Windows 11 Firmware Protection - Core Isolation Probem

Been trying to solve this problem, pretty much visit every site, or reddit form, since all the links in my browser results are greyed out.

Problem is Firmware Protection in Windows 11 (win version 23H2 (c build 22631.3447)

Device Securirity> Secured-core PC > Security details.. which shows Firmware protection disabled, but when pressing enable you will go to the main Core isolation page where
the Firmware option does not show up. (by playing around with regedit sometimes you can make it show up but it will also be greyed out and u need admin rights.

Now since i've tried imo all methods i could find, i have no idea how to fix this.

Im aware of the regedit HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios
CredentialGuard
GypervisorEnforcedCodeIntegrity
KernelShadowStacks
SystemGuard

In those there are option to set values to 1's or 0's (i've tried all, deleting, reinstalling, setting all to 0, this is day 4 and im about to give up.

Firmware option sometimes appears back but is greyed out and off, You need admin rights to change it.

As for the group policies i tried 100's of times without success.

Motherboard bios is updated to the latest
Latest drivers , latest windows update

"If the security capability of your device isn't what you'd like it to be, you might need to turn on certain hardware features (such as secure boot, if supported) or change the settings in your system's BIOS. Contact your hardware manufacturer to see what features are supported by your hardware and how to activate them".

abactuon said:

Device protection in Windows Security - Microsoft Support

Learn how to access Windows device security settings in Windows Security to help protect your device from malicious software.

support.microsoft.com

"If the security capability of your device isn't what you'd like it to be, you might need to turn on certain hardware features (such as secure boot, if supported) or change the settings in your system's BIOS. Contact your hardware manufacturer to see what features are supported by your hardware and how to activate them".

Click to expand...

I added some pictures in the post, Secure boot, TPM, Core isolation, Memory integrity they are all enabled in windows via the bios. I include the msinfo32 file showing that for example the secure boot is running etc. But the firmware protection just won't work, i already did a reinstall, same problem. But sure i will try to contact gigabyte about this.

Hello @goldfine and welcome to ElevenForum.




Briefly, you need to turn on...

1. CPU Virtualization in the BIOS
2. Windows Hypervisor in Programs & Features > Turn Windows features on or off.
3. Then do what it says in the tutorial.

Secure Boot and TPM should already be enabled, since you're on Windows 11.

Actually before i joined the forum, i did follow those steps, as i mentioned before my whole search history is windows 11 firmware protection fix and i checked every page. A couple forums where they talk about changing the regedit and group policy, i've tried all that too. I deleted all regs, reinstalled, bios settings in each possible way, i've been doing this for days now. I need it to be fixed haha. Ow yeah and i dont get any messages of incompatible drivers, infact when i run the windows ready test for win11 it says its all good.

goldfine said:

Actually before i joined the forum, i did follow those steps, as i mentioned before my whole search history is windows 11 firmware protection fix and i checked every page. A couple forums where they talk about changing the regedit and group policy, i've tried all that too. I deleted all regs, reinstalled, bios settings in each possible way, i've been doing this for days now. I need it to be fixed haha. Ow yeah and i dont get any messages of incompatible drivers, infact when i run the windows ready test for win11 it says its all good.

Click to expand...

What happens when you click: Enable (RED box)?

Ghot said:

What happens when you click: Enable (RED box)?


View attachment 93996

Click to expand...

When i click enable it will return to this page.

Also I included Bios settings.

​

Ftpm: Enabled
Secured core Auto enablement: Enabled
DRTM Support: Enabled
SMM Isolation Support: Enabled
Firmware Anti Rollback: Enabled
Secure Bio: Enabled
TSME: Enabled
IOMMU: Enabled
SVM Enabled: Enabled
SVM Lock: Enabled
SMEE: Enabled



So basically most people refer to this page Most common refferal but it won't help for everybody. In there you will find the Group Policy explanation, That will show you how to enable the firmware by changing the Group policy. But like i said i tried everything its just not working.

goldfine said:

When i click enable it will return to this page.

Click to expand...

I dunno then.

Personally, I turned all that stuff OFF. I don't even have a Firmware setting.



I use 3rd party backup software. In my opinion, that's far better than all these Microsoft guesswork security settings.

On AMD platforms, you will only be able to enable firmware protection on cards with the AMD PRO badge.
On intel platforms, you'll get this on cards with the vPro badge.
I don't know much about AMD's chipsets, but for Intel's 12, 13 and 14th generations, the Q670 and W680 chipsets provide that.

Ghot said:

I dunno then.

Personally, I turned all that stuff OFF. I don't even have a Firmware setting.



I use 3rd party backup software. In my opinion, that's far better than all this Microsoft guesswork settings.

Click to expand...

IF you go to gpedit, Computer configuration, Administrative templates, System, DeviceGuard, Double click on Turn on virtualization bases security, Enable, Select platform security level, Secure boot and DMA Protection, Secure Launch Configuration to Enabled, and you will prolly get that firmware option popping up too. or it could blow up your pc. I just going to send gigabyte an email i almost wasted a week trying to fix this myself.

goldfine said:

IF you go to gpedit, Computer configuration, Administrative templates, System, DeviceGuard, Double click on Turn on virtualization bases security, Enable, Select platform security level, Secure boot and DMA Protection, Secure Launch Configuration to Enabled, and you will prolly get that firmware option popping up too. or it could blow up your pc. I just going to send gigabyte an email i almost wasted a week trying to fix this myself.

Click to expand...

I'm on Win 11 HOME.
I don't have gpedit.

goldfine said:

I just going to send gigabyte an email i almost wasted a week trying to fix this myself.

Click to expand...

It's probably NOT Gigabyte's problem.
It's probably Microsoft.

Maybe get into a "chat" with Microsoft. Let them share your screen, and they will fix it.
Well... after the first "advisor" you chat with, escalates it to a real tech support person.

It's been 4 days , 5 now, I'm done with it , here i found another user on reddit having the same problem for those interested in investigating this issue.

goldfine said:

It's been 4 days , 5 now, I'm done with it , here i found another user on reddit having the same problem for those interested in investigating this issue.

Click to expand...

I just disabled...

Core Isolation, Memory Integrity, Vulnerable Driver Block List, Drivers Included with Windows Update.
I removed 98% of the Win 11 apps.

And what did I discover?
No BSODs, no problems with Windows, everything works just fine.
I use Bitdefender Internet Security (paid), AV/firewall.
And I use Macrium Reflect backup software, (paid).





I don't want an operating system that runs Microsoft's stuff.
I want an operating system that runs MY stuff.

Since I just can't let it rest here i found another long Thread with pretty much the same problem, there has to be a genius in here that can solve this right.

Also I just send an email to Gigabyte support, lets see what they have to say.

goldfine said:

Since I just can't let it rest here i found another long Thread with pretty much the same problem, there has to be a genius in here that can solve this right.

Also I just send an email to Gigabyte support, lets see what they have to say.

Click to expand...

We ALL used to be geniuses, but then Window 8 and above came along and damaged our brains.