Memory Integrity off - no incompatible drivers found

I'm unable to turn Memory Integrity on (under Core isolation)
Running Win22H2, build 22621.1555. Windows Security (no 3rd party A/V).

• No incompatible drivers were found, either with the Scan in Windows Security or in the drivers tab of Sysinternals/autoruns (all drivers are Verified).
• I tired enabling Virtualization Based Security in Group Policy, but that didn't help (I've since restored this to "Not Configured").
• Windows is up to date
• SFC and DISM both come up clean
• No issues shown in Device Manager, including hidden devices
• All resident applications are also installed on another device, where Memory Integrity is running without issues.

After rebooting, the setting to turn it on is once again available, but when I try toggling it on, Windows Security scans, immediately toggles the setting off, and disables the toggle, as shown in the screen-shots below.

I saw something (here, # 6) about modifying the Registry (including adding the 'Enabled' key in my case) but didn't want to mess with this before asking the knowledgeable people here in the Forum.

Any advice will be appreciated. Thank you.

If your mobo is an Asus z690, Scroll down in this forum post and see if Jaehee H. suggestion dated 4/4/23 will work for you. It relates to Asus mobos.

Thank you @glasskuter.
The mobo is a Z690, but the BIOS doesn't look like Jaehee's, and there's no mention of SVM. There is something called AmdVtEnable which might be equivalent, but the device runs Intel integrated graphics, so I'm not even sure this s applicable. Currently there's no value set for it, so I might try Enabling, and see if it's a fix.

Virtualization is enabled in the BIOS.

Another thought (IMO, unlikely solution): Dell did release a new BIOS version last week. I typically wait to deploy these, but will consider updating.

safron said:

Dell did release a new BIOS version last week

Click to expand...

Yes, I applied another bios update yesterday. Dell has updated my bios 13 times in the 17 months I've had this Optiplex. It's unreal how often they release new bios. I don't think the bios is your problem though but it's worth a try.
This issue is caused not only by having active drivers that are outdated, but also old drivers stored in driverstore. Have a look at a standalone tool called DriverStoreExplorer to see if it might lead you to your culprit but be very careful using it. Releases · lostindark/DriverStoreExplorer

It's readme is here GitHub - lostindark/DriverStoreExplorer: Driver Store Explorer [RAPR]

Same here - I remember when we used to see maybe 1 BIOS update per year. Most these days seem to address specific security flaws. The latest for our XPS: "Dell Security Advisories DSA-2023-095, DSA-2023-099, and DSA-2023-090".

Thanks for the recco. I'll check out RAPR - it seems like a good addition to the toolbox in any event - but I wonder how I'll identify the culprits, since Windows Security doesn't list any. Maybe I'll compare with my other "working" Win 11 22H2 device, but it's not apples-to-apples, so...

safron said:

but I wonder how I'll identify the culprits

Click to expand...

You need to make sure that CPU virtualization (whatever it's called in your BIOS), is enabled, before you do anything else.


Probably the easiest way, is to first find your motherboard manual.
If you're lucky... it will show you where the CPU virtualization setting is, in your BIOS.


Generally, you need to do these things...

1. Enable CPU virtualization in the BIOS
2. Go to Control Panel > Programs and Features > Turn Windows features on or off... and enable virtualization there as well.
3. THEN go to Settings and turn on Memory Integrity.

Thanks Ghot. I found a (not sure if it's the) Z690 manual, but nothing in there about CPU virtualization. It mentions how to access the BIOS, but no detail about settings. Dell documentation, of course, is useless. Will try enabling features (e.g., Virtual Machine Platform, Windows Hypervisor, and anything else that looks like Virtualization) one by one.

safron said:

Thanks Ghot. I found a (not sure if it's the) Z690 manual, but nothing in there about CPU virtualization. It mentions how to access the BIOS, but no detail about settings. Dell documentation, of course, is useless. Will try enabling features (e.g., Virtual Machine Platform, Windows Hypervisor, and anything else that looks like Virtualization) one by one.

Click to expand...

Well I've been... googling.
It seems that CPU virtualization may be locked to the enabled position in the BIOS, aka, not visible in the BIOS.


It's times like these, that I really hate companies like DELL and HP... etc.

Thanks for researching. Yes - everything's so dumbed-down that they end up hamstringing the end-user. Of course disabling options simplifies the code, so they have a vested interest. I'll report back after messing with RAPR and the optional features.

Here is the official z690 manual in case it's not the one you are using but since Dell has their own bios for it, it's probably as both you and Ghot mentioned, the OEM has likely dumbed down the 'real deal bios' that comes with these boards when purchased on the open market.

I would be throwing this back into Dell support's lap. Don't mess around with their lower level support either. Demand to speak to a real support technician. Once you can get to upper support, they are pretty good about staying with you. The problem is getting to them.

Thank you glasskuter. Unfortunately, the support contract on our XPS has lapsed (and IMO, wasn't particularly useful anyway) so I'm not sure how much help to expect there. I checked the XPS Community forum but didn't come up with anything useful. Maybe I'll post a new thread there.

Ghot: I enabled both Virtual Machine Platform, and Windows Hypervisor (I don't see anything specifically for CPU Virtualization) in optional features, but no joy! FYI, neither of these are enabled on our other device, and Memory Integrity is on.

Wait one. Going by your listed specs I thought you had some custom setup using the Asus model Z690 Rogue mobo. From looking at the specs for that computer z690 refers to the Intel chipset. I'm far from being an expert in hardware but I don't think they are the same thing. @Ghot correct me here.

glasskuter said:

Wait one. Going by your listed specs I thought you had some custom setup using the Asus model Z690 Rogue mobo. From looking at the specs for that computer z690 refers to the Intel chipset. I'm far from being an expert in hardware but I don't think they are the same thing. @Ghot correct me here.

Click to expand...

OP has a Foxconn motherboard... with a Z690 chipset.

9D2HH Foxconn, R6PCT

Can you post an image of Device Manager for the affected machine?

Ghot said:

OP has a Foxconn motherboard... with a Z690 chipset.

Click to expand...

Correct! Sorry if I mislead - my lack of technical expertise is showing.

Dru2 said:

Can you post an image of Device Manager for the affected machine?

Click to expand...

Sure - pls let me know what you're looking for (e.g., everything expanded?, hidden devices?, specific devices?). I've already confirmed there are no errors appearing.

You can check if Virtualization is Enabled in BIOS/UEFI with a simple command. Win + Terminal/CMD (Admin) and type the following:

systeminfo

Then check the following info at the end: Virtualization Enabled In Firmware (Yes - Enabled /No - Disabled).

Thank you @neves. I checked SystemInfo (in the GUI) earlier, but don't think I saw anything about Virtualization. I'll have another look tomorrow morning using Terminal.

@glasskuter: FYI, RAPR identified a number of "old" drivers. I'm trepidatious about deleting them, but will take copious backups, and try to knock them out in a controlled manner. Getting rid of at least some of them seems beneficial in any event. Beforehand though, I'm going to uninstall a number of apps (e.g., Killer Intelligence Center, Intel Graphics Command Center, Dell bloatware) that came bundled with the recent Reset. Hopefully I'll get lucky.

I've also posted in the XPS Community forum but haven't yet received any response.

safron said:

Thank you @neves. I checked SystemInfo (in the GUI) earlier, but don't think I saw anything about Virtualization. I'll have another look tomorrow morning using Terminal.

Click to expand...

Check Hyper-V Requirements (the last info line at the bottom) - there you have Virtualization Enabled In Firmware - if it says Yes it's activated in BIOS/UEFI - if No - it's not.

It's similar in the GUI, at System Summary - you scroll down to the last lines: 4x Hyper V - where in the right you have Virtualization Enabled In Firmware Yes (Enabled) or No (Disabled).

Thanks again neves. The last line in SystemInfo reads:
> "Hyper-V Requirements: A hypervisor has been detected. Features required for Hyper-V will not be displayed."

safron said:

Thanks again neves. The last line in SystemInfo reads:
> "Hyper-V Requirements: A hypervisor has been detected. Features required for Hyper-V will not be displayed."

Click to expand...

That line is misleading - as in - it can mean a lot of things, such as:

- you have multiple virtualization apps installed - which is kinda like having multiple antivirus solutions installed (it can create conflicts - and thus as a preventive measure - one solution is disabled by default). Which is actually an official statement.

- Hyper-V and all its features could actually be Missing/Disabled. Which easy to find out - by simply using Windows Search and opening the Windows Features tab - while typing the following: Turn Windows feature Then look for Hyper-V. Both features should be ticked. If Disabled from the BIOS/UEFI Hyper-V Platform feature - should be greyed out. If missing or disabled - you can also use the folowing comands to enabled them - while using windows CMD/Terminal ( with Admin privileges)

Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All

DISM /Online /Enable-Feature /All /FeatureName:Microsoft-Hyper-V

Also from PowerShell:

Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V

It's also worth to be added - that Hyper-V doesn't usually come with Windows Home (can't tell if you're running Home or Pro) - but can be added/installed if desired.

The systeminfo command used in CMD/Terminal works slightly different than the GUI version - so that's why was wondering what you get there - to know if it's Enabled or Disabled in Bios/UEFI. Especially since you're using a Dell system - the brand i dislike the most when it comes to BIOS/UEFI features (and how they complicate things - cutting-out or limiting their BIOS features more than any other brand). Even tho - there's room for complaints about every brand - Dell is in top of the list of Systems I would not recommend (for having the worst costumer support - on top of meddling with their systems more than any other brand).

Anyway, there's also an "extended" official documentation for activating Memory Integrity. Tho, personally i'm also against using Memory Integrity (keeping it Disabled) - since it's one of the worst Windows Security features introduced by Microsoft up to this point - functionality wise. Highly sensible (overly-picky - kinda like an overly-pretentious spoiled brat), selfish by design (there's tone of useful and legit apps that can't run while having it enabled - especially any other virtual app) and obviously - troublesome by nature (all things mentioned - it can create conflicts with way to many legit apps). Might still work for some (who happen to meet all its requirements - while also not needing/using any of the apps it can conflict with) - but in my case - couldn't bare it more than a week after installing Windows 11. Just my 2 cents.