Turn On or Off Core Isolation Memory Integrity in Windows 10  

Cliff S said:

You know Shawn, I wonder if this(the off switch not working) is what is keeping 17133, from becoming RTM

They said the problem won't effect most users, and that probably is just a nice way of saying, this only effects people who know what they are doing, like IT specialists and Ten Forums members

You have such a way with words! A brief pause while I pick myself up off the floor!

Cliff S said:

You know Shawn, I wonder if this(the off switch not working) is what is keeping 17133, from becoming RTM

They said the problem won't effect most users, and that probably is just a nice way of saying, this only effects people who know what they are doing, like IT specialists and Ten Forums members

LOL, wouldn't that be funny if so.

Cliff S said:

If you feel like experimenting, I found this:

set to 0

Code:

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity

Attachment 184314

Brink said:

Thank you Cliff. I added that as Option Two.

I'm surprised the registry key is not hash protected though.

Thanks guys for this. Set it to on, just to find out I can't set it back. I'll leave it "on", but it's nice to know how to undo (without Image restore)

AndreTen said:

Thanks guys for this. Set it to on, just to find out I can't set it back. I'll leave it "on", but it's nice to know how to undo (without Image restore)

You might want to save it in Regedit as a favorite, so you can find it easily(I do that with all the keys I use.
Or just save Shawn's reg files.

Cliff S said:

You know Shawn, I wonder if this(the off switch not working) is what is keeping 17133, from becoming RTM

They said the problem won't effect most users, and that probably is just a nice way of saying, this only effects people who know what they are doing, like IT specialists and Ten Forums members

How could that be since it is in 1709 as well

My computer became really sluggish after I turned this feature on so had to Regedit the feature to it's death. :)

Thanks for finding the KEY to look for. :)

slicendice said:

My computer became really sluggish after I turned this feature on so had to Regedit the feature to it's death. :)

Thanks for finding the KEY to look for. :)

I find my PC runs just as snappy with it on or off.

Too bad it isn't going well for you

Hey Shawn, have you thought about sending them an email?
You can tell the team about this problem, as there is an email address at the bottom of the link you posted: Windows Defender System Guard: Making a leap forward in platform security with memory integrity - Microsoft Tech Community - 167303

Windows 10 with Core isolation (VBS)

At Microsoft, we are constantly innovating and raising the bar for security. We invest in next-gen security products, but some of our investments involve transforming the platform itself. Memory integrity protection using virtualization-based security is one of the ways in which we continue to harden the platform against sophisticated attacks. Send us feedback via the Hub, log bugs, and help us make Windows 10 even more secure byemailing our team

Hey Cliff, :)

That's something each person with an issue should do to help make Microsoft aware of it.

I have posted my experience with switching core isolation memory "on" in the Insider thread, but those threads get buried away real quick, so think maybe I post it here, too.

After manually switching the setting to "on", everything looked OK for a while, just "off" switch was greyed of. During the night, when system went to sleep, it froze. After wake (start up really) system resources went crazy (CPU up to 100%) mostly taken by system and diagnostic services.



Symptoms: GSOD (or BSOD - light blue really ) at restart with reference to ACPI.SYS crash dump shows:

Code:

Crash dump directories: 
C:\WINDOWS
C:\WINDOWS\Minidump

On Sun 15. 04. 2018 00:55:19 your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\Minidump\041518-23796-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x112253) 
Bugcheck code: 0x1000007E (0xFFFFFFFFC0000005, 0xFFFFF8030BA2E57A, 0xFFFF8089609776C8, 0xFFFF808960976F10)
Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
file path: C:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a system thread generated an exception which the error handler did not catch. 
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. 
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time. 



On Sun 15. 04. 2018 00:55:19 your computer crashed or a problem was reported
crash dump file: C:\WINDOWS\MEMORY.DMP
This was probably caused by the following module: ntkrnlmp.exe (nt!memset+0x5055) 
Bugcheck code: 0x7E (0xFFFFFFFFC0000005, 0xFFFFF8030BA2E57A, 0xFFFF8089609776C8, 0xFFFF808960976F10)
Error: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
Bug check description: This bug check indicates that a system thread generated an exception that the error handler did not catch. 
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time. 





--------------------------------------------------------------------------------
Conclusion
--------------------------------------------------------------------------------

2 crash dumps have been found and analyzed. No offending third party drivers have been found. Connsider using WhoCrashed Professional which offers more detailed analysis using symbol resolution. Also configuring your system to produce a full memory dump may help you.

Manually switched the setting to "off" by changing the registry key (same as option 2 in this tutorial) and system resources became a bit more available, but still up to 60% CPU, taken by diagnostic and system alone - after couple of restarts that is.

Resource monitor showed, that sleepstudy log was filled and taken resources, so I manually disabled diagnostic (services...), but it came up after some time. This was going on for hours.

Problem resolved after manually triggering sleepstudy with

Code:

powercfg /sleepstudy

Generate Sleep Study Report in Windows 10 Windows 10 Tutorials

and put system to sleep, then wake it up.

All fine after that