Memory integrity and incompatible drivers problem

Question

I have been unable to turn on memory integrity in windows security. I the incompatible drivers in device manager and I removed the device that they were associated with. Unfortunately, I still have the same problem and it looks like it's with the same drivers. The problem now is that I can't identify them except by the *.sys filename and I cannot find those.

Answer 1

Hii,

Download the autorun file and check if the mentioned driver is still installed. Delete it using the autorun file available at the following link:

https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns

Download and extract it to a folder, then run autorun64.exe as administrator > go to the Drivers tab and look for the files (or it may have the name given in Windows Security).

Right-click and select Delete driver.

Now open the command prompt (admin) and run the command: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /f /v ExcludIWDriversInQualityUpdate /t REG_DWORD /d 1, restart your computer and try enabling memory integrity or core isolation.

Please leave feedback if the information was helpful to you or not.

Thanks

Answer 2

To resolve the issue with enabling memory integrity in Windows, you can follow these steps:

1. Identify Incompatible Drivers: Use the Event Viewer to check the Code Integrity logs. Look for any entries that indicate drivers were blocked due to compatibility issues. You can find these logs under Applications and Service Logs\Microsoft\Windows\CodeIntegrity\Operational. Typically, memory integrity compatibility events have EventID=3087.
2. Driver Verifier: Consider using Driver Verifier to help identify problematic drivers. You can enable Code Integrity checks by using the command:

      verifier.exe /flags 0x02000000 /driver <driver.sys>
   

   Replace <driver.sys> with the name of the driver file you suspect is causing issues.
3. Update Drivers: If you identify any incompatible drivers, try updating them through Device Manager. If the drivers are not essential, you can also consider uninstalling them.
4. Registry Check: Ensure that the memory integrity setting is enabled in the registry. You can check the following registry key:
   • HKLM\System\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity should be set to Enabled=1.
5. Troubleshooting: If you continue to experience issues, you may need to disable memory integrity temporarily to troubleshoot further. You can do this through the Windows Recovery Environment (Windows RE) if necessary.

By following these steps, you should be able to identify and resolve the issues preventing memory integrity from being enabled.

---

References:

• Enable virtualization-based protection of code integrity
• Driver compatibility with memory integrity and VBS