Core Isolation Memory Integrity fails to enable because of incompatible driver wdcsam64_prewin8.sys

Question

Lenovo Legion Y740, Intel core i7 9750H, Windows 10, v2004 (Build 9041.264)

I tried to enable the Core Isolation -> Memory Integrity feature in Windows Defender today, but it failed. It showed this under "Incompatible drivers" -

wdcsam64_prewin8.sys

Driver date: 11/29/2017

Driver version: 1.2.0.0

Published name: oem16.inf

I do have a Western Digital EasyStore portable drive. But device manager is not showing any driver update for it. I also ran an update check via Lenovo Vantage and Windows Update. Neither showed any pending update.

I also went to the WD support website but that doesn't have any driver at all. I had a chat with WD support rep and they have no idea what this driver is.

How do I resolve this?

Answer 1

You can uninstall this driver by using device manager.

(start computer with wd device attached.) You will see the WD Ses device. and uninstall the driver, remove it from disk. Do this only when you do not use any of the WD software involved (smartware....). Restart again, try to enable core isolation. If it is still complaining about the wd ses driver, follow the procedure again, as it is now using a previous version of the driver that might be available in the driver store.

Repeat this untill all versions are gone.

ONLY WHEN YOU ARE NOT USING ANY OF THE WD SOFTWARE.

Happy core isolation!

Answer 2

Hello,

I was having the exact same issue.  I navigated to…

C:\Windows\System32\DriverStore\FileRepository\wdcsam.inf_amd64_7ce69fc8798d6116

…and deleted the wdcsam64_prewin8.sys file.  I tried changing the file name to add ".tmp" after it.  To do this, I had to change the owner from SYSTEM to me.  It still would not let me change it, so I deleted it.  You might have to make yourself the file owner to delete it.  After rebooting, I was able to turn on Core isolation’s Memory integrity, which required a reboot.

I know it is not a good idea to delete system files; however, I have yet to experience any side effects of deleting this driver.

Hope this helps!

Joe

Answer 3

If using Windows 10:

1. Take ownership of the wdcsam64_prewin8.sys file in folder

      C:\Windows\System32\DriverStore\FileRepository\wdcsam.inf_amd64_7ce69fc8798d6116

and in any other similar folder

      C:\Windows\System32\DriverStore\FileRepository\wdcsam.inf_**************

2. Give yourself full control of the file.
3. Then delete the file(s) OR move [maybe to your download folder] & rename them.

1. Search for the folder, utilizing Win10's search bar, next to the Windows Start Menu icon, in the bottom left of your taskbar. Copy/paste:

 C:\Windows\System32\DriverStore\FileRepository\wdcsam.inf_amd64_7ce69fc8798d6116

2. Windows will say "working on it"
3. Once it has brought up a list of folders in File Explorer, go to the search bar in File Explorer, on the right side, just above the list of folders and files. Again, copy/paste C:\Windows\System32\DriverStore\FileRepository\wdcsam.inf_amd64_7ce69fc8798d6116
4. Windows will "work on it" again.
5. Now only that necessary folder and a few files will appear in the search results, and they are now highlighted, including the offending

wdcsam64_prewin8.sys will be visible.

6. Right click on the folder: Properties -> Security tab -> Advanced -> Change Owner. It will open a dialogue box where you can enter your full login name, i.e.: *** Email address is removed for privacy ***. Click on tab "check names", and you should populate the properties box. Tap apply. Give yourself full control and ownership, including the files contained therein. Windows will give you warnings about doing such things; click ok and ignore for now.

7: Select the file wdcsam64_prewin8.sys and right click on it; choose cut.

8: Go to your OneDrive, or other off system storage device and make a new folder; give it a memorable name. Open the folder, and right click and paste.

9. Repeat step number 6 and this time, instead of your credentials in the population box, type System; tap "check names" and tap apply, and then OK, until you are back at the beginning of the properties tab.
10. The offending file is now safely stored offsite, the system is now secure and safe. 
11. Go back to Windows Defender and you can now enable Core Isolation.

Hope this helps! 

This is what the File Explorer should look like, once the offending prewin8.sys file has been removed, and ownership returned to System.

Answer 4

Same problem here. How do I remove it?

Answer 5

Is there any updated info for this problem. This seems to have been an issue since the introduction of memory integrity in 2018. Do you think we'll get an update to the driver or at least be able to uninstall it?