Core isolation memory integrity disabled

22H2 (OS Build 22621.1)

I noticed a warning the other day about device security. I went into settings and turned memory integrity on, but it turned itself off. The culprit seems to be 3 out of date drivers -



last 2 are my TV tuner card and no more recent drivers are available. I believe #1 is a usb driver.

Is this any cause for concern ?

With these drivers it just means you can't turn on core isolation. I faced this problem with two drivers - Logitech webcam, and WD external disk.

The webcam was easy as without the Logitech drivers, the Windows default drivers for camera and microphone work fine. I only use the webcam for Skype and not for anything else. The WD driver appears to be only for their utilities.

So I removed all the drivers with pnputil command in admin mode, eg

pnputil /delete-driver /oem?.inf /uninstall (replace ? with the oem number)

Then you can turn on core isolation with a reboot.

After the reboot, the Logitech drivers appear in the optional updates and I use wushowhide to hide them. The WD driver only appears in this way when I plug the drive in. Again wushowhide prevents the driver install, but the drive works just fine without.

badcrc said:

Is this any cause for concern ?

Click to expand...

Memory Integrity adds an extra layer of protection, but it requires all drivers to be compatible. It has been available in all versions of Win10 since 2018, but was turned off by default.

How-To Geek said:

This feature is a subset of Core Isolation. Windows normally requires digital signatures for device drivers and other code that runs in low-level Windows kernel mode. This ensures they haven’t been tampered with by malware. When “Memory Integrity” is enabled, the “code integrity service” in Windows runs inside the hypervisor-protected container created by Core Isolation. This should make it nearly impossible for malware to tamper with the code integrity checks and gain access to the Windows kernel.

Click to expand...

I have memory integrity turned on wherever possible, but if it's a choice between that and uninstalling a driver you need, then you're probably safe enough without it. Malware would first have to get past the rest of your AV protection before it could come up against memory integrity.

One thing bearing in mind is the overhead of using core isolation on older processors. As I understand it, Intel 8th and later generations of processors have hardware-assist for the virtualization, whereas older processors that support it do so via firmware emulation.

The way I found this out was by running the Prime Number test program. On my 10th generation processor it takes 9-10 seconds to generate 1m numbers, and this time is met both with and without core isolation enabled. On my wife's older PC, which has a Haswell G3450 CPU where virtualization is emulated in firmware, the figures are 35 seconds (disabled) and 3m30s (enabled). It also slows down other tasks, for example Macrium Backup of C: drive from 4.2m to 5.5m.

Perhaps this is one of the reasons why older Intel processors are not officially supported by MS for W11.