardware... though the gaming angles could yet turn out to be a storm in a tea-cup, as the latest preview 'clean-installs' in VMWare with the VBS / Memory Integrity feature disabled by default.

Quote:

---

Originally Posted by kalniel

There's a question how much usability is actually impacted though. If the performance is degraded less than the performance improvement each generation for GPUs then you could make the case for simply waiting another generation if that performance difference crossed the threshold of usability.

I'd be interested to know what hardware mitigations could be put in place in the future to mostly eliminate the losses though - it sounds like there's a bottleneck somewhere that some acceleration either on the CPU or GPU side might be able to help with.

---

In our org, we do a lot of deep learning that is mixed between Linux and Windows wherein a lot of interim testing of learning scripts is done on the windows systems and then ported over to Linux (ported, as in transferred, we run in architecture ambiguous methods). If VBS also detrimentally impacts performance for those users, am I going to be in a bad position where VBS will severely impact our ML engineers running Windows meaning I'll have to run part of the business in a heightened security mode versus the other parts in a poor security posture.

I haven't looked into any benchmarking for ML methods and impacts yet but it does depend on how far the impacts extend. Performance becomes a usability impact once it gets over a certain acceptability threshold, something like 1-10% would be "ah well, work with it" but at 10-20% then serious questions start getting asked then if it's over 20% then it becomes a quandry.

I would be interested in seeing if establishments like phoronix, lambda, puget and sisoft see a quantifiable difference between VBS on and off in use cases more than just gaming. I may have a look myself when I have longer than 2 minutes which I spend popping onto Hexus while a spinning loader finishes.

From the article it is not clear if the performance impact of up to 28% in FPS is present on all CPUs or just the ones that do not have the required hardware.
My understanding is that only older hardware will be affected, so not a problem for more modern CPUs.

Quote:

---

Originally Posted by Ballantin

From the article it is not clear if the performance impact of up to 28% in FPS is present on all CPUs or just the ones that do not have the required hardware.
My understanding is that only older hardware will be affected, so not a problem for more modern CPUs.

---

I agree about article clarity, but having followed the links you can find out PCGamer tested on a 10700K Intel chip, so not very old hardware.

Quote:

---

Originally Posted by Tabbykatze

I haven't looked into any benchmarking for ML methods and impacts yet but it does depend on how far the impacts extend. Performance becomes a usability impact once it gets over a certain acceptability threshold, something like 1-10% would be "ah well, work with it" but at 10-20% then serious questions start getting asked then if it's over 20% then it becomes a quandry.

---

And do you need that performance to keep scaling in future years? The slightly dumb question I'm asking is whether a 20% cut of 2022/3's (presumably realistic win11 adoption time) GPU performance would still be an issue, and is it likely that while GPU perf will increase, so will the load you're using it for?

Quote:

---

Originally Posted by Tabbykatze

It's the tough balancing act between security and usability and there'll always be ways to circumvent through either automation or tricking a user.

However, a line does have to be drawn and on something like this the usability is impacted without recourse except to wholly disable the security, that is unacceptable.

---

My guess is that internally, the justification is similar to the justification of UAC. The difference being that the fix for this one might actually be done in hardware (if the impact comes from the GPU rather than CPU)

UAC was very unpopular when it was first introduced and almost everyone hated it. However it was necessary because software was consistently completely unjustifiably requiring administrator privileges to run. The way that has been fixed was to annoy users into annoying the companies that develop the rubbish software that demanded admin privileges.

This is slightly different - it's not that GPU hardware is poorly made, however by forcing it on as default (in certain circumstances) it will get people talking about the impact and how to reduce it.

If it were to be configurable on a per application bases, all the software vendors would do is instruct users on how to disable the feature.

Quote:

---

Originally Posted by Ballantin

From the article it is not clear if the performance impact of up to 28% in FPS is present on all CPUs or just the ones that do not have the required hardware.
My understanding is that only older hardware will be affected, so not a problem for more modern CPUs.

---

If you follow the links in the article to PC Gamer it says they used a 10700K, that's on Microsoft's list for supported processors.

The ComputerBase link apparently translates to Threadripper 3970X, again on the supported processors list.

Ninja edit: beaten to it by kalniel. :)

Quote:

---

Originally Posted by kalniel

And do you need that performance to keep scaling in future years? The slightly dumb question I'm asking is whether a 20% cut of 2022/3's (presumably realistic win11 adoption time) GPU performance would still be an issue, and is it likely that while GPU perf will increase, so will the load you're using it for?

---

My only response to that is that it's not 2022/2023 and talking about potential future performance increase offsetting the current generation decrease is a moot point and pure conjecture at best. Right now, it "could" (because there haven't been any major benchs done) affect our day to day performance in the business. That and if I follow your acumen, I may have to spend up to £30,000 buying equivalent hardware in newer generations just to get the performance back which is untenable. I do get the root of what you're saying that in the years to come the immediate deficit will be offset, but that is years away and I have to deal with the problems in the now first and plan for the future second.

Quote:

---

Originally Posted by badass

My guess is that internally, the justification is similar to the justification of UAC. The difference being that the fix for this one might actually be done in hardware (if the impact comes from the GPU rather than CPU)

UAC was very unpopular when it was first introduced and almost everyone hated it. However it was necessary because software was consistently completely unjustifiably requiring administrator privileges to run. The way that has been fixed was to annoy users into annoying the companies that develop the rubbish software that demanded admin privileges.

This is slightly different - it's not that GPU hardware is poorly made, however by forcing it on as default (in certain circumstances) it will get people talking about the impact and how to reduce it.

If it were to be configurable on a per application bases, all the software vendors would do is instruct users on how to disable the feature.

---

I do agree with your final point that that is where they can go. Similar to software constantly saying "you must disable your AV to allow it to install properly" wherein I look at that kind of request as "my software has been written badly and could be intercepted by your AV or be disrupted by on access scanning and I have not written proper post install checks and validation".

However, I would still generally require the ability to do piecemeal virtualisation because as much as it may be completely invisible to the software, there will be something that breaks because of it by its very nature as being another hurdle between software and OS.

Quote:

---

Originally Posted by Tabbykatze

My only response to that is that it's not 2022/2023 and talking about potential future performance increase offsetting the current generation decrease is a moot point and pure conjecture at best. Right now, it "could" (because there haven't been any major benchs done) affect our day to day performance in the business. That and if I follow your acumen, I may have to spend up to £30,000 buying equivalent hardware in newer generations just to get the performance back which is untenable. I do get the root of what you're saying that in the years to come the immediate deficit will be offset, but that is years away and I have to deal with the problems in the now first and plan for the future second.

---

Well it's more that in the now you don't need to run win 11 I presume, since it's not fully released yet and win 10 will still be supported for some time.

Quote:

---

Originally Posted by kalniel

Well it's more that in the now you don't need to run win 11 I presume, since it's not fully released yet and win 10 will still be supported for some time.

---

Indeed it will be.

Depends on the needs it will be W11 or W10.

Windows 10 had it share of issues too at launch. Ultimately,its prudent to just wait and see especially as we can't say whether Windows 11 will actually have problems with older games too.

Still annoyed at my Skylake/Kabylake laptop not being allowed to run it,especially since it had hardware TPM2 built-in but will move it to Linux in a few years. Problem sorted! ;)

Quote:

---

Originally Posted by Tabbykatze

I do agree with your final point that that is where they can go. Similar to software constantly saying "you must disable your AV to allow it to install properly" wherein I look at that kind of request as "my software has been written badly and could be intercepted by your AV or be disrupted by on access scanning and I have not written proper post install checks and validation".

---

Interesting that one. The other one I see a lot is where the vendor lists the exclusions required. Always entire directories and often so many of them that they might as well say exclude C:\ from scanning.
The problem is simple. Despite every person at the software vendor using and experiencing technology and first hand experiencing how unreliable it generally is, they design and code their software as if everything else is completely reliable. That said, most are also suckers for advertising. I am always reminded of a user that had been told by IT that setting up his iPad was really simple and he could do it himself---------came back at least 10 times asking what to do next. The final visit was him popping in to exclaim "I love the way it JUST WORKS!"

This has a Qubes feel to it.

Notoriously resource intensive.

One good / one bad ...... will the windows trend ever end?

Quote:

---

Originally Posted by Rubarb

One good / one bad ...... will the windows trend ever end?

---

This can still be turned off and the good/bad moniker is normally due to a woefully unstable and unusable aystem.

The good/bad thing is just how bandwagons work - people want to group together under whatever opinion is opposite to the current situation - so W10 is now seen as good so everyone wants to appear knowledgeable and get likes and upvotes by saying W11 is bad without ever having tried it or even knowing how to configure their PC to be offered it.

Quote:

---

Originally Posted by jwsg

The good/bad thing is just how bandwagons work - people want to group together under whatever opinion is opposite to the current situation - so W10 is now seen as good so everyone wants to appear knowledgeable and get likes and upvotes by saying W11 is bad without ever having tried it or even knowing how to configure their PC to be offered it.

---

That's a huge bloody assumption you're making if referencing someone like myself.

Quote:

---

Originally Posted by jwsg

T...so W10 is now seen as good...

---

I wouldn't go that far myself, Windows 10 is only good when compared to Windows 11, and 8 for that matter (IMO). If i was to compare it to Windows 7 it's pretty bad.

Quote:

---

Originally Posted by badass

This is slightly different - it's not that GPU hardware is poorly made, however by forcing it on as default (in certain circumstances) it will get people talking about the impact and how to reduce it.

---

ISTM that games are just an obvious victim of VBS, but I suspect this is a general slowdown of the system under IO like any other virtual workload. I wonder if code that did a lot of file IO would perform badly as well.

Purely guessing but my suspicion is that it would be any graphically intensive workload, based on how GPU passthrough 'works' on Linux. AFAIK Nvidia only recently enabled GPU passthrough on Windows and it's still in beta so there's probably improvements to be made.

Windows 11 seems even less finished than Windows 10 was but i guess they rushed it out the door to catch those back to school sales.

Quote:

---

Originally Posted by DanceswithUnix

ISTM that games are just an obvious victim of VBS, but I suspect this is a general slowdown of the system under IO like any other virtual workload. I wonder if code that did a lot of file IO would perform badly as well.

---

I wonder what the impact would be like if features like VT-d/AMD-Vi and SR-IOV were fully* enabled and used. These are all designed to reduce the performance impact of Virtualisation when dealing with I/O

Also, from personal experience, the performance difference can be absolutely shockingly huge between a Type 1 (bare metal, Like ESXi) hypervisor and a Type 2 Hypervisor like Hyper-V (Which is the tech that VBS is based on)

*fully - as in not just switching on in the BIOS but all of the hardware and software involved supporting the tech.

several of you guys have hit the nail on the head, I would be more than happy to go back to windows 7 if it had the dx support.
Infact even windows 98 with out all the UAC bull was more enjoyable than window 10 or 11.

Windows 11 is the 1st Windows OS since before Vista I have not run at launch,or ran a Beta version to test. It just seems a ton of faff and not even better performance either in its current build.

Quote:

---

Originally Posted by CAT-THE-FIFTH

Windows 11 is the 1st Windows OS since before Vista I have not run at launch,or ran a Beta version to test. It just seems a ton of faff and not even better performance either in its current build.

---

Well I was going to try at least a VM but with those ridiculous hardware requirements don't actually have any hardware which can run it.
Ivy Bridge desktop is a no, the Haswell ThinkPad due have a TPM (but probably too early a version), but still is not allowed to run it.

First time I've seen Windows baulk on hardware requirements in decades.

Quote:

---

Originally Posted by kompukare

Well I was going to try at least a VM but with those ridiculous hardware requirements don't actually have any hardware which can run it.
Ivy Bridge desktop is a no, the Haswell ThinkPad due have a TPM (but probably too early a version), but still is not allowed to run it.

First time I've seen Windows baulk on hardware requirements in decades.

---

My Skylake laptop has TPM2,etc as its Enterprise grade. However,as it still works fine,I have no intention of having to get a new laptop to run Windows 11. I will use the laptop with even Linux,if it does the job. It will get replaced when it falls apart,or when I actually need more processing power. At least replacing parts in a desktop means another person can re-use them,or another system in the home can be upgraded with the older parts.

With laptops I use them as long as possible. All MS is doing is making more unnecessary E-Waste,when low powered Atom CPUs/ARM CPUs can run this fine.

Quote:

---

Originally Posted by CAT-THE-FIFTH

My Skylake laptop has TPM2,etc as its Enterprise grade. However,as it still works fine,I have no intention of having to get a new laptop to run Windows 11. I will use the laptop with even Linux,if it does the job. It will get replaced when it falls apart,or when I actually need more processing power. At least replacing parts in a desktop means another person can re-use them,or another system in the home can be upgraded with the older parts.

With laptops I use them as long as possible. All MS is doing is making more unnecessary E-Waste,when low powered Atom CPUs/ARM CPUs can run this fine.

---

Well, looks like those workarounds AGTDenton discussed on the other threads work with a VM, so I might have a look at least.

Can't see me trying it on real hardware anytime soon though. Currently benchmarks are still all over the place anyhow - though mostly way down.

My Haswell ThinkPad T540p was the last socketed enterprise laptop as Intel went BGA only after Haswell. Spent ages upgrading the screen (think Lenovo changed to maintenance manuals that gen to no longer list the part numbers and only after I started did I realise that the 1080 IPS screens required a different lid, bezel, signal cable and hinge) but doubt I'll every upgrade the CPU for the quad now.

Next time I buy a new (used) laptop it will hopefully have thunderbolt as I keep wanting to try an eGPU.

Quote:

---

Originally Posted by kompukare

Well, looks like those workarounds AGTDenton discussed on the other threads work with a VM, so I might have a look at least.

Can't see me trying it on real hardware anytime soon though. Currently benchmarks are still all over the place anyhow - though mostly way down.

My Haswell ThinkPad T540p was the last socketed enterprise laptop as Intel went BGA only after Haswell. Spent ages upgrading the screen (think Lenovo changed to maintenance manuals that gen to no longer list the part numbers and only after I started did I realise that the 1080 IPS screens required a different lid, bezel, signal cable and hinge) but doubt I'll every upgrade the CPU for the quad now.

Next time I buy a new (used) laptop it will hopefully have thunderbolt as I keep wanting to try an eGPU.

---

The issue is whether Windows updates will work,so might as well stick with Windows 10 for the immediate future. Beware of Thunderbolt - the link speed can vary a lot in laptops,so it can be close to useless!

I bought my laptop used,as I want a semi-ruggedised case,and upgradeable RAM and storage and got a good deal a few years ago. Either way between AMD/Intel/Nvidia all jacking up prices(and trying not to actually compete with each other) and MS trying to force early obsolescene of systems,sort of getting fedup with PC tech now.

PC World's Gordon Ung has now also done some VBS On/off comparative gaming testing.
System used was an "Acer Predator Triton 500 laptop equipped with an 8th-gen Intel Core i7-8750H, 16GB of DDR4, and an Nvidia GeForce RTX 2060 Max-Q GPU".
Ung suggests waiting for more reports and testing before a Windows 11 VBS gaming verdict can be made.

https://b2c-contenthub.com/wp-conten..._11_Gaming.jpg

All the test systems which showed the decreases were using Ampere dGPUs.

Quote:

---

Originally Posted by CAT-THE-FIFTH

All the test systems which showed the decreases were using Ampere dGPUs.

---

Sample size is too small to draw a conclusion yet - most testers happen to be using ampere cards. Once we get some more non-ampere tests in we can start to see if there's a correlation.

This performance hit probably affects more than just games so for me a 28% loss (worst case scenario) of performance could mean another 17mins per hour when rendering....in an average 8 hour day that means I could add another 1.5 HOURS onto my work meaning an 8 hour day now needs a 10 hour day or essentially a 5 day week becomes (metaphorically speaking) a 4 day week.

That's one hell of a hit to productivity and kind of goes against everything MS have been saying about the 'design principles' of windows 11... which might explain why they've basically limited the cpu's to those with mbec hardware so as not to show just had bad a hit this is to pc performance.


Obviously not so much an issue with new cpu's with built in hardware (assuming no change to requirements) but for context I would basically need to go from a 16 core to a 20 core cpu to get the performance loss back...which also means going up to (in most cases) workstation grade cpu's and all the other higher priced components which is not exactly cheap.

Quote:

---

Originally Posted by LSG501

This performance hit probably affects more than just games so for me a 28% loss (worst case scenario) of performance could mean another 17mins per hour when rendering....in an average 8 hour day that means I could add another 1.5 HOURS onto my work meaning an 8 hour day now needs a 10 hour day or essentially a 5 day week becomes (metaphorically speaking) a 4 day week.

That's one hell of a hit to productivity and kind of goes against everything MS have been saying about the 'design principles' of windows 11... which might explain why they've basically limited the cpu's to those with mbec hardware so as not to show just had bad a hit this is to pc performance.


Obviously not so much an issue with new cpu's with built in hardware (assuming no change to requirements) but for context I would basically need to go from a 16 core to a 20 core cpu to get the performance loss back...which also means going up to (in most cases) workstation grade cpu's and all the other higher priced components which is not exactly cheap.

---

Are Microsoft getting seriously into the hardware business?

Maybe this was planned before the current shortages. A few years ago when PC sales were massively down, needlessly forcing upgrades might have gone down a lot better than they will today.

Are Microsoft the first to insist on VBS then? Usually the just mostly copy ideas the Linux kernel has had for ages. To be dependent on something which most installed PCs do not have hardware support for seems very strange.

Quote:

---

Originally Posted by LSG501

This performance hit probably affects more than just games so for me a 28% loss (worst case scenario) of performance could mean another 17mins per hour when rendering....in an average 8 hour day that means I could add another 1.5 HOURS onto my work meaning an 8 hour day now needs a 10 hour day or essentially a 5 day week becomes (metaphorically speaking) a 4 day week.

That's one hell of a hit to productivity and kind of goes against everything MS have been saying about the 'design principles' of windows 11... which might explain why they've basically limited the cpu's to those with mbec hardware so as not to show just had bad a hit this is to pc performance.


Obviously not so much an issue with new cpu's with built in hardware (assuming no change to requirements) but for context I would basically need to go from a 16 core to a 20 core cpu to get the performance loss back...which also means going up to (in most cases) workstation grade cpu's and all the other higher priced components which is not exactly cheap.

---

We don't yet know if the hit is more CPU or GPU yet. Also every other site could not get this 28% performance hit. They varied between 0% and 10%.

What would be useful is to test the performance hit in a CPU limited scenario and in a GPU limited scenario and look at the figures.

Quote:

---

Originally Posted by kalniel

Sample size is too small to draw a conclusion yet - most testers happen to be using ampere cards. Once we get some more non-ampere tests in we can start to see if there's a correlation.

---

It seems interesting to me that this feature is in Windows 10, but no-one seems to have performance tested it there?

Quote:

---

Originally Posted by kompukare

Are Microsoft getting seriously into the hardware business?

Maybe this was planned before the current shortages. A few years ago when PC sales were massively down, needlessly forcing upgrades might have gone down a lot better than they will today.

Are Microsoft the first to insist on VBS then? Usually the just mostly copy ideas the Linux kernel has had for ages. To be dependent on something which most installed PCs do not have hardware support for seems very strange.

---

Not sure but they have been working on custom arm hardware supposedly....I wouldn't put a friendly chat from Intel being out of the question though (especially with the AMD 'issues').

They do however make the majority of their windows money from oem sales, so the cynical side of me says it's a calculated thing with the intent to sell more oem windows by helping sell new pc's by requiring new hardware etc.. to be fair depending on the license you'd likely need (officially) a new license if you need a new cpu (and motherboard) so that's another sale of windows too.

As to linux, not really a linux user but it doesn't seem to have as many 'security' issues as windows so it might not even need this level of 'security'.

Quote:

---

Originally Posted by badass

We don't yet know if the hit is more CPU or GPU yet. Also every other site could not get this 28% performance hit. They varied between 0% and 10%.

What would be useful is to test the performance hit in a CPU limited scenario and in a GPU limited scenario and look at the figures.

---

As I said worst case scenario but it doesn't really matter if it's gpu in my case either because I could easily have the same hit with gpu rendering (cuda) instead of cpu rendering.... 28% drop would basically mean needing to upgrade to a 3090 from a 3070 ti to get the same performance. Even at 10% it's still not exactly great because you'd still need to go up at least one step in the ladder.


The mbec hardware is usually in the cpu so I'd edge more towards the cpu side of things but like you say more testing is needed, and not just in gaming, to really know where the hit is coming from.