[Bug]: blue screen and restart loop after install in Windows 11 Enterprise

[NotMainstream]

Tools category

Harden Windows Security Module

Does your system meet the requirements?

• [X] Yes, my system meets the requirements 👍

Is your Windows installation genuine?

• [X] Yes, I am using genuine Windows installation. 💯

Please explain the bug

Hello, Thanks for your efforts. All your work looks awesome and seems very thoughtful. Your project was talked about in the GrapheneOS Discord in the Off-Topic room and many are interested in it. Maybe you can join the discussion at some point. I made a VM from Linux using KVM and installed the official .iso from Microsoft for Windows 11 Enterprise, then I have installed all the updates and then installed your script. I have selected YES for all 19 questions. Everything worked perfectly until now, but after the first restart I got blue screen and restart loop. I tried the wizard to repair the startup procedure but with no positive effect. Any idea what I have done wrong ? Regards.

[NotMainstream]

Error: System Thread Exception Not Handled

[HotCakeX]

Hi, thank you, I'll try checking out the conversation on Discord ^^

I think the BSOD is related to your hypervisor, maybe related to vTPM or secure boot implementation of it, the device guard features use UEFI lock that rely on those features. The miscellaneous category increases Early-Launched Antimalware's security by only loading drivers with known good reputation. if a critical driver doesn't have known good reputation then it fails to load and can lead to BSOD. If KVM injects something like that for example to improve interoperability between the 2 OSes then that might also be the cause of the issue.

I use Hyper-V on daily basis and one of my VMs is latest Windows version enterprise edition. My main host OS is pro for workstation, there is no difference between the 2 versions in the applied hardening measures and neither of them BSOD.

I also test everything in Azure VMs since they are totally supported for the hardening measures as well.

Except for the process mitigations (that are heavily and constantly tested), everything else is industry standard and officially supported setting.

My suggestion is trying another hypervisor like Hyper-V or even VMware and see if you can reproduce the issue.

[HotCakeX]

It's been 4 days of no activity, I'm assuming the source of the problem was what I mentioned above, so I'm gonna mark this as resolved.

Please feel free to reopen it if you have more info to add or open new issues for any other problems. thanks

[NotMainstream]

Sorry for not replying in time. Leave it close for now. I actually started to formulate an answer and got lost after multiple restarts in which I've tried to install VirtualBox and register the drivers in Secure Boot but I could not manage to make it work as my host OS it's way to locked down. I also tried Boxes app but the Windows 11 setup says that my VM doesn't meet the hardware requirements for Windows 11.

[HotCakeX]

I just spent the time to install, update and test my module on Virtualbox to prove that there is no bug in the module/script.

Everything successfully works, installed Vbox guest additions too. VMware works too, Hpper-V obviously works. The problem must be on your end. And thanks but i've already checked those other scripts, before even creating this.

[NotMainstream]

Thanks a lot!

[HotCakeX]

You're welcome!

Here are VMware workstation results after shut down and multiple restarts just like in Vbox scenario. VMware tools installed too.