Windows 11 Memory Integrity: Turn It On, Fix Driver Errors

Windows Security sometimes shows a yellow warning that Memory integrity is off, and turning it on fails with a message about incompatible drivers. Memory integrity is one of the strongest protections in Windows 11 against malware that hides in drivers, so it is worth getting working. This guide explains what Windows 11 memory integrity does, how to turn it on, how to deal with the incompatible driver message without breaking anything, and when it is reasonable to leave it off.

The steps apply to Windows 11 version 24H2, 25H2 and 26H2.

What Memory integrity is

Memory integrity is part of Core isolation in the Windows Security app. Microsoft’s device security page explains that core isolation protects core Windows processes by isolating them in memory, using hardware virtualization. Memory integrity, also called Hypervisor-protected Code Integrity (HVCI), builds on this: it helps prevent malicious programs from using low-level drivers to hijack the PC. Code that could be dangerous is checked inside the isolated environment before Windows runs it.

Drivers run with the highest privileges on the PC, which is why attackers like to abuse old or vulnerable ones. Memory integrity closes much of that door.

Requirements

• Hardware virtualization enabled in UEFI/BIOS. Microsoft lists this as a requirement. It may be called Intel VT-x, AMD-V or SVM in the firmware.
• Compatible drivers for all devices and apps that load drivers.
• A supported processor; most PCs that meet Windows 11 requirements qualify.

Microsoft notes that the options shown on the Core isolation page depend on your Windows version and hardware.

Turn it on

1. Search Start for Windows Security and open it.
2. Select Device security.
3. Under Core isolation, select Core isolation details.
4. Switch Memory integrity on.
5. Restart when prompted.

After the restart, return to the page to confirm the switch is still on. On a new PC it is often on already.

“Incompatible drivers” message

If the switch will not stay on, Windows Security shows Review incompatible drivers with a list of driver files (for example names ending in .sys). Microsoft’s page on why incompatible drivers prevent memory integrity explains the reasoning: a driver that is not compatible could stop working, with effects ranging from negligible to severe, if memory integrity were forced on.

Work through it like this:

1. Note the driver name and publisher from the list.
2. Identify the device or app. Search the file name online or check Device Manager (View > Devices by driver). Common culprits are old utilities for printers, game controllers, overclocking tools, anti-cheat components, VPNs and virtual drive software.
3. Update it. Check Windows Update (including optional updates) and the device maker’s site. Microsoft’s first recommendation is an updated driver. See update drivers in Windows 11.
4. Remove what you no longer use. If the driver belongs to a device or app you no longer need, uninstall the app in Settings > Apps, or uninstall the device in Device Manager. Microsoft mentions removing the device or app as an option when no update exists.
5. Try Memory integrity again and restart.

Microsoft does not recommend deleting driver files by hand to force the setting on. Deleting the wrong file can stop a device or Windows from working.

Performance and gaming

Memory integrity runs some code checks through the hypervisor, which can cost a little performance on some systems, especially older processors. On most current PCs the difference in everyday use and gaming is small. If you game competitively and measure a real drop, you can weigh that against the security benefit. For most people, leaving it on is the right choice. Our Windows 11 gaming hub covers settings with a bigger performance effect.

Related protections on the same page

• Kernel-mode Hardware-enforced Stack Protection: Microsoft says it needs Memory integrity on and a processor with Intel CET or AMD shadow stack support.
• Local Security Authority protection: helps keep untrusted software from reading or tampering with the sign-in process; Microsoft says changing it needs a restart.
• Microsoft Vulnerable Driver Blocklist: blocks known vulnerable drivers.
• Security processor (TPM) and Secure boot sections show the state of those features; see enable TPM 2.0 and enable Secure Boot.

If Device security shows Standard hardware security not supported, Microsoft says at least one requirement is missing and suggests asking the hardware maker which features are supported.

Hardware virtualization: how to check and enable it

Memory integrity needs virtualization support switched on in the firmware. To check from Windows:

1. Press Ctrl+Shift+Esc to open Task Manager and select Performance > CPU.
2. Look for Virtualization: Enabled under the graphs.

If it says Disabled, turn it on in the firmware:

1. Go to Settings > System > Recovery, select Restart now next to Advanced startup.
2. Choose Troubleshoot > Advanced options > UEFI Firmware Settings > Restart.
3. Find the virtualization option, often called Intel Virtualization Technology (VT-x), SVM Mode or AMD-V, under Advanced, CPU Configuration or Security.
4. Enable it, save and exit.

If the PC uses BitLocker or device encryption, make sure you can find your recovery key before changing firmware settings; see Windows 11 BitLocker. Virtualization is also used by features such as Windows Sandbox and WSL, so enabling it has other benefits.

Related guides

Memory integrity works alongside Microsoft Defender, Smart App Control and the other settings in our Windows 11 security hub. Our core isolation checklist summarises the whole page.