Cannot turn on Microsoft Vulnerable Driver Blocklist

Question

With Windows 10 I was able to turn Core Isolation back on after installing Realplayer. But now I am operating Windows 11 and downloaded/installed Realplayer 25 but I am unable to turn Microsoft Vulnerable Driver Blocklist back on. So I uninstalled Realplayer 25 but it appears there are still some drivers installed that will not allow me to turn on Vulnerable Driver Blocklist. I have tried to find out the specific drivers associated with Realplayer (Applian Technologies).

Thanks in advance.

Answer 1

Hi Karl,

Thanks for posting your question here. The issue happens because RealPlayer installs older system drivers that are no longer considered safe in Windows 11. Even after uninstalling RealPlayer 25, some of these Applian‑related kernel drivers can remain on the system and prevent Windows Security features, specifically the Microsoft Vulnerable Driver Blocklist from being turned on. Windows 11 enforces this security rule more strictly than Windows 10, which is why the problem appears now.

To fix it, check Windows Security > Device security > Core isolation details to see which driver is blocked, then manually remove it using Microsoft Sysinternals Autoruns by disabling and deleting any Applian or RealPlayer drivers. After restarting, you should be able to re‑enable the blocklist. Keep in mind that reinstalling RealPlayer may cause the same issue again, as it is not fully compatible with Windows 11’s driver security requirements.

Reference: KB5020779—The vulnerable driver blocklist after the October 2022 preview release

Let me know if you have questions, I'm here to help

Thanks,

Jobelle C.

Answer 2

The Vulnerable Driver Blocklist in Windows 11 is enforced through Memory Integrity (Core isolation) and the Windows driver block rules. If a remaining RealPlayer/Applian driver is still present and classified as vulnerable, Windows will prevent enabling the feature until that driver is removed or updated.

Use these steps to troubleshoot and re‑enable the blocklist/Memory Integrity:

1. Identify the blocking driver
   • When trying to turn on Memory Integrity or the Vulnerable Driver Blocklist, Windows usually shows a message like “A driver can’t load on this device” with the driver name and publisher.
   • Note the exact driver name and company shown in the notification. According to the documentation, these are the only reliable pieces of information available about the blocking driver.
   • If the notification is not visible anymore, try toggling Memory Integrity again from Windows Security to trigger it.
2. Try to update or remove the driver
   • First, check Windows Update for a newer, compatible version of the driver.
   • If no update is available, check the driver/software vendor’s site (RealPlayer/Applian) for an updated driver that supports Memory Integrity.
   • If no compatible version exists and the software is already uninstalled, open Device Manager, enable View > Show hidden devices, and look for any leftover virtual, audio, capture, or filter drivers from RealPlayer/Applian. Uninstall those devices and choose to delete the driver software if prompted.
3. Reboot and try enabling again
   • After removing or updating the problematic driver, restart the PC.
   • Open Windows Security → Device security → Core isolation details and turn Memory Integrity back on. This also enforces the vulnerable driver blocklist on supported systems.
4. Last‑resort workaround (not recommended for long‑term use)
   • If no compatible driver is available and the functionality is critical, Memory Integrity can be turned off so the driver can load, but this lowers security. The official guidance warns that turning off Memory Integrity on a Secured‑core PC takes it out of a Secured‑core state and increases risk.

If the driver is one of the known vulnerable drivers in Microsoft’s blocklist (for example, similar to the WinRing0 case described in the documentation), it will remain blocked by design until the vendor provides a fixed version.

---

References:

• A driver can't load on this device
• KB5020779—The vulnerable driver blocklist after the October 2022 preview release
• Microsoft recommended driver block rules
• Microsoft Defender Antivirus alert - VulnerableDriver:WinNT/Winring0