Hot add of CPU or memory not working on domain-joined Windows 11, 22H2 or newer and Windows Server 2025

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

Hot add of CPU or memory will not operate for Windows virtual machines when Virtualization Based Security (VBS) is enabled in the OS

Environment

VMware vSphere ESXi

Cause

Starting with Windows 11 22H2 and Windows Server 2025, Credential Guard is enabled by default on domain-joined, non-DC systems that meet the hardware requirements. This default enablement automatically turns on VBS.

The following features are not supported in a virtual machine when VBS is enabled:

• Fault tolerance
• PCI passthrough
• Hot add of CPU or memory

Resolution

To resolve this issue, power off the virtual machine to make Memory and CPU changes.

Additional Information

For additional details, refer:

• Virtualization-based Security Best Practices 7.x
• Virtualization-based Security Best Practices 8.x
• Virtualization-based Security Best Practices 9.x

Source:

Default enablement of Credential Guard and VBS (Microsoft KB)