https://support.microsoft.com/en-us/help/3204980/virtualizat...
https://exoticbaryon.anset.org/2017/09/18/when-virtualbox-wo...
Microsoft pulled an old trick out of their sleeve and implemented a feature, Device Guard, that requires virtualization. And of course it blocks other uses of the virtualization hardware, except, surprise surprise, their own virtualization solution.
D-, does not play well with others.
If your company requires Device Guard you can only use software based virtualization or Hyper-V.
on init, the Hyper-V driver hijacks the running Windows instance, schedules it as the 'root partition', and runs it like just another VM.
unlike 'child partitions', the root partition still has non-virtualized drivers, which run unimpeded by privileged instruction traps.
when a child partition (guest VM) is started, it's scheduled as a peer to the root. its Virtual Processors (VPs) run alongside the root partition's VPs.
when the child partition traps into the hypervisor, or uses one of the enlightened drivers, the hypervisor dispatches a bus request to the root partition, which handles the IRQ using a Virtual Service Provider implemented by the host Windows kernel.
so the hypervisor is kind of a bridge between the host Windows and the child VMs, but the host Windows actually runs as a sort of privileged VM itself, just one with full hardware access and scheduling priority.
* I work for MS, but not on any of these things.
Disclosure: work at Microsoft on the Hyper-V team.