Side channel mitigations in VMware Workstation: what it means and how to disable it

Applies to: VMware Workstation Pro 15.5.5 and later on Windows 10 and Windows 11 hosts. Fusion on a Mac has a similar setting under Virtual Machine > Settings > Advanced.

Why VMware shows this message

Only one hypervisor can control the processor’s virtualization features (Intel VT-x or AMD-V) at a time. When Windows starts its own hypervisor for Hyper-V, WSL 2, Windows Sandbox or Memory integrity, older Workstation versions simply couldn’t start VMs. Since version 15.5.5, released in May 2020, Workstation handles this by switching to a User Level Monitor that runs the VM through Microsoft’s Windows Hypervisor Platform instead of using VT-x directly. VMware’s release notes list Windows 10 version 2004 (build 19041.264) or newer as the minimum for this mode.

In this mode Workstation turns on side channel mitigations: processor features such as indirect branch prediction barriers and L1 data cache flushing that block Spectre- and Meltdown-class attacks, where code in one context tries to read memory it shouldn’t. Broadcom’s knowledge base says these mitigations are the likely cause when such VMs run slowly. The message is a heads-up, not an error: the VM works, just with that overhead.

Many people see it without ever installing Hyper-V. Memory integrity (core isolation) also starts the Windows hypervisor, and Broadcom says Windows 11 version 24H2 turns VBS on by default, which is why the message often appears after that upgrade.

Check which mode your VM runs in

• Press Win + R, type msinfo32 and press Enter. At the bottom of System Summary, A hypervisor has been detected means the Windows hypervisor is running, and Virtualization-based security shows whether VBS is running.
• In the VM’s folder, open vmware.log in Notepad and search for Monitor Mode. CPL0 is the normal, fastest mode; ULM means the VM is running through the Windows hypervisor and the mitigations apply.
• Workstation 25H2 and later also show whether a VM runs in Hyper-V/WHP mode, according to Broadcom.

Which fix to choose

Your situation	Best option
You need WSL 2, Docker Desktop, Windows Sandbox or Hyper-V VMs	Keep the hypervisor and disable the mitigations per VM (Option 1)
The VM runs software you don’t trust, such as malware samples or unknown downloads	Keep the mitigations on and accept the slowdown
You want VMware at full speed and don’t need the features above	Turn off the Windows hypervisor (Option 2)
It’s a work PC with Credential Guard or settings managed by your organization	Leave the security settings alone and ask your IT team

Option 1 is the smallest change: it affects only the VM you pick, and you can switch it back at any time. It doesn’t remove the protections Windows applies to the host itself. What you give up is VMware’s extra isolation for that VM, which matters most when the guest runs untrusted code.

Option 1: Disable the mitigations for one VM

1. Shut down the virtual machine from inside the guest. Broadcom’s steps start with the VM powered off.
2. In Workstation, select the VM and open VM > Settings.
3. Go to the Options tab and select Advanced.
4. Tick Disable side channel mitigations for Hyper-V enabled hosts and click OK.
5. Power on the VM. The message no longer appears for it.

The checkbox is meant for hosts where the Windows hypervisor is active. Broadcom’s article documents it for Workstation 15 and 16, and it is still in the same place in Workstation 17. Repeat it for each VM that feels slow. If a VM won’t power on in this mode at all, check Hardware > Processors in its settings: VMware notes that Virtualize CPU performance counters isn’t supported with Hyper-V and has to be off.

If you use the old Workstation Player

Workstation Player has no checkbox, and Broadcom says the setting doesn’t apply to it. Player was discontinued in 2024, when Workstation Pro became free for personal use, so the simplest fix is to install the current Workstation Pro, which opens your existing VMs and has the checkbox.

If you have to stay on Player, community guides add this line to the VM’s .vmx file while the VM is off and Player is closed:

ulm.disableMitigations = "TRUE"

Broadcom doesn’t document this key, so treat it as unofficial and back up the .vmx file before editing it. The file sits in the VM’s folder next to its virtual disks.

Option 2: Turn off the Windows hypervisor

This lets Workstation use VT-x or AMD-V directly again, so the User Level Monitor and its mitigations aren’t used at all. It follows the steps in Broadcom’s and Microsoft’s articles. Before you start, note what stops working: WSL 2, Windows Sandbox, Hyper-V VMs and tools built on them, such as Docker Desktop with the WSL 2 or Hyper-V backend, plus the Memory integrity protection.

1. Open Windows Security > Device security > Core isolation details and turn Memory integrity off. Restart when asked.
2. Press Win + R, run optionalfeatures and clear Hyper-V, Virtual Machine Platform, Windows Hypervisor Platform and Windows Sandbox (whichever are listed; Windows Home has no Hyper-V entry). Click OK.
3. Open an elevated Command Prompt and run the command below, then restart.

bcdedit /set hypervisorlaunchtype off

Check msinfo32 again: the hypervisor line should be gone, and new vmware.log files should show CPL0. To undo it later, turn the features back on and run bcdedit /set hypervisorlaunchtype auto.

If the hypervisor still starts, Credential Guard or a VBS policy may be enabling it. Microsoft’s article lists both as features that must also be off; on a work PC these are usually set by your organization, so don’t change them yourself. The same Windows hypervisor conflict also affects VirtualBox, covered in Not in a hypervisor partition (HVP=0).

Related guides

• Not in a Hypervisor Partition (HVP=0): How to Fix the VirtualBox Error on Windows
• Install VMware Tools greyed out: 6 ways to fix it
• Failed to open a session for the virtual machine: VirtualBox fixes
• How to open Command Prompt as administrator in Windows 11 and 10

Official sources:

• Broadcom KB 315649: VMs with side channel mitigations enabled may exhibit performance degradation
• Broadcom KB 417896: Workstation VM performance after upgrading to Windows 11 24H2
• Microsoft Learn: Virtualization applications don’t work together with Hyper-V