Windows Security Core isolation, still showing "Actions recommended"

Question

Dear readers,

windows came up to me, telling me from the info-area to "Windows security - Action recommended". So I went to the section which is marked with a explanation mark sign which is the "Core isolation" section.

Core isolation told me to first uninstall two drivers before beeing able to switch the Memory integrity on, so I did.

I uninstalled following drivers with the following commands from an evaluated CMD-Console:

oem22.inf
oem111.inf

pnputil /delete-driver oem22.inf /uninstall /force
pnputil /delete-driver oem111.inf /uninstall /force

Everything looked good, I did a restart an then switched on the Memory integrity, did a restart again, saw that the "Local Security Authority protection was off, switched it on, did a restart. Now, both settings are on, but there still is written in yellow "This change requires you to restart your device" and "Local Security Authority protection is off. Your device may be vulnerable.

Why is this even possible even though the switches are on? The yellow explanation mark next to the Windows Security sign in the information area remains.

Please rescue my windows-security.

Thank you in advance.

Answer 1

Hello,

See if this fix helps you:

https://www.kapilarya.com/fix-local-system-authority-protection-is-off-in-windows-11

Let us know if this helps!

Note: Included link in this reply refers to blog post by a trusted Microsoft MVP.

Answer 2

Hello there,

Have you made any recent updates? If so try to uninstall them and see if the exclamation mark still appears.

There are reports that recent update have broken this feature.

Right-click the Windows icon (Start menu). Select Settings.

In Windows Settings, click Update & Security (scroll down to see this option). Select Windows Update.

Select View update history.

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer--

Answer 3

I too have had a similar issue. Firstly I was getting a warning saying that my TPM had failed or was switched off! And in windows 11 that's only controlled through BIOS/UEFI. On inspection, TPM was enabled in BIOS. My fix for this was to update BIOS firmware. This seemed to have fixed the issue for a short while. Very soon after, I received the LSA warnings that you all are getting. My fix for this was to preform a clean reinstall of windows. This worked for the LSA warning. But, then on the next restart after the clean reinstall, I started to get a 3rd, different core isolation warning; memory integrity! The retailers of the PC are perplexed and I'm at a loss, as these are areas you do not want security warnings! Though the retailers of the PC did remotely access it, checked a few things, updated a driver, and tested to see if virtualisation was functional, as virtualisation cannot function without memory integrity functioning. Virtualisation was working apparently. Maybe another clean reinstall of Windows and this time clear the TPM cache with the reinstall?