What does Windows error code 4561 (ERROR_VSM_DMA_PROTECTION_NOT_IN_USE) mean?

ERROR_VSM_DMA_PROTECTION_NOT_IN_USE

The hypervisor is not protecting DMA because an IOMMU is not present or not enabled in the BIOS.

ERROR_VSM_DMA_PROTECTION_NOT_IN_USE is Win32 error 4561 (0x11D1) and belongs to VSM and IOMMU DMA isolation.

Where the result appears

• A security feature requiring protected DMA.
• Kernel DMA Protection evaluation.
• VBS initialization on systems with external DMA-capable devices.
• Firmware compliance checks for secured-core configurations.

Likely causes

• no IOMMU or SMMU is present.
• vT-d, AMD-Vi, or equivalent firmware support is disabled.
• devices capable of DMA are not correctly remapped.
• the platform or VM does not expose required DMA isolation.

Troubleshooting steps

• Record Kernel DMA Protection status in System Information.
• Record IOMMU firmware settings and device topology.
• Record VBS and Secure Boot state.
• Record Device Guard hardware readiness events.
• Record dock, Thunderbolt, PCIe, and virtualization configuration.

What to verify

Verify whether no IOMMU or SMMU is present. Check Kernel DMA Protection status in System Information together with IOMMU firmware settings and device topology.

Handling, retry, and recovery

Enable supported IOMMU protection in firmware or move the workload to compliant hardware. Do not claim DMA isolation when Windows explicitly reports it is not in use.

Difference from nearby codes

VSM_NOT_INITIALIZED concerns the secure execution environment as a whole; it narrows the missing protection to DMA remapping.

Practical example

VBS starts on a platform where VT-d is disabled.

References

• Microsoft: System Error Codes (4000–5999) — reference for error 4561.
• Microsoft: Virtual Secure Mode — reference for error 4561.
• Microsoft: Kernel DMA Protection — reference for error 4561.