Windows-itpro-docs: Requirements incorrectly state that "HVCI and nested virtualization cannot be enabled at the same time"

[conioh]

What the title says.

I'm currently running Windows 10 Enterprise 1809 with Hyper-V and HVCI enabled.
I have a couple of Windows 10 Pro 1809 and Insider 18836 VMs. Nested Virtualization is enabled in all of them and so is HVCI.
A few of those VMs have Hyper-V installed with yet another Windows 10 Pro running inside - it too with nested virtualization and HVCI enabled.

Just for kicks I installed Windows 10 4 levels deep (host => VM 1 => VM 2 => VM3). It wasn't fast, to say the least, but it worked. HVCI included.

What the author probably meant to write was that "HVCI and nested virtualization virtualization products other than Hyper-V cannot be enabled at the same time". This is an obvious corollary of:

1. HVCI is based on Hyper-V and requires Hyper-V running.
2. Hyper-V and other virtualization products (except those that use Windows Hypervisor Platform) cannot be enabled at the same time.

If it's that important you can spell it out explicitly, but please make sure that the conclusion you spell out explicitly is the correct one. HVCI and nested virtualization work just fine.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 1526c4cb-4584-7fc6-e633-a48e13dad7e8
• Version Independent ID: 13a88ed8-f43d-f658-cbe4-d148d5ffaa12
• Content: Enable virtualization-based protection of code integrity
• Content Source: windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md
• Product: w10
• GitHub Login: @brianlic-msft
• Microsoft Alias: justinha

[conioh]

3-levels deep, with HVCI:

[illfated]

Funny scenario, but good point.

[conioh]

Funny scenario, but good point.

Not that funny. Let's say you're developing an anti-malware product and want to make sure your driver works well with HVCI and that it treats Hyper-V VMs properly (for example, if it's installed both inside the VM and on the root partition, it scans the VHDs only from one side and not from both, or whatever other feature you have that's relevant).

Would each and every member of your team use a psychical machine for that? Of course no. They'd all use VMs. So they enable HVCI inside the VMs and nested virtualization so they can run 2nd-level VMs inside their 1st-level VMs, where they test their product.

We need HVCI and nested virtualization to work at the same time, and they do indeed. We just need to documentation to reflect that.

[illfated]

Sure, thanks for describing the practical scenario and implications.
(I did not mean "ha-ha" funny, but something interesting which may put a smile on my face.)

[j0rt3g4]

Notes added on the PR :) #3034

[e0i]

@justinha There is a PR #3034 available for this issue. Kindly review. Thanks.

[j0rt3g4]

@e0i Please follow up this :) thank you!

[illfated]

I guess you mean that you would like to see this issue ticket closed too.
Please note that it may take a couple of days before the change migrates
to the public Docs site, but as long as the OP is aware of this, fair enough.

@e0i : See if you are enabled to use this command:

@officedocsbot close

[e0i]

@officedocsbot close