Windows 10: Turn On or Off Core Isolation Memory Integrity in Windows 10

How to: Turn On or Off Core Isolation Memory Integrity in Windows 10

How to Turn On or Off Core Isolation Memory Integrity in Windows 10


The Windows 10 Creators Update introduced a new experience called the Windows Defender Security Center to make it is easier for you to view and control the security protections you choose and better understand the security features already protecting you on your Windows 10 device.

Starting with Windows 10 build 17093, the Device security page was added to Windows Security that provides you with status reporting and management of security features built into your devices including toggling features on to provide enhanced protections.

One Device security is Core isolation that provides virtualization-based security features to protect core parts of your device.

Memory integrity is a security feature of Core isolation that prevents attacks from inserting malicious code into high-security processes.

See also:

• Windows Defender System Guard: Making a leap forward in platform security with memory integrity - Microsoft Tech Community - 167303
• Memory integrity | Microsoft Docs

It is required to have Virtualization enabled for your CPU in your UEFI firmware settings to have Core isolation Memory integrity available.






This tutorial will show you how to turn on or off the Core isolation Memory integrity Device security feature of Windows Security in Windows 10.

You must be signed in as an administrator to turn on or off Memory integrity.



Contents

• Option One: Turn On or Off Core Isolation Memory Integrity in Windows Security
• Option Two: Turn On or Off Core Isolation Memory Integrity using a REG file

OPTION ONE [/i] Turn On or Off Tabs in apps (Sets) in Windows Security
1 Open Windows Security, and click/tap on the Device security icon. (see screenshot below)



2 Click/tap on the Core isolation details link. (see screenshot below)



3 Turn On or Off (default) Memory integrity for what you want. (see screenshots below)





4 Click/tap on Yes when prompted by UAC.

5 Restart the computer to apply. (see screenshots below)











OPTION TWO [/i] Turn On or Off Core Isolation Memory Integrity using a REG file
The downloadable .reg files below will modify the DWORD value in the registry key below.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity

Enabled DWORD

0 = Off
1 = On


1 Do step 2 (on) or step 3 (off) below for what you would like to do.


2 To Turn On Core Isolation Memory Integrity
A) Click/tap on the Download button below to download the file below, and go to step 4 below.

Turn_ON_Core_isolation_Memory_integrity.reg

Download

3 To Turn Off Core Isolation Memory Integrity
This is the default setting.


A) Click/tap on the Download button below to download the file below, and go to step 4 below.

Turn_OFF_Core_isolation_Memory_integrity.reg

Download
4 Save the .reg file to your desktop.

5 Double click/tap on the downloaded .reg file to merge it.

6 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

7 Restart the computer to apply.

8 If you like, you can now delete the downloaded .reg file.

That's it,
Shawn


Related Tutorials

• How to Enable or Disable Windows Sandbox in Windows 10

:)

 

Cannot disable Memory Integrity (Core Isolation) in RS4 Build 17123

Thanks you very much.

You avoided a reinstallation ;-)

 

Cannot disable Memory Integrity (Core Isolation) in RS4 Build 17123

See the link below how to get VMWare to work on Creators Update.

After Win10 Creators update, VMs do not start i... |VMware Communities

 

Hello Ita1, *Smile

I'm not sure either, but this setting has always been turned off by default for me so far.

 

this setting = VBS, right?

What's the meaning than of "for older systems, customers will have the ability to opt in post upgrade using [...]"?

Older system=upgrade?

 

Yes, core isolation is VBS.

The line below means that they will be able to set it like in the tutorial.

 

txs for your kind reply Brink!

right

yes but for devices that meet the minimum requirements otherwise the reliance on hardware would be useless.
So, i think that older system should be explained as "system that come from an older branch" (eg 10 FCU) otherwise it doesn't make sense...

 

Nothing new in the release notes either. *Sad

https://support.microsoft.com/en-us/...lware-platform

 

From the article you linked Shawn:

My Logitech webcam is one of those drivers that doesn't work now, with this turned on.

But, Microsoft provides their own generic drivers for webcams(in Device Manager), just basic ones with no frills, but enough to work in Skype.

Samsung and Logitech are notorious for not updating their certificates, so it is to be expected I guess*sarc

 

Thank you for the heads up Cliff. *Smile

 

Your welcome Shawn.
I have upgraded my main system to the RP(yeah I couldn't wait*Redface) and now have the option, and turned it on.
If the generic driver hadn't worked, I would have turned it off, but I don't need any of the extra features anyhow.
By the way, one will need to do the same for the web cams mic also.

 

Hmm, this below is what I'm seeing in Windows 10 build 17639.

I'm unable to turn off "Memory integrity", but I do not have any group policies configured despite the red message below. *Confused

 

Yeah, after I turned it on, I have that too*Confused




And typical Microsoft non-help, this is what clicking "Learn More" gives you:




Which is why Ten Forums exists, and thrives*chuckle

 

If you feel like experimenting, I found this:

set to 0
Code: Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity[/quote]

 

Thank you Cliff. I added that as Option Two.

I'm surprised the registry key is not hash protected though.