unable to find the incompatible driver(s) preventing core integrity

huntblatz · Oct 16, 2022

Hello All,

When I try to enable core isolation, I am notified that I have an incompatible driver, however, unlike some other posts I have seen, when I click on "Review incompatible drivers," there is nothing on the list. When I first installed Windows 11 Pro, Core Isolation was on. Some time in 2021, it stopped.

Is there a site or service where I can upload my driver list and have it checked against compatible drivers so I can isolate and manually remove the offender(s)?

I am jumping to this line of inquiry because it worked before; I've ensured Windows Virtual Machine and and Windows Hypervisor Platform are enabled, and tried setting Core Integrity to "on" using a security policy. I've also set the installed and unused drivers to be "visible" in the Device Manager and turned on the "Show Hidden Devices." Just to be clear about my technical abilities, I believe I am pretty much a neophyte to what's happening under the hood.

Does anyone have any thoughts?

garlin · Oct 16, 2022

Download the Device Guard and Credential Guard hardware readiness tool.

Code:

 .\DG_Readiness_Tool_v3.6.ps1 -capable -hvci
###########################################################################
Readiness Tool Version 3.4 Release.
Tool to check if your device is capable to run Device Guard and Credential Guard.
###########################################################################
###########################################################################
OS and Hardware requirements for enabling Device Guard and Credential Guard
 1. OS SKUs: Available only on these OS Skus - Enterprise, Server, Education, Enterprise IoT, Pro, and Home
 2. Hardware: Recent hardware that supports virtualization extension with SLAT
To learn more please visit: https://aka.ms/dgwhcr
###########################################################################

Checking if the device is DG/CG Capable
 ====================== Step 1 Driver Compat ======================
Driver verifier already enabled
Verifying each module please wait ....
Completed scan. List of Compatible Modules can be found at C:\DGLogs\DeviceGuardCheckLog.txt
No Incompatible Drivers found
 ====================== Step 2 Secure boot present ======================
Secure Boot is absent / not enabled.
If Secure Boot is supported on the system, enable Secure Boot in the BIOS and run the script again.
 ====================== Step 3 OS Architecture ======================
64 bit arch.....
 ====================== Step 4 Supported OS SKU ======================
This PC edition is Supported for DeviceGuard
 ====================== Step 5 Virtualization Firmware ======================
Virtualization firmware check passed
 ====================== Step 6 NX Protector ======================
NX Protector is available
 ====================== Step 7 SMM Mitigation ======================
SMM Mitigation is available
 ====================== End Check ======================
 ====================== Summary ======================
Machine is not Device Guard / Credential Guard compatible because of the following:
Secure boot validation failed.

glasskuter · Oct 16, 2022

Hello and welcome to the forum. Third party drivers that prevent core isolation do not have to be for devices you have installed, only that the drivers exist in Windows driver folders. Have you uninstalled devices that you didn't remove the drivers for because you have many that would be suspect to me going all the way back to 2006. As well, quite a few of them are not commonly known companies who maintain their drivers.

The first thing I would do is go to Intel and run its driver and support assist tool to get all your Intel stuff up to date. Then run Windows update and install any listed under optional updates to see if it can update some of the others. Take what is left using a new list and try to use process of elimination. If you recognize any for hardware you no longer have, get rid of them.

In your case , if windows won't tell you exactly what is preventing core isolation, you may have to run without it. There are entirely too many that could be the problem.

Bizarre · Oct 16, 2022

If Windows doesn't want to tell you which drivers are causing problems, you may need to update all drivers listed in Device Manager.
You may also need to update installed programs that add themselves in Services. That's what I did to enable Core Isolation.

glasskuter · Oct 16, 2022

@garlin Thanks for mentioning that tool. I was not aware of it.

If his tool doesn't help you narrow this down, you'll have to dig into your drivers.
I took your list and highlighted several drivers for you to look into. I uploaded it to onedrive. drivers.docx
I cannot say these are the driver(s) preventing core isolation, only that they are very old and you have to start somewhere..

I also went to HP for your device. They're not doing too good getting updated drivers on their site. Hope this might help you narrow things down.