Solved Acronis True Image 2016 Build 6595 working on Windows 11 with Memory Integrity/HVCI enabled – tested workaround

Acronis True Image 2016 Build 6595 working on Windows 11 with Memory Integrity/HVCI enabled – tested workaround


I would like to share a workaround that I successfully tested on my own Windows 11 PC for Acronis True Image 2016 Build 6595 with a perpetual license.


My original problem was that Windows 11 would not allow me to enable Core Isolation → Memory Integrity because of the old Acronis driver:


C:\Windows\System32\drivers\tib.sys


Original True Image 2016 version:
1.0.0.1163


I wanted to keep using my legitimate perpetual True Image 2016 license without disabling Windows 11 Memory Integrity. After several tests, I was able to get it working by replacing only tib.sys with a newer legitimately obtained Acronis driver and changing the tib kernel service from BOOT_START to DEMAND_START.


IMPORTANT: This is not an officially supported Acronis configuration. It mixes a newer Acronis kernel driver with True Image 2016. Use this procedure at your own risk. Create a full backup and Acronis bootable rescue media before attempting it. Do not download random .sys files from driver sites and do not redistribute Acronis driver files. Obtain the newer driver from your own legitimate Acronis installation.


My successfully tested configuration:


Acronis True Image 2016
Build: 6595
License: Perpetual


Original tib.sys:
1.0.0.1163


Newer tib.sys used:
1.1.1.10022


tib_mounter.sys:
5.0.0.2561
(original True Image 2016 driver)


Windows 11
VBS: Enabled
Memory Integrity / HVCI: Enabled


I deliberately kept the original True Image 2016 tib_mounter.sys. Only tib.sys was replaced.


First, I temporarily installed a current Acronis version and copied:


C:\Windows\System32\drivers\tib.sys


The version I obtained was 1.1.1.10022.


I checked it with PowerShell:


Get-Item “C:\Windows\System32\drivers\tib.sys” |
Select-Object FullName,
@{N=“FileVersion”;E={$.VersionInfo.FileVersion}},
@{N=“ProductVersion”;E={$.VersionInfo.ProductVersion}}


I also verified the digital signature:


Get-AuthenticodeSignature “C:\Windows\System32\drivers\tib.sys” |
Format-List Status,StatusMessage


The result was:


Status : Valid
StatusMessage : Signature verified


With the current Acronis version still installed and Memory Integrity enabled, I manually tested the newer driver:


sc.exe start tib
sc.exe query tib


The result was:


STATE : 4 RUNNING
WIN32_EXIT_CODE : 0
SERVICE_EXIT_CODE : 0


I also confirmed that VBS/HVCI was actually running:


Get-CimInstance -ClassName Win32_DeviceGuard `
-Namespace root\Microsoft\Windows\DeviceGuard |
Select-Object VirtualizationBasedSecurityStatus,
SecurityServicesConfigured,
SecurityServicesRunning


My result was:


VirtualizationBasedSecurityStatus : 2
SecurityServicesConfigured : {2}
SecurityServicesRunning : {1, 2, 5}


I then uninstalled the current Acronis version, temporarily disabled Memory Integrity, rebooted, and installed Acronis True Image 2016 Build 6595.


The True Image 2016 installation contained:


tib.sys 1.0.0.1163
tib_mounter.sys 5.0.0.2561


Before modifying anything, I backed up the original drivers:


New-Item -ItemType Directory -Force “C:\ATI2016_Backup”


Copy-Item “C:\Windows\System32\drivers\tib.sys” `
“C:\ATI2016_Backup\tib.sys”


Copy-Item “C:\Windows\System32\drivers\tib_mounter.sys” `
“C:\ATI2016_Backup\tib_mounter.sys”


I also backed up the tib service registry configuration:


reg export “HKLM\SYSTEM\CurrentControlSet\Services\tib” `
“C:\ATI2016_Backup\tib_service.reg” /y


One important difference I found was the tib service startup type.


True Image 2016 configured tib as BOOT_START, while the newer Acronis installation configured the newer tib.sys as DEMAND_START.


Therefore, I did not simply replace the file while leaving it as a boot driver.


I closed True Image 2016 and stopped the driver:


sc.exe stop tib


I confirmed:


sc.exe query tib


Result:


STATE : 1 STOPPED


Then I changed the startup type:


sc.exe config tib start= demand


Important: there is a required space after start=.


I verified it with:


sc.exe qc tib


The result was:


START_TYPE : 3 DEMAND_START


Next, I renamed the original True Image 2016 driver:


Rename-Item "C:\Windows\System32\drivers\tib.sys"
“tib.sys.2016-original”


Then I copied the newer tib.sys 1.1.1.10022 into:


C:\Windows\System32\drivers\tib.sys


I did not replace tib_mounter.sys. It remained the original True Image 2016 version 5.0.0.2561.


I then tested the newer driver before rebooting:


sc.exe start tib
sc.exe query tib


The result was:


STATE : 4 RUNNING
WIN32_EXIT_CODE : 0
SERVICE_EXIT_CODE : 0


True Image 2016 opened normally and detected all disks.


Before re-enabling HVCI, I tested application startup, disk detection, backup creation and backup validation. Everything worked correctly.


I then enabled:


Windows Security
→ Device Security
→ Core Isolation
→ Memory Integrity


and rebooted Windows.


After rebooting, I confirmed again that Memory Integrity/HVCI was really active:


Get-CimInstance -ClassName Win32_DeviceGuard `
-Namespace root\Microsoft\Windows\DeviceGuard |
Select-Object VirtualizationBasedSecurityStatus,
SecurityServicesConfigured,
SecurityServicesRunning


Result:


VirtualizationBasedSecurityStatus : 2
SecurityServicesConfigured : {2}
SecurityServicesRunning : {1, 2, 5}


I also checked the Acronis drivers:


sc.exe query tib
sc.exe query tib_mounter


Both successfully ran:


tib
STATE : 4 RUNNING
WIN32_EXIT_CODE : 0
SERVICE_EXIT_CODE : 0


tib_mounter
STATE : 4 RUNNING
WIN32_EXIT_CODE : 0
SERVICE_EXIT_CODE : 0


I did not stop at simply checking whether the driver loaded.


With Windows 11 Memory Integrity/HVCI enabled, I successfully tested:


True Image 2016 startup
Disk detection
Backup creation
Backup validation
File recovery
Recovery to another USB device
Disk-level operations
Windows reboot
tib.sys loading
tib_mounter.sys loading


I restored data to a separate USB flash drive and compared the restored folders and files with the source. The recovery completed successfully.


I also tested disk-level operations using the True Image 2016 tools. The application reached the expected restart stage for operations requiring pre-boot access, and after reboot both tib and tib_mounter remained operational with HVCI still enabled.


I had one additional unrelated compatibility issue. After fixing tib.sys, Windows still initially refused to enable Memory Integrity because of an old FTDI driver:


ftdibus.sys


My Driver Store contained both:


FTDI 2.12.36.4 – 2021
FTDI 2.8.24.0 – 2012


The obsolete package on my PC was published as:


oem18.inf


I removed only that old package:


pnputil /delete-driver oem18.inf /uninstall


After that, Memory Integrity could be enabled.


Do not blindly use oem18.inf. The oemXX.inf number is specific to each Windows installation.


Check your own Driver Store first:


pnputil /enum-drivers | findstr /i /c:“ftdi” /c:“ftdibus”


Rollback procedure:


If the newer tib.sys does not work on your system, temporarily disable Memory Integrity and reboot.


Then stop tib:


sc.exe stop tib


Restore the original True Image 2016 tib.sys from your backup.


Then restore the original startup type:


sc.exe config tib start= boot


Or restore the saved registry configuration:


reg import “C:\ATI2016_Backup\tib_service.reg”


Then reboot.


My final working configuration is:


Acronis True Image 2016 Build 6595
Perpetual license


Windows 11
Memory Integrity / HVCI: ON
VBS: ON


tib.sys:
1.1.1.10022


tib_mounter.sys:
5.0.0.2561


tib service:
DEMAND_START
RUNNING


So far, backup, validation, recovery and disk-related operations are working correctly with Memory Integrity enabled.


Again, this should be considered an experimental and unsupported configuration, not an officially supported Acronis upgrade path.


I am posting the exact versions, commands and test results because this may help other owners of legitimate perpetual True Image 2016 licenses who want to keep using the software without disabling Windows 11 Memory Integrity.

Brave decison to use an old version of Acronis backup software and I wish you the best of luck if you ever want to remove it.

I haven't read the entire thread as I am OS at present. But I don't understand why you'd bother with an old image backup application when there are better alternatives.

In early 2024 did you get the popup offer to upgrade to Acronis True Image 2025 (perpetual license)? That was probably a one-time offer since Acronis has only offered subscriptions since 2021. I upgraded 5 licenses.
BTW, I was surprised to see that Acronis True Image 2025 (perpetual license) is currently for sale on Newegg.

MisterEd said:

In early 2024 did you get the popup offer to upgrade to Acronis True Image 2025 (perpetual license)? That was probably a one-time offer since Acronis has only offered subscriptions since 2021. I upgraded 5 licenses.
BTW, I was surprised to see that Acronis True Image 2025 (perpetual license) is currently for sale on Newegg.

Click to expand...

I actually did that and upgraded my Acronis to 2025. If in a couple of years Acronis has another upgrade offer, I may just do that again. I'm certainly NOT going to pay every year for every software package, that would get really expensive!