Cannot Enable Memory Integrity

Question

Hello, I’ve had a problem enabling memory integrity. All the bios settings are correct and Force enabling it through regedit causes a boot loop issue where i cannot connect to the network. checking event viewer shows no incompatible drivers and im starting to lose hope. any help will be greatly appreciated please and thank you!

Answer 1

Hello,

See if this video fix helps you:

https://www.youtube.com/watch?v=CbripJ5Hz9c

Let us know if this helps!

Answer 2

Unfortunately, the logs don't indicate which component is causing the issue. But please try uninstalling the ASUS utilities, and Hyper-V (via OptionalFeatures.exe).

Then, clean boot Windows using msconfig.exe

A clean boot is the process of starting Windows without loading any third-party applications or services. For more information, please refer to the Microsoft article.

How to perform a clean boot in Windows - Microsoft Support:

https://support.microsoft.com/en-us/topic/how-to-perform-a-clean-boot-in-windows-da2f9573-6eec-00ad-2f8a-a97a1807f3dd

(Step 3 in the above link is crucial. You need to first enable "Hide all Microsoft Services" before clicking "Disable all".)

After rebooting the system, re-enable Memory Integrity.

Answer 3

Please download the hvciscan tool from Microsoft.

Copy it to the C: drive's root, i.e., C:\hvciscan_amd64.exe

Open admin Command Prompt and run:

C:\hvciscan_amd64.exe

Post the output.

Answer 4

Hi Morc,

What happens when you enable Memory Integrity via the Windows Security GUI. Does it show the list of incompatible drivers? If so, please post the screenshot here.

Answer 5

To troubleshoot the issue with enabling memory integrity, consider the following steps:

1. Check Compatibility: Ensure that your hardware supports memory integrity and that all BIOS settings are correctly configured. Sometimes, even if settings appear correct, a BIOS update may be necessary.
2. Review Code Integrity Logs: Since you mentioned checking the Event Viewer, ensure you are looking at the Code Integrity logs specifically located under Applications and Service Logs\Microsoft\Windows\CodeIntegrity\Operational. Look for EventID=3087, which indicates compatibility events related to memory integrity.
3. Analyze Setup Logs: Check the setupact.log for messages related to HVCI (Hypervisor-protected Code Integrity). This log will provide insights into whether memory integrity was enabled or if there were any compatibility issues.
4. Driver Verification: Use Driver Verifier with Code Integrity checks enabled to ensure that all drivers are compatible with memory integrity. You can enable this by running the command: verifier.exe /flags 0x02000000 /driver <driver.sys> for each driver.
5. Registry Settings: If you are forcing memory integrity through the registry, ensure that you are setting the correct keys. The keys should be:
   • HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity with the value Enabled=1.
6. Auto-disable Feature: If your system is crashing during boot, consider that the auto-disable feature may be kicking in. This feature is designed to prevent boot failures caused by incompatible drivers. You may need to temporarily disable memory integrity to regain access and troubleshoot further.
7. Seek Additional Help: If the issue persists, consider reaching out to Microsoft support or community forums for more tailored assistance.

By following these steps, you should be able to identify the root cause of the issue and potentially resolve it.

---

References:

• Memory integrity and VBS enablement
• Enable virtualization-based protection of code integrity