I recently purchased a new Laptop, and I immediately noticed some issues, or as Microsoft would call them, “features” baked into the laptop that caused a lot of inconvenience. The three main issues have to do with the “AI” features, and the inclusion of “Virtualization Based Security”, AKA VBS (which is what we’ll refer to it as from hereon), and finally there are potential issues with the defaults for Bitlocker in Windows 11. These are just issues on the more technical side of things, there are plenty of other articles and webpages discussing the general bloat and bad defaults in Windows 11.
Note that some of these issues are only pertinent on certain hardware or to certain people. The AI features that drain system resources primarily seem to be forced on modern computers that have an NPU. Issues with Bitlocker forcing encryption via the TPM only apply to machines with a TPM Chip. The Virtualization Based Security issue also will likely only affect people running specialized software, namely Hypervisors like VirtualBox or VMWare.
This article will hopefully help you overcome some of these issues you may run into with Windows 11, especially if you have a new computer or are switching to Windows 11 as the ESU program for Windows 10 ends in October of this year.
The Problems
AI Features
Most new computers come built-in with a Neural Processing Unit, or NPU which Windows uses to help handle AI tasks. As of the time of publishing, Windows 11 comes baked-in with a bunch of different AI features, things like Recall, which essentially monitors your activity within windows and allows you to go back and search for things you were doing earlier on your PC. From Microsoft,
Recall (preview) was introduced earlier this year, with the ability to enable you to quickly find and jump back into what you have seen before on your PC. You can use an explorable timeline to find the content you remember seeing before.
-“Retrace your steps with Recall” - Microsoft”
This is just one of the main features, other features include AI Search, “Click to Do”, which allows you to select text or images on your screen and plug it into AI to get more information, and a few others. It is worth noting that these AI features, like
The two main issues are privacy and resource usage. Obviously, having a program on your computer, regardless of how “safe” Microsoft claims it to be, that is constantly monitoring your activity can become a major privacy and security risk. As for resource usage, if I recall, I saw about 7-9GB RAM at idle on this new laptop. This forum thread also suggests that the AI features eat up battery as well. Most people aren’t going to care that much about these AI Features, and by disabling them you can definitely recoup some of this. We’ll get to that later on.
Virtualization Based Security & Virtual Machines
This is an issue that is mostly specific to power users and system administrators. Windows 11 has a built-in feature called Virtualization Based Security, or VBS. VBS uses the Windows Hypervisor to virtualize the Windows installation, and by doing to enables the use of multiple security features such as Memory Inegrity. You can read more specifics here. A side-effect of this however, is that, because the Windows Hypervisor utilizes the CPU’s built-in virtualization abilities, virtual machines ran in Hypervisors other than Hyper-V such as VirtualBox or VMWare suffer significant performance issues.
I am not sure what the specific criteria that lead this feature to be enabled by default are, but the main way to verify if it is enabled on your system or not is to open PowerShell, and run
systeminfo
Look towards the bottom of the output, and you should see pertinent information at the bottom that looks like this:
Virtualization-based security: Status: Not enabled App Control for Business policy: Enforced App Control for Business user mode policy: Audit Security Features Enabled: Hyper-V Requirements: A hypervisor has been detected. Features required for Hyper-V will not be displayed.
If either Virtualization Based Security is listed to be enabled, or you see the line “A hypervisor has been detected.” on your system, you will run into issues with VirtualBox or VMWare. It seems as though Microsoft has changed the way to disable these functions throughout different versions of Windows 10 & 11, but I will go through some methods later on in this article.
Bitlocker & TPM Defaults
Bitlocker is a tool that comes included with Windows 11 (&10) that allows you to encrypt hard drives, including your main OS drive for security. Without this feature, all of the data on your hard drive can be accessed by anyone with physical access to the machine, with or without a Windows account password. Needless to say, this is especially important for Laptops.
If your machine is newer and has a TPM chip, there is a high likelyhood that it is already enabled by default on your machine. One potential issue is the fact that by default Windows will encrypt the drive utilizing your TPM chip. If you do not have a recovery key, you will lose access to your data.
Another issue can be performance. According to this article by Tom’s Hardware, their independent testing revealed SSD performance can drop by up to 45% of workload, plus potentially additional performance hits if you are using an older CPU.
The way I personally prefer to encrypt my data is with a password + recovery key. Bitlocker actually allows you to use multiple methods to unlock your drive, but many of these features are only available through the CLI. In the next section, we will go over how to either setup Bitlocker with a password + recovery key, or how to disable it entirely.
The Workarounds
Disabling AI Features
As mentioned previously, Microsoft has implemented various AI Features into Windows which drain system resources.
Part One: Deleting Copilot
- Open Settings
- Go to Apps > Installed Apps
- Find “Microsoft Copilot 365” and click the “…”
- Click Uninstall and then Uninstall again to confirm.
[Note] This only deletes the frontend for the Copilot Interface. The next part describes disabling the services that run in the background and drain your resources.
[Note] You may wish to uninstall other pre-installed programs such as Teams and OneDrive on your system while you’re here if you do not use these. They can be a nuisance to some users.
Part Two: Disabling the AI Service
The WSAIFabricSvc service is a service that runs in the background, and, if your computer is newer and has an NPU spawns processes called “WorkloadSessionHost”. The service starts with your computer, and by disabling it you will effectively stop any AI services from running, saving you RAM, CPU, NPU, & battery life. To disable this service:
- Open the Run dialog (Windows + R)
- Type “services.msc” and hit Enter
- In the main page, scroll down until you find “WSAIFabricSvc”
- Right click on it, and then click Properties
- Change “Startup Type” from Automatic to Disabled
- Press “Stop” below the “Service Status” line.
- Restart for changes to take effect.
If done successfully, if you have an NPU, it should be idle when viewed in Task Manager > Performance Tab (icon looks like a heart monitor). Under the Processes Tab (icon looks like three blocks), you can search for WorkloadSessionHost and confirm that it is not running as well.
Disabling Virtualization Based Security & Windows Hypervisor
As previously stated, the methods for disabling VBS & the Hypervisor have changed throughout Windows 11 versions and the method listed here may not work in the future. Microsoft appears to have gone out of their way to make this task difficult as they want to force these features as much as possible. These methods may not work on all systems and Windows Updates may still re-enable VBS or the Hypervisor. Here’s the way I have used to disable these features - I will include multiple methods. You may have to use a combination of these methods to disable VBS on your system.
Method One: Opt-Out of VBS
- Download the DG Readiness Tool on Microsoft’s website here.
- Extract the ZIP file to your downloads folder
- Open PowerShell as Administrator
- Run
Set-ExecutionPolicy -ExecutionPolicy remotesigned
- Run
cd C:\Users\YourUserName\Downloads\dgreadiness_v3.6\dgreadiness_v3.6
Replacing this directory with wherever you extracted your folder if you extracted it somewhere else.
- Run
.\DG_Readiness_Tool_v3.6.ps1 -disable
- When prompted, choose “R” to Run Once.
- You should now see
Disabling Hyper-V and IOMMU Disabling Hyper-V and IOMMU successful Please reboot the machine, for settings to be applied.
at the bottom of the output from the program.
- When you reboot, you will be met with a screen asking you to confirm opt-out of Credential Guard and VBS. Press F3 or the Windows Key to confirm both settings.
Method Two: Disable Hypervisor Launch
- Run PowerShell as Administrator
- Run
bcdedit /set hypervisorlaunchtype off
- Reboot for changes to take effect
Method Three: Disabling Memory Integrity
- Open Windows Security
- Go to Device Security
- Go to Core Isolation
- Disable Memory Integrity
- Reboot for changes to take effect.
Method Four: Disable any Optional Features using the Hypervisor
- Open the Run dialog (Windows + R)
- Run optionalfeatures.exe
- Disable the following features, if enabled: Hyper-V, Virtual Machine Platform, Windows Hypervisor Platform, Windows Subsystem for Linux
- Reboot for changes to take effect.
Method Five: Disable Virtualization in BIOS and re-enable (Unconfirmed)
- Boot into your computer’s BIOS
- Disable Virtualization tools (Intel VT-x/AMD-V)
- Reboot and check status via Command Prompt > systeminfo
You may still have to search around online for the most up-to-date information on this topic if the above methods do not work. I recommend looking around or asking on Eleven Forum.
Bitlocker - Setup or Disable
As we talked about, Bitlocker is enabled on many systems by default for the main OS drive. Once again, this protects your device in case anyone gains physical access to it and prevents them from getting your files and information. You may wish to disable Bitlocker entirely or configure it to use a Password & Recovery Key instead of the TPM. The recovery key is a way to get back into your system if your motherboard fails (if encrypted via TPM), or you forget your encryption password.
Checking your Bitlocker Status:
- Press the Windows Key and Search “Bitlocker”
- Click on “Manage Bitlocker”
- You will see your C: drive and it’s protection status.
If the status is disabled and you wish to enable it….
- Click “Turn On Bitlocker”
If your system has a TPM, you will initially only have the option to configure it using a TPM & Recovery Key. This should be fine for most people, just make sure you save a backup of your recovery key in case anything happens to your machine. You will have the option of saving it to a drive, Microsoft Account, or printing a copy. The wizard will walk you through the rest of the process.
If the status is enabled and you wish to disable it
- Click on “Turn off Bitlocker”
If the status is enabled and you wish to get a copy of your recovery key:
- Click “Back up your recovery key”
To setup Bitlocker with Password + Recovery Key and NOT use TPM:
- Make sure you have a USB Drive handy to save the recovery key to, and insert it into your computer.
- Open the Run dialog (Windows + R)
- Run gpedit.msc
- Navigate to Computer Configuration > Administrative Templates > Windows Components > Bitlocker Drive Encryption > Operating System Drives
- Click on Require additional authentication at Startup
- Set to Enabled
- Under Options, check the box for “Allow Bitlocker without a compatible TPM”
- Under “Settings for computers with a TPM”, make sure all the options are set to Allow
- Press Apply and close out of Group Policy Editor
- Open PowerShell as Administrator
- Run
manage-bde -on C: -pw -rk E:
Replace E: with the drive letter of the USB Disk you will be saving the recovery key to. Once you hit Enter, you will be prompted to enter a password for the drive & confirm. Keep the USB Drive with the recovery key in the machine and reboot. Don’t worry, you will only need to keep the USB Drive inserted this one time only so Bitlocker can verify it works. You will be asked to enter your password whenever you boot up the machine from now on.
Once you boot back into Windows, the encryption process will begin and you should see a window indicating it’s progress.
[Note] Recovery keys may NOT be stored on the Operating System Drive, regardless of which method is used.
[Note] If you save the recovery key to a USB Drive using the CLI method, it will be stored as a hidden .BEK file on the drive. You will need to enable “Show hidden files, folders, and drives” as well as uncheck the box for “Hide protected operating system files” in Windows Explorer Options to view it.
[Note] If you save the recovery key to a drive using the Manage Bitlocker Screen, your recovery key will be stored as a .txt file.
[Note] If you choose to save your recovery key to your Microsoft Account (using Manage Bitlocker screen), review your Microsoft Account settings and make sure you have a backup email, and a phone number setup on your account. If get locked out of your Microsoft Account, you may be unable to access your Bitlocker key and you will have to contact Microsoft Support for help.
Thanks for reading. The content in this article has been written primarily from my own testing & experience, as well as a bit of internet research including Microsoft Documentation, Eleven Forums & Tom’s Hardware.
If you find anything in this guide does not work, you get stuck, or something is incorrect, please don’t hesitate to leave a comment.
- Mr Brinks