Windows 10: Core isolation and memory integrity - UEFI settings (vt-d)

Hi folks.
A week ago I migrated to Windows 10 from Windows 7 on a well aged ivy bridge system. So far everything went very well and I'm glad I finally made the step. I'm just "breeding" over a subject that I just can't seem to find any hard information about.

Under "core-isolation" I activated the point "memory integrity", that wasn't activated after a clean install. It seems to work just fine. No problem whatsoever so far.
I have vt-x and vt-d activated in UEFI and I understand that vt-x obviously is essential for this feature. But what about vt-d? Does Windows 10 utilize this feature in any way for security purposes or can it be disabled? (Or the other way round, does it have to be disabled for some reason I don't know.)

:)

 

Core isolation and memory integrity - UEFI settings (vt-d)

Hi folks.
A week ago I migrated to Windows 10 from Windows 7 on a well aged ivy bridge system. So far everything went very well and I'm glad I finally made the step. I'm just "breeding" over a subject that I just can't seem to find any hard information about.

Under "core-isolation" I activated the point "memory integrity", that wasn't activated after a clean install. It seems to work just fine. No problem whatsoever so far.
I have vt-x and vt-d activated in UEFI and I understand that vt-x obviously is essential for this feature. But what about vt-d? Does Windows 10 utilize this feature in any way for security purposes or can it be disabled? (Or the other way round, does it have to be disabled for some reason I don't know.)

 

Core isolation and memory integrity - UEFI settings (vt-d)

I think you may have misundertood my question.

I'm not planning to ever run virtual machines.
My only goal is to take advantage of the Windows 10 inbuilt security measures that are realized by virtualisation techniques. (If I'm correct "memory integrity" is basically the only one.)
So I'm fine with the fact the hypervisor is running. That's the point after all.
I just find these techniques to be terribly documented, at least for the average user. Everything I can find in the web is remarkably vague. So I'm not sure if they can benefit off vt-d although I don't think they do.

- - - Updated - - -

OK, I think(!) I found the answer myself. It seems vt-d is used for Kernel-DMA protection. As far as I understand this is only relevant if Thunderbolt 3 is available. That makes sense, too.

 

Cannot Turn On Core Isolation Memory Integrity in Settings


core isolation was on for me without me doing a thing i think and i use kis. is vt-d and stuff enabled in your bios?
i do notice that i cannot scan a selected file with defender from right click context menu. it tells me something about it admin limiting access.

i didn't turn on memory integrity as i'm not sure what it does and i read here that you can't turn it off without going into registry

and somehow the firewall part says kis is handling the firewall, but under win def firewall bit the toggle is set as on. in control panel it says win def firewall off kis firewall on though. so i'll leave it as is

---
my mistake, maybe. i thought core isolation and the memory integrity are 2 separate things and that core isolation was on, since the gfx next to the words "core isolation" has a green tick on it and there's text saying "virtualisation-based security is running to protect the core parts of your device". too chicken still to touch memory integrity.