Yeah, I know—this one's a nasty surprise. You're just trying to boot into Windows, and you get that smug blue screen with STATUS_DOWNGRADE_DETECTED and error code 0xc0000388. It looks scary, but I've fixed this on more machines than I can count. Let's get you back up.
First, the fix that works 90% of the time
This error means Windows detected that some security feature was running before and now it's not—or vice versa. The most common culprit is Memory Integrity (part of Core Isolation) or Credential Guard. One of them got toggled off or blocked, and Windows decides to throw a fit at boot.
- Boot into Safe Mode. If you can get into Safe Mode, great. If not, you'll need to use the Windows Recovery Environment. Interrupt the boot three times to trigger automatic repair, then go to Troubleshoot > Advanced options > Startup Settings > Restart and press 4 for Safe Mode.
- Once in Safe Mode, open an elevated PowerShell or Command Prompt. Run:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard" /v Enabled /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 0 /f
What this does is disable Virtualization-Based Security and both of its main components—Credential Guard and Hypervisor-protected code integrity (aka Memory Integrity). These are the two things that usually trigger 0xc0000388 when they're half-broken.
- Reboot normally. That alone often clears the error. If it does, you're done. Don't re-enable those features unless you really need them for work.
Why this works
The error message says "a possible attempt to compromise security." That's Windows overreacting. What's actually happening is a mismatch between what the boot configuration expects and what's currently running. When you disable VBS and related features, you remove that expectation, so there's nothing to compare. Windows boots without checking for the security stack.
The reason I jump straight to registry edits instead of telling you to fiddle with Group Policy or Settings is simple: the registry is the ground truth. Settings app sometimes lies or won't let you change things when the system is in a weird state. The registry always works in Safe Mode.
Less common variations and their fixes
If the registry fix didn't work, here's the next batch of suspects. Don't skip these—I've seen all of them in the field.
Secure Boot and firmware settings
Sometimes the error appears after a BIOS update or if you accidentally disabled Secure Boot. Reboot into your UEFI setup (usually Del or F2 during POST) and make sure Secure Boot is set to Windows UEFI mode—not "Other OS." Also check if VT-x/AMD-V is enabled. Without virtualization extensions, VBS can't work, and Windows doesn't handle that gracefully.
Driver signature enforcement
If you've ever disabled driver signature enforcement (maybe to install an old driver) and then forgot, that can trigger this. Boot into Advanced Startup and choose Disable driver signature enforcement. If it boots, you know that's the issue. Then you'll need to update or remove the unsigned driver.
Corrupted boot configuration data (BCD)
Less common, but possible. Rebuild your BCD:
bootrec /fixmbr
bootrec /fixboot
bootrec /rebuildbcd
Run those from a command prompt in the recovery environment. This rarely fixes 0xc0000388 specifically, but it's a good sanity check.
Prevention is better than the cure
Once you're back in, stop this from happening again. Here's what I tell my clients:
- Update your BIOS/chipset drivers. Most of these errors happen after a Windows feature update that conflicts with an old UEFI. Keep firmware current.
- Don't disable Secure Boot or VBS on a whim. If you need to disable them, do it through the proper channels—Settings > Privacy & Security > Windows Security > Device security. Not through random command lines. Unless you're me, and then go ahead.
- Check your drivers. Old, unsigned drivers are the root cause of many security-related BSODs. Use the manufacturer's update tool, not Windows Update, for critical hardware like GPUs and network adapters.
- Take regular System Restore points. I know it sounds old school, but if you can roll back to a known-good state in 10 minutes, you skip the whole Safe Mode dance.
That's it. You should be back up. If you're still stuck after all this, your install might be too far gone—back up your data and do a clean install. It's faster than chasing ghosts.