Device initialization by an access-restricted virtual machine, including: restricting access by a first operating system to a device during one or more device initialization operations, wherein the first operating system is executing in a first virtual machine supported by a hypervisor; determining, by a second operating system executing in a second virtual machine supported by the hypervisor, one or more modifications attempted by the first operating system to the device; and performing, by the second operating system, the one or more modifications to the device.