What does Windows error code 4560 (ERROR_VSM_NOT_INITIALIZED) mean?

ERROR_VSM_NOT_INITIALIZED

Virtual Secure Mode (VSM) is not initialized. The hypervisor or VSM may not be present or enabled.

ERROR_VSM_NOT_INITIALIZED is Win32 error 4560 (0x11D0) and belongs to Virtual Secure Mode readiness.

Where the result appears

• A driver or security feature requesting VSM-protected services.
• Credential Guard or memory-integrity initialization.
• A virtual machine expecting guest VSM.
• Boot after firmware, hypervisor, or BCD changes.

Likely causes

• the hypervisor is absent or disabled.
• vBS policy is enabled but required firmware features are unavailable.
• the VM does not expose nested virtualization or guest VSM.
• boot configuration prevented the secure environment from starting.

Troubleshooting steps

• Record System Information VBS status.
• Record hypervisor and Secure Boot configuration.
• Record Device Guard and CodeIntegrity events.
• Record firmware virtualization settings.
• Record VM generation and nested-virtualization capabilities.

What to verify

Verify whether the hypervisor is absent or disabled. Check System Information VBS status together with hypervisor and Secure Boot configuration.

Handling, retry, and recovery

Restore the supported VBS prerequisites, reboot, and verify that VSM is running before enabling dependent features. Applications should detect capability rather than assuming VSM exists.

Difference from nearby codes

DMA_PROTECTION_NOT_IN_USE means VSM may exist but DMA is not isolated; NOT_INITIALIZED says the secure mode itself is unavailable.

Practical example

A VM image with Credential Guard is moved to a host without guest VSM support.

References

• Microsoft: System Error Codes (4000–5999) — reference for error 4560.
• Microsoft: Virtual Secure Mode — reference for error 4560.
• Microsoft: Kernel DMA Protection — reference for error 4560.