Windows 11 Core Isolation/Memory Integrity Question

mccnavy · Oct 3, 2022

Recently, on my laptop I noticed that Windows 11 Core Isolation (and Memory Integrity) were not an option under Device Security. I had thought I saw them before so I looked online. I read that in order for the feature to be active I needed Virtualization enabled. I enabled it in BIOS and, indeed, the options returned and showed active. Why do you need virtualization enabled for this feature if not running VM? Also, I had (2) options...one for Intel Virtualization Technology and one for Virtualization Technology for Directed I/O. Which ones should I have enabled...I assume the Intel VT for Windows Security...but I don't use VM...do I need the I/O setting enabled? Thanks.

Brink · Oct 3, 2022

Hello,

You would need to enable CPU virtualization like below first.

Enable or Disable CPU Virtualization in UEFI BIOS Firmware Settings on Windows PC Tutorial

This tutorial will show you how to enable or disable Intel ("Intel VT" or "VT-x") or AMD ("AMD-V") CPU virtualization in UEFI/BIOS on Windows 10 and Windows 11 PC. CPU virtualization is a hardware feature found in all current AMD and Intel CPUs that allows a single processor to act as if it was...

www.elevenforum.com

Afterwards, you should be able turn on Memory Integrity like below if you do not have any incompatible drivers preventing it.

Enable or Disable Core Isolation Memory Integrity in Windows 11 Tutorial

This tutorial will show you how to turn on or off core isolation memory integrity in Windows 11. Core isolation is a security feature of Microsoft Windows that protects important core processes of Windows from malicious software by isolating them in memory. It does this by running those core...

www.elevenforum.com

PerpetualCycle · Oct 3, 2022

mccnavy said:
Recently, on my laptop I noticed that Windows 11 Core Isolation (and Memory Integrity) were not an option under Device Security. I had thought I saw them before so I looked online. I read that in order for the feature to be active I needed Virtualization enabled. I enabled it in BIOS and, indeed, the options returned and showed active. Why do you need virtualization enabled for this feature if not running VM? Also, I had (2) options...one for Intel Virtualization Technology and one for Virtualization Technology for Directed I/O. Which ones should I have enabled...I assume the Intel VT for Windows Security...but I don't use VM...do I need the I/O setting enabled? Thanks.

It uses a hypervisor protected container to segregate and protect the code integrity checking of device drivers.
It does affect performance slightly.
You want the Intel.