Enable Core Isolation and Memory Integrity in Windows 11
The Problem
Most serious Windows malware does not stay in your user account. It gets a driver loaded into the kernel, and from there it can hide processes, switch off antivirus, and survive a reinstall of the app you thought was the problem. That is the attack Memory Integrity — the setting Microsoft ships under Core Isolation — is designed to stop.
Memory Integrity (also called HVCI, Hypervisor-protected Code Integrity) runs the code that checks driver signatures inside a small hardware-isolated virtual machine. A driver that is unsigned, revoked, or on Microsoft's vulnerable-driver blocklist never gets to run, even if malware already has administrator rights.
On a clean Windows 11 install it is on by default. On a PC upgraded from Windows 10, or one that has had gaming anticheat, older RGB software, or a virtual drive tool installed, it is very often off — and the switch refuses to move, showing "Memory integrity can't be turned on".
Checking whether you were ever infected? Memory Integrity is prevention, not cleanup. Run malware removal and rootkit and bootkit removal first, then harden.
Symptoms
- Windows Security shows a yellow warning on Device security.
- The Memory integrity toggle is greyed out, or flips back to Off after a restart.
- An error names an incompatible driver with a
.sysfilename. - A blue screen appeared right after you enabled it — see how to fix a blue screen.
Before You Start
Memory Integrity needs virtualisation enabled in firmware. If Settings → Privacy & security → Windows Security → Device security shows no Core isolation section at all, virtualisation is off — turn it on first, see how to enable virtualization (VT-x / AMD-V).
Also create a restore point. Removing a driver to satisfy the check is easy to reverse, but only if you left yourself a way back.
The Fix: Step-by-Step
Step 1: Check the Current State
- Press
Windows + I→ Privacy & security → Windows Security → Device security. - Open Core isolation details.
- Note whether Memory integrity is On, Off, or greyed out. Note any Microsoft Vulnerable Driver Blocklist toggle underneath — that one should also be On.
If Memory Integrity is already On, you are done. Turn on the blocklist as well and skip to the FAQ.
Step 2: Try the Toggle
Switch Memory integrity to On and restart when prompted. On a PC with no legacy drivers, this is the whole job.
If Windows refuses and shows a Review incompatible drivers link, open it. The list names each blocking driver by filename and publisher — write those down before you close it.
Step 3: Identify What Owns the Blocking Driver
Filenames are rarely obvious. Common culprits:
| Driver | Usually belongs to |
|---|---|
| iqvw64e.sys | Intel network diagnostic tools |
| speedfan.sys, WinRing0x64.sys | Fan control and hardware monitoring apps |
| dtsoftbus01.sys | Daemon Tools virtual drives |
| EasyAntiCheat.sys, BEDaisy.sys | Game anticheat (usually fine once updated) |
| RTCore64.sys | MSI Afterburner / RivaTuner |
| nvhda64v.sys | Old NVIDIA HD audio driver left behind |
Search the exact filename if it is not listed. If you cannot place it, run Win + R → msinfo32 → Software Environment → System Drivers, sort by the file name column, and check the publisher.
Step 4: Update the App First, Remove Second
Most of these have a current version that ships a signed, compliant driver. Update the app from the vendor's own site — not a driver-updater tool — then retry Step 2.
Only if no update exists should you uninstall. Settings → Apps → Installed apps, uninstall, restart, and try again. See how to update outdated drivers for the safe way to do this.
Step 5: Remove an Orphaned Driver Left Behind by an Uninstall
Uninstalling the app does not always remove the driver file. In Terminal (Admin):
pnputil /enum-drivers
Find the entry whose Original Name matches the blocking .sys file, note its Published Name (oem##.inf), then:
pnputil /delete-driver oem23.inf /uninstall /force
Substitute the real number. Restart, then retry the toggle.
Step 6: Deal With a Graphics Driver Blocker
If the blocker is a display driver leftover, a normal uninstall usually will not clear it. Use the clean-removal route in clean install GPU drivers with DDU, then install the current driver from AMD, NVIDIA, or Intel directly.
Step 7: Turn On the Vulnerable Driver Blocklist
Back on Core isolation details, switch Microsoft Vulnerable Driver Blocklist to On. This blocks drivers that are properly signed but known to be exploitable — the exact route ransomware crews use to disable antivirus before encrypting. It costs nothing and breaks almost nothing.
Step 8: Confirm It Actually Stuck
Restart, then check Win + R → msinfo32 → System Summary. Look for:
- Virtualization-based security — Running
- Virtualization-based security Services Running — includes Hypervisor enforced Code Integrity
If it says Not enabled after you set the toggle, something is turning it off again — usually a game anticheat or a virtual machine tool. Check Event Viewer under System for HVCI or DeviceGuard entries.
What It Costs You
Memory Integrity adds a small CPU overhead. On a modern chip that is a few per cent and invisible outside benchmarks; on an older pre-2018 CPU without the newer virtualisation extensions, it can be noticeable in games. If frame rates drop measurably and you are gaming on old hardware, that is the one legitimate reason to leave it off — see optimize Windows 11 for gaming for what to change first instead.
It also conflicts with some VM software. VirtualBox and older VMware builds run slowly or refuse to start nested virtualisation with HVCI on. Current VMware Workstation and Hyper-V are fine.
What Not to Do
- Do not use a "driver updater" utility to clear the blocking driver. They install repackaged drivers, and several of those are themselves on the blocklist.
- Do not disable the blocklist to get an old tool working. That toggle exists because those specific drivers are actively used in attacks.
- Do not force-delete a
.sysfile fromSystem32\drivers. Usepnputil, or Windows will try to reload a driver whose file has vanished and bluescreen on boot.
FAQ
Is Memory Integrity the same as Secure Boot?
No. Secure Boot checks what runs before Windows starts — the bootloader and firmware chain. Memory Integrity checks drivers after Windows is running. They protect different stages and you want both. Secure Boot setup is covered in enable TPM and Secure Boot.
Will enabling Memory Integrity slow down my games?
On a CPU from roughly 2018 onward, the difference is within run-to-run noise. On older hardware the overhead is real but usually single-digit percentages. Measure your own frame rates before and after rather than trusting a forum claim — anticheat software has a far bigger impact than HVCI does.
Why does it turn itself off after every restart?
Something is switching it back. The usual causes are a virtualisation tool that needs the hypervisor for itself, a game anticheat driver installed after you enabled it, or a system-restore rollback. Check Event Viewer under System for DeviceGuard events, which name the component that changed the setting.
Can I enable Memory Integrity on Windows 11 Home?
Yes. Core Isolation and Memory Integrity are available on Home, Pro, and Enterprise. Credential Guard is the Pro-and-above feature — that one is covered in LSA protection and Credential Guard.
The toggle is on but msinfo32 says virtualization-based security is not enabled — why?
The toggle records your intent; the hypervisor has to start at boot for it to take effect. If firmware virtualisation is off, or another hypervisor claimed the hardware first, the setting stays set and inert. Enable virtualisation in BIOS/UEFI and restart.
Does Memory Integrity stop ransomware?
Not on its own — it blocks the kernel driver stage that many attacks use to disable defences, which makes an infection far less damaging, but a ransomware binary running as your own user does not need a driver. Pair it with Controlled Folder Access and real backups.
Still Not Working?
If the incompatible-driver list is empty but the toggle still refuses, the block is usually firmware-level: virtualisation disabled, or an outdated UEFI. Update your motherboard or laptop firmware from the manufacturer's support page, then retry.
Related: enable Smart App Control, enable BitLocker drive encryption, configure UAC and a standard user account.
Related guides
Set Up UAC and a Standard User Account in Windows 11
Running as administrator gives every program you open full control of the PC. Set UAC to always notify and move daily use to a standard account without losing anything.
Enable Controlled Folder Access in Windows 11
Controlled Folder Access stops unknown apps writing to Documents and Pictures, blocking ransomware before it encrypts. Turn it on and allow the apps you trust.
Enable LSA Protection and Credential Guard in Windows 11
Stop password-stealing tools reading saved credentials out of memory. Turn on LSA protection on any Windows 11 PC, and Credential Guard on Pro and Enterprise.
How to Secure Remote Desktop (RDP) in Windows 11
RDP exposed to the internet is a top ransomware entry point. Lock it down with Network Level Authentication, lockout policy, and a VPN instead of port forwarding.
Set Up DNS Filtering to Block Malicious Sites
A filtering DNS resolver blocks phishing, malware, and ad domains for every device before they load. Set it up on Windows 11 and on the router, with encrypted DNS.