Windows 11 automatically disables Hypervisor-Protected Code Integrity (Memory Integrity) after reboot despite meeting all requirements.

Question

Hello,

I've been troubleshooting this issue for nearly two days and have exhausted every standard troubleshooting step I can find. I'm hoping someone can help identify why Windows is automatically disabling Hypervisor-Protected Code Integrity (HVCI / Memory Integrity).

When I enable Memory Integrity under:

Windows Security → Device Security → Core Isolation

Windows accepts the change and prompts me to restart. After restarting, Memory Integrity has automatically been turned OFF again. Windows does not report any incompatible drivers or display any error message.

My system consist of :

• Windows 11 Version 10.0.26200.8737
• ASUS PRIME Z490-A
• Intel Core i9-10900K
• NVIDIA RTX 3080
• BIOS / Firmware

I have already:

• Updated BIOS to the latest version (3302)
• Updated Intel Management Engine firmware
• Updated Intel MEI driver
• Verified BIOS settings:
• Secure Boot = Enabled
• TPM (Intel PTT) = Enabled
• Intel Virtualization Technology (VT-x) = Enabled
• Intel VT-d = Enabled
• IOMMU DMA Protection = Enabled (OS Controlled)

My Windows Status and System Information reports:

• Secure Boot State: On
• Kernel DMA Protection: On
• Virtualization-based Security: Running
• Hypervisor detected

However:

• Virtualization-based security services configured: None
• Virtualization-based security services running: None

Device Guard PowerShell output shows:

• VirtualizationBasedSecurityStatus = Running
• SecurityServicesConfigured = {0}
• SecurityServicesRunning = {0}
• CodeIntegrityPolicyEnforcementStatus = 2

The registry shows that Windows automatically changes:

HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity\Enabled

When I enable Memory Integrity:

Enabled = 1

After reboot Windows changes it back to:

Enabled = 0

without reporting any reason.

The Microsoft Device Guard Readiness Tool reports that :

• Credential Guard is not running
• HVCI is not running
• Config-CI is enabled and running (Enforced mode)
• Not all services are running

It does not report unsupported hardware, firmware, or incompatible drivers.

Additional troubleshooting that I've completed:

• Clean Windows installation (Cloud Reset)
• Installed all Windows Updates
• DISM /RestoreHealth completed successfully
• SFC /scannow found no integrity violations
• only Microsoft filter drivers are loaded (fltmc filters)
• Reviewed Code Integrity logs in Event Viewer
• Generated System.nfo
• Generated Device Guard diagnostic logs

No diagnostic has identified an incompatible driver or unsupported hardware.

One detail that may be important:

To the best of my knowledge, Memory Integrity has never remained enabled on this PC during the approximately six years I've owned it. I only discovered the issue because software I use now requires HVCI. At this point, it appears Windows is actively deciding to disable HVCI during boot, rather than failing because of missing prerequisites.

Is there an internal diagnostic, ETL trace, Device Guard log, registry setting, or known platform compatibility issue that could explain why Windows resets HVCI to disabled despite VBS running successfully and all documented requirements being met?

Any guidance would be greatly appreciated.

Thank you.

Answer 1

Hello Alton Chong,

Welcome to Microsoft Q&A forum.

Based on what you've described, I don't think the issue is with any missing requisition. I'd lean more toward a silent failure of HVCI.

Before we proceed further, can you please help check a few details?

• Open the Event Viewer.
• Go to Microsoft > Windows > Code Integrity > Operational and look for event at the boot.
• Press Win + R to open the run dialog box.
• Type hvciscan_amd64.exe and press Enter.
• When the scan is done, type hvciscan_amd64.exe KCET and press Enter.
• Please let me know the results.

I'm waiting for your reply.