Turn On or Off Core Isolation Memory Integrity in Windows 10  

just a heads up, upgrading to windows 10 version 2004 (may 2020 update) may delete the 'WasEnabledBy' key I reported on before. this did not occur in the release preview builds of 2004 i tried out, but when I upgraded from 1909, the key disappeared, resulting in core isolation setting being greyed out, and the 'This setting is being managed by your administrator' message. Not sure of the pre-conditions that would cause windows to remove this key during windows setup as of yet, or if this is a bug in 2004. I have no info on whether this key fails to be created on clean installs of 2004 either.

Cybot said:

just a heads up, upgrading to windows 10 version 2004 (may 2020 update) may delete the 'WasEnabledBy' key I reported on before. this did not occur in the release preview builds of 2004 i tried out, but when I upgraded from 1909, the key disappeared, resulting in core isolation setting being greyed out, and the 'This setting is being managed by your administrator' message. Not sure of the pre-conditions that would cause windows to remove this key during windows setup as of yet, or if this is a bug in 2004. I have no info on whether this key fails to be created on clean installs of 2004 either.

Sorry to hijack into this thread as this is my first post, but my attempts to figure out and correct a recent spurt of intermittent PC shutdowns include this subject matter. Unfortunately, my tech level of understanding what is going on here is quite overwhelmed with making sense of this.

I installed two M2 SSD's last week which was the first day where my random shutdowns began. Upon my first boot up, the PC shutdown within minutes and subsequently a few more times for the next hour while I just observed it's behaviour. One of my storage HDD's was not being recognized so I double checked my connections, found a loose plug, went over all others and rebooted to see that all seemed well. I created the two new partitions for the SSD drives and for the next week the PC operated perfectly. However, yesterday it shut down again while my partner was just working on the web. I checked the Event Viewer to start digging and for the shutdown itself I got a critical message and an error.

Event ID 6008 - The previous system shutdown at 11:38:24 AM on ‎8/‎25/‎2020 was unexpected. Event ID 41 - The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.

I then checked back further through the log to check for any warnings/errors showing up close to the shutdown itself and found this:

The hypervisor did not enable mitigations for CVE-2018-3646 for virtual machines because HyperThreading is enabled and the hypervisor core scheduler is not enabled. To enable mitigations for CVE-2018-3646 for virtual machines, enable the core scheduler by running "bcdedit /set hypervisorschedulertype core" from an elevated command prompt and reboot.

This is where the scope of what has happened, what triggered it and how it manages to shut of the PC altogether is well beyond me. This is a personal use machine and in terms of what the above error needs or expects, I'm also not sure if it applies for me. Also, my windows is updated to the "2004" version just in case that's important here.

If possible, could I trouble you for a layman breakdown to the above, core isolation, its relation to memory integrity and what they mean for me in terms of enabling all of the required aspects VS disabling them?

Obviously, my main concern is solving the random shutdown issue but I'd also want to understand all of the pieces in play here.

Thanks!

Brink said:

Hello @bonocity, and welcome to Ten Forums.

Core isolation provides added protection against malware and other attacks by isolating computer processes from your operating system and device.

https://support.microsoft.com/en-us/...#coreisolation

I don't believe this would related to the issue you are having, but you can turn off Core Isolation to verify.

I would like to confirm my suspicion or your view and report back. Would there be a way for me to search the Event Viewer system logs further back than the dates that are available in the immediately shown list? The reason I ask is the timing of the warning I noted above, and the PC shutdown 2-3 seconds later.

Would it be reasonable to suspect this error being a culprit if for every shutdown, the appearance of this is noted in the same way within the event viewer?

Lastly, if anything else is an option causing such behavior that you have seen, I'd gladly look into those as well.

Thanks for your time!

Brink said:

If you are still getting these random unexpected shutdowns with Core Isolation turned off, then it would be best to go ahead and create a new thread in the forum for this separate issue to see what we can do to help.

To clarify, I believe I disabled core isolation/memory integrity last night, but after reviewing this guide just now: Turn On or Off Core Isolation Memory Integrity in Windows 10 It turns out I did not address the registry portion, I just turned of memory integrity within Security Centre.

Secondly, all shutdowns to date occurred prior to my turning that particular setting off. In this case whatever default settings for these processes was set via the OS itself, were not touched until I stumbled upon this potential connection to my shutdowns.

From my recent and very avid googling, the connection with this error being logged in the OS and users experiencing reboots like mine appears to be quite a commonality. I was wondering if you could elaborate as to the reasons why you don't think this is related to my sudden shut downs?

Brink said:

You could test by reversing the setting you changed before this started to verify if it still happens or not, but it's just that I haven't seen this cause shut down issues like this before. Always a first though.

I just remembered, that prior to turning off memory integrity in security centre, I had initially ran the noted CMD Prompt code to enable the core scheduler: "bcdedit /set hypervisorschedulertype core", as requested in the warning within the event viewer, then chose to disable it. I then found the opposite code on this forum to do so, and turned off memory integrity at that point.

So to go back to the "correct" setting to ensure everything required is enabled I should enable memory integrity in security centre, and rerun the CMD prompt script to enable core scheduling and that would be it? If I'm missing anything here please let me know.

Appreciate your help!

Brink said:

The bcdedit /set hypervisorschedulertype core would be to enable the Hyper-V core scheduler below instead of what this tutorial is for.

https://support.microsoft.com/en-us/...n-side-channel

https://docs.microsoft.com/en-us/win...cheduler-types

Running the command below will remove this entry. You will need to restart the computer afterwards to apply.

bcdedit /deletevalue hypervisorschedulertype

Apologies for the additional noob question on the above two documents, but they both seem to be tailored towards Windows Server/Enterprise subject matter. I've also never actively utilized window's virtual machine capabilities (to my knowledge) for anything which only makes me feel more confused (ha!)

Also, would it be helpful to post the event "system" logs here to give readers a better sense of the "state" my OS is in for this discussion?