$result = (Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).VirtualizationBasedSecurityStatus

switch ($result) {
  2 {
    Write-Host "Virtualization-Based Security: Enabled and Running"
    exit 0
  }
  1 {
    Write-Host "Virtualization-Based Security: Enabled but Not Running"
    exit 1
  }
  0 {
    Write-Error "Virtualization-Based Security: Disabled"
    exit 1
  }
}