Solved Could not turn Device Security on

Yesterday I upgraded Windows 10 Home on my Dell Inspiron 3280 AIO to Windows 11. The upgrade finished successfully and now I am on Version 22H2 OS Build 22621.2506. Upgraded to Windows 11 on an Optane-enabled system - Windows 10 Help Forums

I noticed that Windows Security > Device security could not be turned on.

Driver incompatibility as shown below,



Knowing that VSO Inspector had installed this pcouffin, I uninstalled VSO inspector using REVO Uninstaller


Even after uninstalling VSO Inspecto,r Device Security scan shows " Incompatible driver"



I had reinstalled and uninstalled VSO Inspector but to no avail.

How do I get rid of this incompatibility to be able to turn on Memory Integrity?

I even logged into Macrium Reflect PE > System32 >DriverStore>FileRepository and deleted the folder containing the files pcouffin.cat, pcouffin.inf and pcouffin.sys . Even then Memory Integrity scan says "Resolve any driver incompatibilities" but does not show any specific driver but asks me to read this Why do incompatible drivers prevent using Memory integrity? - Microsoft Support

How to resolve this issue?

Hello mate,

You should be able to uninstall that incompatible driver using the command below using option 4 of the tutorial below.

pnputil /delete-driver oem22.inf /uninstall /force


Afterwards, try enabling Core Isolation Memory Integrity again.

Thank you @Brink for the prompt response. I did the PowerShell repair as in your tutorial. No problem.

As for enabling Core Isolation Memory Integrity, can I not achieve the same result by switching on Virtual Machine Platform and Windows Hypervisor Platform in Windows features?




I did it earlier in the day and the System information showed a lot of entries on it having enabled. I was not sure I did the right thing and so went back and undid it .

Similiarly as for deleting the incompatible drivers, I found the pcouffine engine listed in the Device Manager and uninstalled it. And again I wasn't sure I did the right thing. So reinstalled VSO Inspector and decided to take expert opinion here.

What confused me was the Microsoft statement here in Why do incompatible drivers prevent using Memory integrity? - Microsoft Support
"Microsoft does not recommend that you delete drivers to attempt to restore this setting."

Nar, I'm afraid that wouldn't be the same as the Memory integrity feature.

You'd only want to uninstall/delete incompatible drivers that you won't use. Otherwise, yeah it could cause issues for the device the driver is for.

jumanji said:

As for enabling Core Isolation Memory, can I not achieve the same result by switching on Virtual Machine Platform and Windows Hypervisor Platform in Windows features?

Click to expand...

You also need to enable CPU virtualization in the BIOS, if it's not already enabled.
I have no idea what it's called for an Intel Beelink motherboard.



On my ASUS motherboard with an AMD CPU, it's called....

Ghot said:

You also need to enable CPU virtualization in the BIOS, if it's not already enabled.
I have no idea what it's called for an Intel Beelink motherboard.

Click to expand...

No , I this is not the Beelink MIniPC which came with Windows 11 Pro. The upgrade is on my Windows 10 PC, the Dell Inspiron 3280 AIO. I shall check the BIOS and see where I have to enable CPU virtualisation.May be tomorrow. i shall hit the sack now.

jumanji said:

No , I this is not the Beelink MIniPC which came with Windows 11 Pro. The upgrade is on my Windows 10 PC, the Dell Inspiron 3280 AIO. I shall check the BIOS and see where I have to enable CPU virtualisation.May be tomorrow. i shall hit the sack now.

Click to expand...

It may already be enabled... I don't know.
In my BIOS the setting is on the "Advanced" tab, in the CPU section.


Have a good night.

In addition:

A 09 Dec 2022 DELL Knowledge Base Article How To Enable or Disable Hardware Virtualization on Dell Systems | Dell India says
"Note: Not all Dell computers support Virtualization. If a Virtualization configuration option is not available in the BIOS, then Virtualization is not supported"

I checked the UEFI firmware/BIOS (current - I always update the BIOS when notified in DELL SupportAssist)) in my Dell Inspiron 3280 AIO - now upgraded from Windows 10 Home to Windows 11 Home (22H2 22621.2506), I do not find any settings to enable/disable virtualisation . But In Task Manager > Performance >CPU it says "Virtulization - Enabled" . So I don't know where exactly I stand

jumanji said:

I do not find any settings to enable/disable virtualisation

Click to expand...

It may be pre-enabled by DELL?

OK, here I am. Problem solved.

Took the day off - sleeping . And switched on the PC just now..

Tried to enable Core Isolation for Memory Integrity .

Checked the registry - DeviceGuard > Scenarios showed only "KernelShadowStacks"


Tried to switch on Core Isolation. No joy . Incompatible drivers it shouted again but did not indicate any culprit. ( incidentally it is the same message I got when I uninstalled pcouffin engine in Device Manager force-killing the only incompatible driver.)



Time to take Brink and and his registry patch seriously
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity]
"Enabled"=dword:00000001

Registry patched and system restarted.

Registry after the patch Tuesday



Checked Core isolation. And "Voila !" - Memory Integrity has turned on automatically controllable only by the administrator.

Great news.

jumanji said:

As for enabling Core Isolation Memory Integrity, can I not achieve the same result by switching on Virtual Machine Platform and Windows Hypervisor Platform in Windows features?

Click to expand...

Hello! I'm not sure what your goal exactly is, but these are very different features. So my answer is no.

jumanji said:

Similiarly as for deleting the incompatible drivers, I found the pcouffine engine listed in the Device Manager and uninstalled it. And again I wasn't sure I did the right thing. So reinstalled VSO Inspector and decided to take expert opinion here.

Click to expand...

You did. But you also have to select the "delete the driver" checkbox , it isn't enough to "uninstall" the device in device manager as it gets reloaded on hotplug or on reboot. You can try again to delete it. The pnputil command line command the others gave you does exactly that, it deletes the driver.

jumanji said:

What confused me was the Microsoft statement here in Why do incompatible drivers prevent using Memory integrity? - Microsoft Support
"Microsoft does not recommend that you delete drivers to attempt to restore this setting."

Click to expand...

This advice does not apply to you. That mainly applies to hardware incompatibilities, in which case it is really to no avail to start removing drivers.However, what you have (as far as I can tell) is just a virtual kind-of device along with a driver so it should be okay to remove if you can live without that software of yours.
deletes the driver.

jumanji said:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity]
"Enabled"=dword:00000001

Click to expand...

You did well, but you should double make sure that the incompatible driver was deleted from the system and as such, won;t be reloaded. To do that, run the pnputil command the others gave you. Since you have already uninstalled the software that depends on it, and as far as I understand, this is not a hardware device and you have already unloaded it without much issue, it should be safe to delete it for good.

@ish4d0w

1. There is absolutely no incomaptible hardware in my system. For long Windows 11 Upgrade was being offered to me through Windows Update. I only delayed installing it.

2. I was pretty certain that only VSO Inspector by VSO software has installed the pcouffin engine. "The PCouffin.sys driver is a device driver that provides access layers for optical drives. Its shared by various vendors but all likely have their software pathed to their own installation of drivers." The pcouffin engine is also by VSO software.

3. That is a very old software dating back to 2010 which I am not using now.

4. While uninstalling pcouffin engine in Device Manager it does ask whether I want to force-uninstall the driver and I said yes. Even after that forced uninstall , Memory Iintegrity could not be turned on .It only said Incompatible drivers but did not show any specific driver as it showed earlier. So it is a false statement insofar as I am concerned.

5. The same incompatible driver message comes when the driver was deleted with the pnputility (dism getdriver + pnputility delete driver) with no such driver indicated.

6. Notwithstanding, when the registry patch was applied , Memory Integrity turned on automatically.

So everything is fine now.

Thanks for taking your time to write that long post.

Microsoft has a tool that allows turning on and off things:

Almighty1 said:

Microsoft has a tool that allows turning on and off things:

There is a v3.7.x of the 'DG & DC Readiness tool' · Issue #5690 · MicrosoftDocs/windows-itpro-docs

'Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool' v3.7 is found here: https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-gu...

github.com

Click to expand...

All that is above my head . Sure I did a cursory reading on that subject and one user comment

quote "Sadly on Download Device Guard and Credential Guard hardware readiness tool from Official Microsoft Download Center still the old 3.6 version from 10/26/2018 is listed.
I don't understand why nobody can change that to latest version.

Should end user's really first search and then manually copy the code from Übersicht über Credential Guard - Windows Security
Doesn't make sense for me " unquote

Neither does it for me. Give me an executable tool file. I will run it and check.

In my system the Device Security was off with an X mark. With Brink's intervention, interaction and his tutorials, I managed to switch it on. And there ends the matter - Core isolation/ Windows kernal security. I am not bothered about Windows Defender's Identity protection/credential-guard. I am not an ITPro or System administrator of any enterprise .

Yes, as long as you get it turned on one way or another is what matters. That tool was used for me to turn certain things off so I can use things like Throttlestop to undervolt as with the security turned on, there is no access to the MSR registers for throttlestop to work correctly. It wasn't hard to use because whatever you need, you can toggle on or off.

In your case, since it was the HypervisorEnforcedCodeIntegrity that matter, the Readme file explains everything....
"
To Enable DG/CG. If you have a custom SIPolicy.p7b then use the -Path parameter else the hardcoded default policy is used
Usage: DG_Readiness.ps1 -Enable OR DG_Readiness.ps1 -Enable -Path <full path to the SIPolicy.p7b>

To enable only HVCI
Usage: DG_Readiness.ps1 -Enable -HVCI

To enable only CG
Usage: DG_Readiness.ps1 -Enable -CG

To Verify if DG/CG is enabled
Usage: DG_Readiness.ps1 -Ready

To Disable DG/CG.
Usage: DG_Readiness.ps1 -Disable

To Verify if DG/CG is disabled
Usage: DG_Readiness.ps1 -Ready

To Verify if this device is DG/CG Capable
Usage: DG_Readiness.ps1 -Capable

To Verify if this device is HVCI Capable
Usage: DG_Readiness.ps1 -Capable -HVCI

To auto reboot with each option
Usage: DG_Readiness.ps1 -[Capable/Enable/Disable] -AutoReboot"

so in your case, since it complained about HVCI, all you would do is open PowerShell and then do:
DG_Readiness.ps1 -Enable -HVCI

and then reboot

but you can see what is missing if you did:
DG_Readiness.ps1 -Capable

as there are really only two things, DG/CG and HVCI, you can toggle either or both as on or off.