Core isolation firmware protection

Question

I have Windows 10 Pro, version 21H1 build 19043.1052. I have AMD-V enabled in BIOS, Secure boot and TPM 2.0

I am the only user of the computer, and in the security part, device security, core isolation, there are two settings that I cannot edit: Integrity of memory and firmware protection. In both of them I get a message in red that says "This configuration is managed by the administrator". However, as I said previously, I am the only user and administrator of the PC. Memory integrity appears enabled but grayed out, and firmware protection appears disabled.

I have managed to touch the "memory integrity" setting by changing Enabled from a 1 to a 0 within HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ DeviceGuard \ Scenarios \ HypervisorEnforcedCodeIntegrity in the registry. However, that change is undone every time I reboot the system. In group policies, gpedit.msc, under System - Device Guard - Virtualization-based security, I have set to Enabled, Security Level set to Secure Boot and DMA protection, Virtualization based protection for code integrity enabled with UEFI lock, Credential Guard enabled with UEFI lock, and secure boot enabled.

I have not found where to enable firmware protection and it does not show me the message "This configuration is managed by the administrator".

How can I prevent the "This setting is managed by the administrator" message from being displayed on every reboot for Memory Integrity, and how can I enable
firmware protection?

Answer 1

I also can't enable firmware protection, and can't find a solution.

Answer 2

Hi
@Goncatin
From my own experience, I take it that you have enabled AMD-V, Secure boot and TMP/PTT in the BIOS setting/secure (this may vary with different AIC/OEM), if not, open them manually. And I suggest you check the bios to see whether there are others settings that raise this issue. Try disable one a time to test.
BIOS can be reset by on motherboard button CMOS or unplugged the button battery.
Some options are disabled in bios by default. And some variables maybe incompatible with HVCI as blow link which has something similar to what you have written.
https://learn.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity

To help you better, you should contact your PC/Motherboard provider, do simple consultation for confirmation, advice and bios usage. For instance, ask if it is a common phenomenon and has solution.

Hope this can help you
If your need further help, be free reply to me at your convenience.

==============================================================================

If the Answer is helpful, please click "Accept Answer" and upvote it