# Enable Core Isolation and Memory Integrity in Windows 11

URL: https://www.mytechnician.tech/tips/enable-core-isolation-memory-integrity-windows-11/
Published: 2026-08-07 | Author: Ankit Kumar
Tags: Windows 11, Security, Drivers, Privacy
Summary: Memory Integrity blocks malicious drivers from loading into the Windows kernel. Turn it on, and fix the incompatible driver error that stops it switching on.

## The Problem
Most serious Windows malware does not stay in your user account. It gets a **driver** loaded into the kernel, and from there it can hide processes, switch off antivirus, and survive a reinstall of the app you thought was the problem. That is the attack **Memory Integrity** — the setting Microsoft ships under **Core Isolation** — is designed to stop.

Memory Integrity (also called HVCI, Hypervisor-protected Code Integrity) runs the code that checks driver signatures inside a small hardware-isolated virtual machine. A driver that is unsigned, revoked, or on Microsoft's vulnerable-driver blocklist never gets to run, even if malware already has administrator rights.

On a clean Windows 11 install it is on by default. On a PC upgraded from Windows 10, or one that has had gaming anticheat, older RGB software, or a virtual drive tool installed, it is very often **off** — and the switch refuses to move, showing *"Memory integrity can't be turned on"*.

> **Checking whether you were ever infected?** Memory Integrity is prevention, not cleanup. Run [malware removal](https://www.mytechnician.tech/tips/remove-virus-malware-windows-11/) and [rootkit and bootkit removal](https://www.mytechnician.tech/tips/remove-rootkit-bootkit-windows-11/) first, then harden.

## Symptoms
* **Windows Security** shows a yellow warning on **Device security**.
* The **Memory integrity** toggle is greyed out, or flips back to Off after a restart.
* An error names an **incompatible driver** with a `.sys` filename.
* A blue screen appeared right after you enabled it — see [how to fix a blue screen](https://www.mytechnician.tech/tips/how-to-fix-bsod-blue-screen/).

## Before You Start
Memory Integrity needs virtualisation enabled in firmware. If **Settings** → **Privacy & security** → **Windows Security** → **Device security** shows no **Core isolation** section at all, virtualisation is off — turn it on first, see [how to enable virtualization (VT-x / AMD-V)](https://www.mytechnician.tech/tips/how-to-enable-virtualization-vt-x-amd-v-bios/).

Also [create a restore point](https://www.mytechnician.tech/tips/create-system-restore-point-windows-11/). Removing a driver to satisfy the check is easy to reverse, but only if you left yourself a way back.

## The Fix: Step-by-Step

### Step 1: Check the Current State
1. Press `Windows + I` → **Privacy & security** → **Windows Security** → **Device security**.
2. Open **Core isolation details**.
3. Note whether **Memory integrity** is On, Off, or greyed out. Note any **Microsoft Vulnerable Driver Blocklist** toggle underneath — that one should also be On.

If Memory Integrity is already On, you are done. Turn on the blocklist as well and skip to the FAQ.

### Step 2: Try the Toggle
Switch **Memory integrity** to **On** and restart when prompted. On a PC with no legacy drivers, this is the whole job.

If Windows refuses and shows a **Review incompatible drivers** link, open it. The list names each blocking driver by filename and publisher — write those down before you close it.

### Step 3: Identify What Owns the Blocking Driver
Filenames are rarely obvious. Common culprits:

| Driver | Usually belongs to |
|---|---|
| `iqvw64e.sys` | Intel network diagnostic tools |
| `speedfan.sys`, `WinRing0x64.sys` | Fan control and hardware monitoring apps |
| `dtsoftbus01.sys` | Daemon Tools virtual drives |
| `EasyAntiCheat.sys`, `BEDaisy.sys` | Game anticheat (usually fine once updated) |
| `RTCore64.sys` | MSI Afterburner / RivaTuner |
| `nvhda64v.sys` | Old NVIDIA HD audio driver left behind |

Search the exact filename if it is not listed. If you cannot place it, run `Win + R` → `msinfo32` → **Software Environment** → **System Drivers**, sort by the file name column, and check the publisher.

### Step 4: Update the App First, Remove Second
Most of these have a current version that ships a signed, compliant driver. Update the app from the vendor's own site — not a driver-updater tool — then retry Step 2.

Only if no update exists should you uninstall. **Settings** → **Apps** → **Installed apps**, uninstall, restart, and try again. See [how to update outdated drivers](https://www.mytechnician.tech/tips/how-to-update-outdated-drivers/) for the safe way to do this.

### Step 5: Remove an Orphaned Driver Left Behind by an Uninstall
Uninstalling the app does not always remove the driver file. In **Terminal (Admin)**:

```
pnputil /enum-drivers
```

Find the entry whose **Original Name** matches the blocking `.sys` file, note its **Published Name** (`oem##.inf`), then:

```
pnputil /delete-driver oem23.inf /uninstall /force
```

Substitute the real number. Restart, then retry the toggle.

### Step 6: Deal With a Graphics Driver Blocker
If the blocker is a display driver leftover, a normal uninstall usually will not clear it. Use the clean-removal route in [clean install GPU drivers with DDU](https://www.mytechnician.tech/tips/clean-install-gpu-drivers-ddu-windows-11/), then install the current driver from AMD, NVIDIA, or Intel directly.

### Step 7: Turn On the Vulnerable Driver Blocklist
Back on **Core isolation details**, switch **Microsoft Vulnerable Driver Blocklist** to **On**. This blocks drivers that are properly signed but known to be exploitable — the exact route ransomware crews use to disable antivirus before encrypting. It costs nothing and breaks almost nothing.

### Step 8: Confirm It Actually Stuck
Restart, then check `Win + R` → `msinfo32` → **System Summary**. Look for:

* **Virtualization-based security** — Running
* **Virtualization-based security Services Running** — includes *Hypervisor enforced Code Integrity*

If it says *Not enabled* after you set the toggle, something is turning it off again — usually a game anticheat or a virtual machine tool. Check [Event Viewer](https://www.mytechnician.tech/tips/how-to-read-event-viewer-find-crash-cause/) under **System** for `HVCI` or `DeviceGuard` entries.

## What It Costs You
Memory Integrity adds a small CPU overhead. On a modern chip that is a few per cent and invisible outside benchmarks; on an older pre-2018 CPU without the newer virtualisation extensions, it can be noticeable in games. If frame rates drop measurably and you are gaming on old hardware, that is the one legitimate reason to leave it off — see [optimize Windows 11 for gaming](https://www.mytechnician.tech/tips/optimize-windows-11-for-gaming/) for what to change first instead.

It also conflicts with some VM software. VirtualBox and older VMware builds run slowly or refuse to start nested virtualisation with HVCI on. Current VMware Workstation and Hyper-V are fine.

## What Not to Do
* **Do not use a "driver updater" utility** to clear the blocking driver. They install repackaged drivers, and several of those are themselves on the blocklist.
* **Do not disable the blocklist** to get an old tool working. That toggle exists because those specific drivers are actively used in attacks.
* **Do not force-delete a `.sys` file from `System32\drivers`.** Use `pnputil`, or Windows will try to reload a driver whose file has vanished and bluescreen on boot.

## FAQ

### Is Memory Integrity the same as Secure Boot?
No. Secure Boot checks what runs *before* Windows starts — the bootloader and firmware chain. Memory Integrity checks drivers *after* Windows is running. They protect different stages and you want both. Secure Boot setup is covered in [enable TPM and Secure Boot](https://www.mytechnician.tech/tips/enable-tpm-secure-boot-windows-11-upgrade/).

### Will enabling Memory Integrity slow down my games?
On a CPU from roughly 2018 onward, the difference is within run-to-run noise. On older hardware the overhead is real but usually single-digit percentages. Measure your own frame rates before and after rather than trusting a forum claim — anticheat software has a far bigger impact than HVCI does.

### Why does it turn itself off after every restart?
Something is switching it back. The usual causes are a virtualisation tool that needs the hypervisor for itself, a game anticheat driver installed after you enabled it, or a system-restore rollback. Check Event Viewer under System for DeviceGuard events, which name the component that changed the setting.

### Can I enable Memory Integrity on Windows 11 Home?
Yes. Core Isolation and Memory Integrity are available on Home, Pro, and Enterprise. Credential Guard is the Pro-and-above feature — that one is covered in [LSA protection and Credential Guard](https://www.mytechnician.tech/tips/enable-lsa-protection-credential-guard-windows-11/).

### The toggle is on but msinfo32 says virtualization-based security is not enabled — why?
The toggle records your intent; the hypervisor has to start at boot for it to take effect. If firmware virtualisation is off, or another hypervisor claimed the hardware first, the setting stays set and inert. Enable virtualisation in BIOS/UEFI and restart.

### Does Memory Integrity stop ransomware?
Not on its own — it blocks the kernel driver stage that many attacks use to disable defences, which makes an infection far less damaging, but a ransomware binary running as your own user does not need a driver. Pair it with [Controlled Folder Access](https://www.mytechnician.tech/tips/enable-controlled-folder-access-ransomware-protection-windows-11/) and real backups.

## Still Not Working?
If the incompatible-driver list is empty but the toggle still refuses, the block is usually firmware-level: virtualisation disabled, or an outdated UEFI. Update your motherboard or laptop firmware from the manufacturer's support page, then retry.

Related: [enable Smart App Control](https://www.mytechnician.tech/tips/enable-smart-app-control-reputation-protection-windows-11/), [enable BitLocker drive encryption](https://www.mytechnician.tech/tips/enable-bitlocker-drive-encryption-windows-11/), [configure UAC and a standard user account](https://www.mytechnician.tech/tips/configure-uac-and-standard-user-account-windows-11/).

---
Source: https://www.mytechnician.tech/tips/enable-core-isolation-memory-integrity-windows-11/ — My Technician, free Windows 10/11 troubleshooting guides.
More guides: https://www.mytechnician.tech/llms.txt