Windows Security - Memory integrity off?

Mikkel Lund Knudsen 111

Hey,

So we are running AAD Windows 11 and pretty default Windows Security Baseline in Intune.

Last few days - we have been noticing that the Core Isolation and Memory integrity particular has been showing as "Off".

Anyone else?

Phil Cardone 1 Reputation point

2022-09-14T17:24:52.61+00:00

Also seeing the same thing with Windows 11 and "MDM Security Baseline for Windows 10 and later for November 2021".

Memory integrity is off. Your device may be vulnerable.
This setting is managed by your administrator.
Mikkel Lund Knudsen 111 Reputation points

2022-09-14T18:14:17.827+00:00

So - mine is apparantly not managed by our Administrator - but has been off for some devices at least, for some time?

Im just wondering here - is it a new change for Windows Security that if you DO have it disabled - then there will be a yellow notification mark on the Windows Defender Icon in Tray Area?
Lindy J 1 Reputation point

2022-11-18T04:13:38.367+00:00

Since upgrading to windows 11, I no longer have access to device security or core isolation pages and I have a yellow exclamation box on device security icon. It comes up with page not available or not supported comment. Please advise. I have tried looking at everything to resolve this issue but not getting anywhere.
Elizabeth hunt 0 Reputation points

2024-01-30T19:22:56.19+00:00

I turn it on and it turns itself off soooo any fix on this issue

3 answers

Jarvis Sun-MSFT 10,091 Reputation points Microsoft Vendor

2022-09-07T09:50:49.15+00:00

Hi, @Mikkel Lund Knudsen

Please help to confirm which Security Baseline you have applied, all configuration settings default? we'll do some test to see if it's a common issue.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Mikkel Lund Knudsen 111 Reputation points

2022-09-08T06:37:50.937+00:00

Seems that it has never been turned on, now Windows Security is just highlighting it as an Warning - and that wasn't the case before.

Is this a change in behaviour prior to the Update for Windows Security platform - KB5007651 (Version 1.0.2109.27002) perhaps?

I have to be honest - haven't had time to read through the entire article here : https://answers.microsoft.com/en-us/windows/forum/all/update-for-windows-security-platform-kb5007651/da66d02d-cf18-4a43-ac14-133a69cdc749?page=1

Hope you can answer :)

Jarvis Sun-MSFT 10,091 Reputation points Microsoft Vendor

2022-09-08T08:46:43.007+00:00

@Mikkel Lund Knudsen Thanks for your reply. I did the test and found that the results were the same as yours, and it was off from start to finish. Through searching I found that this may be related to incompatibility exists for a boot-critical driver. I'm not an expert on KB and I'm not sure if the one you're mentioning is a critical upgrade (it's been a long time), maybe we can turn to Windows security for help.
In addition, I found an article about Turn on or off core Isolation Memory Integrity for your reference.
Hope my info can help :)

Regards,
Jarvis

Mikkel Lund Knudsen 111 Reputation points

2022-09-08T09:35:03.327+00:00

I know how to turn it off and on - thats not the issue here :)

The issue is that one day, out of nothing - we got the warning, and first off we though that this might be a error/mistake - but we haven't made any changes .

So thats the reason for us wanting to know if Microsoft have made any changes in the way Microsoft Security Center works with warnings/notifications.

Hope that makes sense :)

Philip C Thompson JR 0 Reputation points

2023-03-11T15:06:32.8033333+00:00

🤣You don't need to do any tests to see if it is a common issue. The sheer amount of Windows users who are reporting this on different forums online proves that it is a common issue.

SMH 🤦‍♂️
Sign in to comment
Mikkel Lund Knudsen 111 Reputation points

2022-09-07T11:07:14.827+00:00

Security Baseline for Windows 10 and later :)
Please sign in to rate this answer.
Jarvis Sun-MSFT 10,091 Reputation points Microsoft Vendor

2022-09-16T01:44:00.047+00:00

@Mikkel Lund Knudsen Sorry for the late response. I did the test but didn't get the same error, which looks like a background issue. And the advice is to open an online support case to handle our issue, here is the link: https://learn.microsoft.com/en-us/mem/intune/fundamentals/get-support

Mikkel Lund Knudsen 111 Reputation points

2022-09-22T19:43:28.07+00:00

You sure about that?

I just saw this : https://www.microsoft.com/security/blog/2022/09/20/new-windows-11-security-features-are-designed-for-hybrid-work/

Hypervisor-protected code integrity (HVCI), also called memory integrity, will be enabled by default on all new Windows 11 devices. HVCI uses VBS to run kernel mode code integrity (KMCI) inside the secure VBS environment instead of the main Windows kernel. This helps prevent attacks that attempt to modify kernel mode code such as drivers. The KMCI role is to check that all kernel code is properly signed and hasn’t been tampered with before it is allowed to run.

Would that also mean, that if memory integrity is turned off - then would Windows Security flag it?

Am I missing something here?

Jarvis Sun-MSFT 10,091 Reputation points Microsoft Vendor

2022-09-23T08:32:19.92+00:00

@Mikkel Lund Knudsen Thanks for your reply. Both my search and the results I see show that there is no connection between the security baseline and Core isolation, at least for now. We recommend to submit a User Voice request at this topic.

Would that also mean, that if memory integrity is turned off - then would Windows Security flag it?

Yes, I saw this alert in the security overview

Mikkel Lund Knudsen 111 Reputation points

2022-09-23T09:23:10.087+00:00

Could you maybe investigate internally - if this is expected behaviour?

If it is - then I think you need to make sure this is included in the Security Baseline for Windows 10/11.

Phil Cardone 1 Reputation point

2022-09-23T12:52:26.2+00:00

Agreed!!
Sign in to comment
Rahul Jindal [MVP] 9,241 Reputation points MVP

2022-11-18T13:09:55.223+00:00

Maybe this can help - enabling-windows-11-22h2-core-isolation.html
Please sign in to rate this answer.

0 comments No comments
Sign in to comment