Build a practice lab with virtual machines

Every risky step a support technician learns, from a registry edit to a full reinstall, has to be practised somewhere, and a colleague’s laptop is never that place. A lab of virtual machines is: on the Mac this lesson’s examples ran on, 48 GB of memory holds Windows 11, Ubuntu Desktop and Ubuntu Server at the same time with 26 GB to spare, and a mistake in any of them is one snapshot away from undone.

You will choose a hypervisor your own computer can run and tell type 1 from type 2, find copies of Windows and Linux you may legally practise on, set up a Windows 11 VM that meets Microsoft’s requirements, size a lab to its host with a program that checks the plan, and keep every experiment on snapshots and isolated networks.

Type 2 runs on your OS, type 1 runs on the hardware

A virtual machinevirtual machine: A computer made of software: a processor, memory, disks and a network card that a hypervisor presents to an operating system installed inside it, the guest. Its short name is VM. (VM) is a computer made of software: a processor, memory, a disk and a network card that a program presents to an operating system installed inside it, the guest. The program that divides one real computer between several VMs is the hypervisorhypervisor: The software that divides one physical computer between virtual machines, giving each its share of the processor, memory, storage and network..

What sits under the hypervisor decides its kind. A type 2 hypervisortype 2 hypervisor: A hypervisor that runs as an app on a host operating system, also called hosted, such as Oracle VirtualBox or UTM. Its guests share the computer with the host's own programs., also called hosted, is an app on an operating system you already use; Oracle’s manual calls VirtualBox a hosted hypervisor, which needs an existing OS. A type 1 hypervisortype 1 hypervisor: A hypervisor that runs directly on the hardware with no host operating system under it, also called bare metal. Hyper-V is one, even when it is turned on in Windows 11., or bare metal, runs directly on the hardware with no host OS beneath it. Step through both stacks, and follow one disk read through the hosted one:

The hosted stack has one more layer, and that is its price: the guests share the machine with the host’s own programs, so a host that is busy or short of memory slows every guest. The bare-metal stack is what servers usually run, and NIST’s guide adds a security reason, since a hypervisor is much smaller than a whole operating system.

Hyper-V is the case that catches people out. You turn it on as a feature of Windows, so it feels like an app, but Microsoft documents it as a type 1 hypervisor that runs directly on the hardware, with Windows in the root (parent) partition, which creates the guests’ child partitions. CompTIA’s A+ Core 1 objectives (exam 220-1201) list both kinds under virtualization concepts.

Pick the hypervisor your computer can run

The host decides more than any preference does, so look at it first. This session asks the Mac this lesson’s examples ran on what it offers a lab:

from session import run

# What this Mac offers a practice lab: whether Apple's Hypervisor framework is available (1 means yes), the
# processor type that guests must match to be virtualized, and the memory and cores that every VM shares.
run("""
sw_vers
uname -m
sysctl -n kern.hv_support
sysctl hw.memsize hw.ncpu hw.nperflevels
sysctl hw.perflevel0.name hw.perflevel0.physicalcpu hw.perflevel1.name hw.perflevel1.physicalcpu
sysctl -n hw.memsize | awk '{ printf "%d bytes = %d GiB of memory\\n", $1, $1 / 1073741824 }'
""")

$ sw_vers
ProductName:		macOS
ProductVersion:		26.7.1
BuildVersion:		25G241
$ uname -m
arm64
$ sysctl -n kern.hv_support
1
$ sysctl hw.memsize hw.ncpu hw.nperflevels
hw.memsize: 51539607552
hw.ncpu: 18
hw.nperflevels: 2
$ sysctl hw.perflevel0.name hw.perflevel0.physicalcpu hw.perflevel1.name hw.perflevel1.physicalcpu
hw.perflevel0.name: Super
hw.perflevel0.physicalcpu: 6
hw.perflevel1.name: Performance
hw.perflevel1.physicalcpu: 12
$ sysctl -n hw.memsize | awk '{ printf "%d bytes = %d GiB of memory\n", $1, $1 / 1073741824 }'
51539607552 bytes = 48 GiB of memory

kern.hv_support printed 1, which is the check Apple’s documentation for its Hypervisor framework gives: this Mac can run VMs with hardware support. uname -m printed arm64, an Apple silicon processor, and that sets the rule for every guest: UTM’s documentation says virtualization needs the guest’s architecture to match the host’s, so arm64 guests run virtualized, while x86_64 guests are emulated and run far slower. The last line converts the 51,539,607,552 bytes of memory: exactly 48 GiB, shared by every VM and by macOS.

The same three questions decide the choice on any computer. Answer them for yours; each answer rules hypervisors out or adds a caveat, and says why:

In short: UTM on a Mac with Apple silicon; Hyper-V on the Pro, Enterprise and Education editions of Windows 11, the three that Microsoft lists; VirtualBox on Windows 11 Home, where Microsoft says Hyper-V cannot be installed; and on a Linux desktop KVM, which Red Hat describes as letting Linux itself work as the hypervisor, with virt-manager as its window (sudo apt install virt-manager on Ubuntu).

Practice copies you may use, and the terms that come with them

A support lab should run the systems its desk supports, and each has a publisher’s page that says what you may download and on what terms. Four cover most first labs:

Read the terms column before you select Download. Microsoft’s page says what happens when a Windows 11 evaluation is not activated or its 90 days run out: the desktop turns black, a notice says the copy is not genuine, and the PC shuts down every hour. It also cannot be uninstalled from a PC, one more reason to keep it in a VM.

So build the lab to be rebuilt. Keep the ISOs and the runbook outside the VMs, and when an evaluation ends, install a new VM from the same ISO by following the runbook, instead of looking for ways to stretch the clock: the terms you accepted are the licence. One more limit on a Mac: Windows Server 2025 needs an x64 processor, so on Apple silicon it can be emulated but not virtualized.

A Windows 11 VM needs what a Windows 11 PC needs

Windows 11 checks its hardware during setup, and a VM is hardware as far as setup can tell. Microsoft’s requirements page has a section for virtual machines; these are its minimums:

The same page notes that the virtual TPM 2.0 is emulated inside the guest, whatever TPM the Hyper-V host has. For Macs with M1, M2 and M3 chips, Microsoft offers Windows 365 in the cloud and calls Parallels Desktop an authorized way to run Windows 11; UTM’s guide adds that Windows needs a valid licence whichever hypervisor runs it. Each hypervisor keeps the settings in its own place:

In UTM on a Mac with Apple silicon, following UTM’s Windows 11 guide:

1. Download the Arm64 ISO of the Windows 11 Enterprise evaluation.
2. In UTM, select + to open the wizard, then Virtualize, then Windows.
3. Give the VM 4 GB of memory or more and at least 2 CPU cores, which the guide says Windows needs to install.
4. Keep Install Windows 10 or higher and Install drivers and SPICE tools selected, and choose the ISO with Browse.
5. Set the drive size. UTM’s GB is a gibibyte, so 64 there is about 68.7 billion bytes, above Microsoft’s 64 GB (bits, bytes and units explains why); 80 leaves room for updates.
6. Select Save, run the VM, and press a key to start Windows Setup.

In Hyper-V on Windows 11 Pro, Enterprise or Education, following Microsoft’s pages:

1. Turn Hyper-V on: Control Panel, Programs, Programs and Features, Turn Windows features on or off, select Hyper-V, then OK, and restart, or run Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All in an administrator PowerShell.
2. In Hyper-V Manager select New, then Virtual Machine, and choose Generation 2: a generation 1 VM cannot be upgraded to Windows 11 in place.
3. Assign 4 GB or more of startup memory, a lab switch (see the network section) and a virtual disk of 64 GB or more, and install from the ISO as a bootable image file.
4. Secure Boot is already on. For a VM named win11, add the TPM and a second processor in an administrator PowerShell: Set-VMKeyProtector -VMName win11 -NewLocalKeyProtector, Enable-VMTPM -VMName win11 and Set-VMProcessor win11 -Count 2.

In VirtualBox they are all under Settings, System, except the disk size, which you choose when you create the VM; on an Apple silicon Mac the TPM and UEFI settings of an Arm VM are fixed by VirtualBox.

Size the whole lab before you build it

A lab is several VMs sharing one host, and Oracle’s manual warns that memory given to a running VM is not available to the host, which swaps until it all but stops when too little is left. So write the plan down first, in a file a program can check. Here are three such files: a plan for this Mac, a first plan for a 16 GB Windows 11 Home laptop, and that same laptop’s plan after the fixes below.

{
  "host": {"name": "this Mac, Apple silicon, UTM", "arch": "arm64", "memory_gb": 48, "cores": 18},
  "vms": [
    {"name": "win11", "os": "windows-11", "arch": "arm64", "memory_gb": 8, "vcpus": 4, "disk_gb": 80,
     "firmware": "uefi", "secure_boot": true, "tpm": "2.0", "network": "nat"},
    {"name": "desktop", "os": "ubuntu-desktop", "arch": "arm64", "memory_gb": 6, "vcpus": 2, "disk_gb": 40,
     "firmware": "uefi", "secure_boot": true, "tpm": null, "network": "nat"},
    {"name": "server", "os": "ubuntu-server", "arch": "arm64", "memory_gb": 4, "vcpus": 2, "disk_gb": 30,
     "firmware": "uefi", "secure_boot": true, "tpm": null, "network": "host-only"}
  ],
  "run_together": [["win11", "desktop", "server"]]
}

{
  "host": {"name": "a 16 GB Windows 11 Home laptop, VirtualBox", "arch": "x64", "memory_gb": 16, "cores": 8},
  "vms": [
    {"name": "win11", "os": "windows-11", "arch": "x64", "memory_gb": 3, "vcpus": 2, "disk_gb": 64,
     "firmware": "uefi", "secure_boot": true, "tpm": null, "network": "nat"},
    {"name": "desktop", "os": "ubuntu-desktop", "arch": "x64", "memory_gb": 6, "vcpus": 2, "disk_gb": 30,
     "firmware": "uefi", "secure_boot": true, "tpm": null, "network": "nat"},
    {"name": "server", "os": "windows-server-2025", "arch": "x64", "memory_gb": 4, "vcpus": 2, "disk_gb": 40,
     "firmware": "uefi", "secure_boot": true, "tpm": null, "network": "bridged"}
  ],
  "run_together": [["win11", "desktop", "server"]]
}

{
  "host": {"name": "the same laptop, plan fixed", "arch": "x64", "memory_gb": 16, "cores": 8},
  "vms": [
    {"name": "win11", "os": "windows-11", "arch": "x64", "memory_gb": 4, "vcpus": 2, "disk_gb": 64,
     "firmware": "uefi", "secure_boot": true, "tpm": "2.0", "network": "nat-network"},
    {"name": "desktop", "os": "ubuntu-desktop", "arch": "x64", "memory_gb": 6, "vcpus": 2, "disk_gb": 30,
     "firmware": "uefi", "secure_boot": true, "tpm": null, "network": "nat-network"},
    {"name": "server", "os": "windows-server-2025", "arch": "x64", "memory_gb": 4, "vcpus": 2, "disk_gb": 40,
     "firmware": "uefi", "secure_boot": true, "tpm": null, "network": "nat-network"}
  ],
  "run_together": [["win11", "desktop"], ["win11", "server"]]
}

The program below checks every VM in each lab-plan file against its guest’s minimums and the lab’s network rule, then adds up the memory of the VMs that run at once, plus 4 GB kept for the host:

"""Checks every lab-plan-*.json in this folder against each guest's minimums and the lab's own rules."""
import glob
import json

# The minimums of each guest operating system, from its publisher's own page:
#   windows-11: https://learn.microsoft.com/en-us/windows/whats-new/windows-11-requirements ("Virtual machine support")
#   ubuntu-desktop: https://ubuntu.com/download/desktop ("System requirements")
#   ubuntu-server: https://ubuntu.com/server/docs/reference/installation/system-requirements/ (suggested minimums)
#   windows-server-2025: https://learn.microsoft.com/en-us/windows-server/get-started/hardware-requirements
NEEDS = {
    "windows-11": {"memory_gb": 4, "vcpus": 2, "disk_gb": 64, "arch": ["arm64", "x64"],
                   "uefi": True, "secure_boot": True, "tpm": "2.0"},
    "ubuntu-desktop": {"memory_gb": 6, "vcpus": 2, "disk_gb": 25, "arch": ["arm64", "x64"]},
    "ubuntu-server": {"memory_gb": 3, "vcpus": 1, "disk_gb": 25, "arch": ["arm64", "x64"]},
    "windows-server-2025": {"memory_gb": 2, "vcpus": 1, "disk_gb": 32, "arch": ["x64"]},
}
LAB_NETWORKS = ["nat", "nat-network", "host-only", "private"]  # never "bridged": that is the real network
KEEP_FOR_HOST_GB = 4  # left for the host itself: Windows 11's own minimum, used here as a floor


def vm_problems(vm, host):
    """Every way one VM misses its guest's minimums or a lab rule, in a fixed order."""
    need = NEEDS[vm["os"]]
    found = []
    if vm["arch"] not in need["arch"]:
        found.append(f"{vm['os']} has no {vm['arch']} edition")
    elif vm["arch"] != host["arch"]:
        found.append(f"an {vm['arch']} guest on an {host['arch']} host is emulated")
    if vm["memory_gb"] < need["memory_gb"]:
        found.append(f"memory {vm['memory_gb']} GB, the minimum is {need['memory_gb']} GB")
    if vm["vcpus"] < need["vcpus"]:
        found.append(f"{vm['vcpus']} virtual processor, the minimum is {need['vcpus']}")
    if vm["vcpus"] > host["cores"]:
        found.append(f"{vm['vcpus']} virtual processors, the host has {host['cores']} cores")
    if vm["disk_gb"] < need["disk_gb"]:
        found.append(f"disk {vm['disk_gb']} GB, the minimum is {need['disk_gb']} GB")
    if need.get("uefi") and vm["firmware"] != "uefi":
        found.append("needs UEFI firmware (in Hyper-V: generation 2)")
    if need.get("secure_boot") and not vm["secure_boot"]:
        found.append("needs Secure Boot turned on")
    if need.get("tpm") and vm["tpm"] != need["tpm"]:
        found.append(f"needs a virtual TPM {need['tpm']}, the plan has {vm['tpm'] or 'none'}")
    if vm["network"] not in LAB_NETWORKS:
        found.append(f"{vm['network']}: the VM joins the real network")
    return found


def check(name):
    with open(name, encoding="utf-8") as f:
        plan = json.load(f)
    host = plan["host"]
    print(f"{name}: {host['name']}")
    print(f"  host: {host['arch']}, {host['memory_gb']} GB memory, {host['cores']} cores")
    problems = 0
    vms = {vm["name"]: vm for vm in plan["vms"]}
    for vm in plan["vms"]:
        print(f"  {vm['name']}: {vm['os']} {vm['arch']}, {vm['memory_gb']} GB, "
              f"{vm['vcpus']} vCPU, {vm['disk_gb']} GB disk, {vm['network']}")
        for p in vm_problems(vm, host):
            print(f"    - {p}")
            problems += 1
    for together in plan["run_together"]:
        guests = sum(vms[n]["memory_gb"] for n in together)
        used = guests + KEEP_FOR_HOST_GB
        print(f"  at once: {' + '.join(together)}")
        print(f"    {guests} GB of VMs + {KEEP_FOR_HOST_GB} GB for the host = {used} of {host['memory_gb']} GB")
        if used > host["memory_gb"]:
            print(f"    - over by {used - host['memory_gb']} GB")
            problems += 1
    word = "problem" if problems == 1 else "problems"
    print(f"  result: {'ready' if problems == 0 else f'{problems} {word} to fix'}")
    print()


print("Windows 11 VM minimums (Microsoft): 4 GB memory, 2 virtual")
print("processors, 64 GB disk, UEFI, Secure Boot, a virtual TPM 2.0")
print()
for name in sorted(glob.glob("lab-plan-*.json")):
    check(name)

Windows 11 VM minimums (Microsoft): 4 GB memory, 2 virtual
processors, 64 GB disk, UEFI, Secure Boot, a virtual TPM 2.0

lab-plan-1-mac.json: this Mac, Apple silicon, UTM
  host: arm64, 48 GB memory, 18 cores
  win11: windows-11 arm64, 8 GB, 4 vCPU, 80 GB disk, nat
  desktop: ubuntu-desktop arm64, 6 GB, 2 vCPU, 40 GB disk, nat
  server: ubuntu-server arm64, 4 GB, 2 vCPU, 30 GB disk, host-only
  at once: win11 + desktop + server
    18 GB of VMs + 4 GB for the host = 22 of 48 GB
  result: ready

lab-plan-2-laptop.json: a 16 GB Windows 11 Home laptop, VirtualBox
  host: x64, 16 GB memory, 8 cores
  win11: windows-11 x64, 3 GB, 2 vCPU, 64 GB disk, nat
    - memory 3 GB, the minimum is 4 GB
    - needs a virtual TPM 2.0, the plan has none
  desktop: ubuntu-desktop x64, 6 GB, 2 vCPU, 30 GB disk, nat
  server: windows-server-2025 x64, 4 GB, 2 vCPU, 40 GB disk, bridged
    - bridged: the VM joins the real network
  at once: win11 + desktop + server
    13 GB of VMs + 4 GB for the host = 17 of 16 GB
    - over by 1 GB
  result: 4 problems to fix

lab-plan-3-fixed.json: the same laptop, plan fixed
  host: x64, 16 GB memory, 8 cores
  win11: windows-11 x64, 4 GB, 2 vCPU, 64 GB disk, nat-network
  desktop: ubuntu-desktop x64, 6 GB, 2 vCPU, 30 GB disk, nat-network
  server: windows-server-2025 x64, 4 GB, 2 vCPU, 40 GB disk, nat-network
  at once: win11 + desktop
    10 GB of VMs + 4 GB for the host = 14 of 16 GB
  at once: win11 + server
    8 GB of VMs + 4 GB for the host = 12 of 16 GB
  result: ready

The Mac’s plan is ready: three arm64 guests use 18 GB, and with 4 GB for macOS that is 22 of 48 GB. The first plan for a 16 GB Windows 11 Home laptop has four problems: Windows 11 has 3 GB and no virtual TPM, the server sits on a bridged network, and all three VMs at once would need 17 GB. The fixed plan gives Windows 11 its 4 GB and a TPM 2.0, puts the VMs on a NAT network and runs two at a time, never more than 14 of 16 GB. That is the honest answer for a 16 GB laptop: Windows 11 and one other VM at once, not three.

Memory and disks count differently: 51,539,607,552 bytes, the memory this Mac reported, is 48 GiB to the byte, while disks are sold in decimal units and UTM sizes drives in gibibytes, so keep the data storage converter at hand. Leave room on the host’s disk too: the fixed laptop plan’s virtual disks add up to 134 GB before the first snapshot, and Oracle’s manual asks for spare space in the VM folder when you use snapshots.

Take a snapshot before every risky step

A troubleshooting method that holds under pressure puts reversible stepsreversible step: A troubleshooting step that can be undone without losing anything, such as a restart, a disabled startup item or an uninstalled update. Reversible steps come before ones with no way back, such as a reset. More in “A troubleshooting method that holds under pressure” before destructive ones. A snapshotsnapshot: A saved state of a virtual machine, its settings, its disks and, if it was running, its memory, to which the VM can be restored later. Hyper-V calls it a checkpoint. It is not a backup. makes nearly any step in a VM reversible: it records the VM’s settings and the state of its disks at one moment, and its memory too if it was running, so that you can return to that moment. VirtualBox calls them snapshots and Hyper-V calls them checkpoints. Follow the routine around one registry edit:

Three facts keep the routine honest. Restoring is one-way: VirtualBox discards the current state when it restores a snapshot, and Hyper-V’s plain Apply cannot be undone, which is why both let you keep the present state first. A snapshot is not a backup: Microsoft writes that a standard checkpoint “is not a full backup” and can cause data consistency issues in systems that replicate between machines, such as Active Directory. And a snapshot keeps whatever was in the VM, passwords and memory contents included; NIST counts that among the biggest security issues of snapshots.

UTM’s documentation offers two other ways back on the VM’s action menu: Clone, a full copy made before the risky change, and Run without saving changes, a disposable run whose writes are lost at shut-down (QEMU backend only).

Keep the lab off real networks and away from real data

Every VM has a virtual network card, and the hypervisor decides where its cable goes. NIST’s guide names three common ways, bridging, NAT and host-only, and the hypervisors add a private kind. The names differ between products; what each lets through does not:

VirtualBox’s plain NAT puts each VM on a network of its own, so two VMs cannot reach each other; its NAT Network mode adds that, which is why the fixed laptop plan uses it.

Bridged makes a lab part of someone else’s network. Picture a Windows Server VM practising the DHCP role, bridged to the office Wi-Fi. RFC 2131 has every new client broadcast its request on the local network and pick one of the offers that come back, so office laptops can be handed lab addresses by a server meant only for practice. On a NAT, host-only or private network the same server answers lab VMs alone. Use bridged only for a test that needs the real network, with the agreement of whoever runs it.

Machines and data follow the same rule:

• Practise only on VMs and computers that are yours, never on a colleague’s, a customer’s or a production machine.
• Use made-up data: invented names and sample files you wrote, never an export of real users or customers.
• Give lab accounts lab-only passwords that you use nowhere else, and mark them in the runbook as lab-only.
• Keep the ISOs and the runbook outside the VMs, so that a rebuild never depends on a broken VM.

Practise: a checker for Windows 11 VM plans

The program in the sizing section checks whole labs. Write its core yourself: one function that lists every Windows 11 requirement a VM plan misses, in the order of Microsoft’s list. The sample tests include plans at exactly the minimums, so a <= written where < belongs fails at once.

def check_vm(plan):
    """Return the Windows 11 VM requirements that plan misses, in the order of Microsoft's list."""
    unmet = []
    return unmet

from check_vm import check_vm


def plan(**changes):
    """A plan at exactly Windows 11's VM minimums, with the given fields changed."""
    p = {"firmware": "uefi", "disk_gb": 64, "secure_boot": True, "tpm": "2.0", "memory_gb": 4, "vcpus": 2}
    p.update(changes)
    return p


def test_minimums_meet_every_requirement():
    """a plan at exactly the minimums, or above them, misses nothing"""
    assert check_vm(plan()) == []
    assert check_vm(plan(disk_gb=80, memory_gb=8, vcpus=4)) == []


def test_generation_1_plan():
    """BIOS firmware without Secure Boot misses uefi and secure-boot, in that order"""
    assert check_vm(plan(firmware="bios", secure_boot=False)) == ["uefi", "secure-boot"]


def test_disk_below_64():
    """a disk of 63.9 or 60 GB misses storage"""
    assert check_vm(plan(disk_gb=63.9)) == ["storage"]
    assert check_vm(plan(disk_gb=60)) == ["storage"]


def test_tpm_missing_or_old():
    """no virtual TPM, or a TPM 1.2, misses tpm"""
    assert check_vm(plan(tpm=None)) == ["tpm"]
    assert check_vm(plan(tpm="1.2")) == ["tpm"]


def test_memory_and_processors_in_order():
    """2 GB and 1 virtual processor miss memory, then processors"""
    assert check_vm(plan(memory_gb=2, vcpus=1)) == ["memory", "processors"]
    assert check_vm(plan(memory_gb=3.5)) == ["memory"]


def test_everything_missed():
    """a plan that misses all six lists them in the order of Microsoft's page"""
    bad = plan(firmware="bios", disk_gb=32, secure_boot=False, tpm=None, memory_gb=2, vcpus=1)
    before = dict(bad)
    assert check_vm(bad) == ["uefi", "storage", "secure-boot", "tpm", "memory", "processors"]
    assert bad == before

Then work through the self-check on the lesson’s seven ideas. It starts with the one you have answered least well and explains every answer:

Interview questions

Warm-up (fresher): Is Hyper-V on a Windows 11 laptop a type 1 or a type 2 hypervisor?

Type 1, although it does not look like one. A type 2, or hosted, hypervisor such as VirtualBox or UTM is an app on an operating system, so the work of every guest goes through that host OS. A type 1, or bare-metal, hypervisor runs directly on the hardware. Hyper-V is a Windows feature you switch on, yet Microsoft describes it as type 1: once it is on, the hypervisor runs on the hardware, and Windows itself runs in the root, or parent, partition, which creates and manages the guests in child partitions beside it. It is also why VirtualBox and VMware Workstation VMs might not start, or might run unreliably, while the Hyper-V hypervisor runs: they need the processor features that Hyper-V already holds.

Two harder questions follow, about a trainee’s 8 GB laptop and a colleague’s request for a lab VM. Note what you would check first, then compare it with each first step:

Key takeaways

• UTM and VirtualBox are type 2 hypervisors, apps on a host OS; a type 1 hypervisor runs on the hardware, and Hyper-V is type 1 even on Windows 11.
• The host decides: UTM on a Mac with Apple silicon, for arm64 guests; Hyper-V on Windows 11 Pro, Enterprise or Education; VirtualBox on Windows 11 Home; KVM on Linux.
• Windows 11 Enterprise and Windows Server 2025 are 90-day and 180-day evaluations whose terms you keep, Ubuntu costs nothing, and an expired evaluation is rebuilt from its ISO.
• A Windows 11 VM needs UEFI, Secure Boot, a virtual TPM 2.0, 4 GB of memory, two virtual processors and 64 GB of disk, and VMs that run together must leave the host its own memory.
• A named snapshot before a risky step makes it reversible, but a snapshot is not a backup and keeps whatever the VM held.
• NAT, host-only and private networks keep lab traffic off the real network, and only made-up data and lab-only passwords belong in a lab.