Memory Integrity

Question

When I open up core isolation to turn on my memory integrity the memory integrity part isn't there and all the other solutions i've tried haven't worked.

Answer 1

Hi, This is Ramesh.

If the Memory integrity option is missing in Windows Security, hardware virtualization may have been turned off in your UEFI settings or using group policy.

1. Please run msinfo32.exe and click System Summary. Resize the columns in the right pane to make the entries visible, and post a screenshot.
2. Open PowerShell admin and run the command get-appxpackage *sechealth* -allusers. Copy the output and post it in your reply.

Answer 2

On Windows 11, the Memory integrity toggle is part of Core isolation in the Windows Security app. If the Memory integrity control is missing entirely, use these checks and alternatives:

1. Verify hardware/firmware support Memory integrity (HVCI) requires hardware virtualization enabled in UEFI/BIOS. If the device or firmware does not support virtualization-based security (VBS), the Memory integrity option may not appear.
2. Check Core isolation and device security Open Windows Security → Device security → Core isolation details. On supported systems, Memory integrity appears here and can be turned on or off. If it does not appear, the device may not meet VBS requirements or OEM/administrator configuration may have disabled it.
3. Confirm state via System Information (msinfo32) Run msinfo32 and check Virtualization-based security Services Running. If it lists Hypervisor enforced Code Integrity, Memory integrity is already enabled even if the toggle is not visible.
4. Check registry state Administrators/OEMs can control Memory integrity via registry:

• HKLM\System\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity (for example, Enabled, WasEnabledBy, EnabledBootId).
• HKLM\System\CurrentControlSet\Control\CI\State (value HVCIEnabled indicates Memory integrity enabled). If these keys are configured by policy or OEM image, the UI control can be hidden or locked.

5. Use policy-based enablement (if applicable) If the device is managed or if administrative tools are available, Memory integrity can be enabled without the UI:

• Group Policy: Computer Configuration → Administrative Templates → System → Device Guard → Turn on Virtualization Based Security → set Enabled, then under Virtualization Based Protection of Code Integrity choose Enabled without UEFI lock. Apply and reboot.
• Intune / CSP: Use the Virtualization Based Technology > Hypervisor Enforced Code Integrity setting in the Intune settings catalog, or the HypervisorEnforcedCodeIntegrity node in the VirtualizationBasedTechnology CSP.

6. Check for driver or compatibility issues If Memory integrity is blocked by incompatible drivers, the Core isolation page normally shows that. If the toggle is missing but VBS is disabled, check:

• Event Viewer → Applications and Service Logs\Microsoft\Windows\CodeIntegrity\Operational for EventID 3087.
• setupact.log for HVCI entries indicating compatibility problems.

If none of these paths show Memory integrity and VBS is not running, the device likely does not meet the requirements for Memory integrity, or it has been disabled/hidden by OEM or management policy.

---

References:

• Enable virtualization-based protection of code integrity
• Memory integrity and VBS enablement
• Driver compatibility with memory integrity and VBS
• Device Security in the Windows Security App