Turn On or Off Core Isolation Memory Integrity in Windows 10

Henk Poley · 22 Jul 2021

Anybody knows if there are any logs or diagnostics when you turn on Core Isolation / Memory Integrity, and on the next reboot Windows does a double reboot and it is (still) switched off.

Or how to decode Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforce dCodeIntegrity\ChangedInBootCycle = 0x1d77f79afa02f40

Obviously Windows Security doesn't show any incompatible drivers (anymore).

DG_Readiness_Tool.ps1 -Capable gives the same double-reboot issue, with no diagnostics. E.g. driver verifier is off at the next boot to desktop.

STRESSED · 23 Mar 2022

I just want to point out that Group Policy can also be used to enable "Core isolation" / "Memory integrity". I'd recommend that people use Group Policy where possible. This gives you access to more settings, for one thing. Link below.

Also, since system stability can be affected, there are some pretty serious caveats to tweaking this functionality through any means. I expect that using System Restore and Safe Mode will suffice if things go wrong, but I'd suggest having a full image backup before playing around with this stuff.

https://docs.microsoft.com/en-us/win...code-integrity

- - - Updated - - -

I made these msinfo32 screenshots for my own notes, but I figured I'd share them here to provide an idea of the implications of the various settings. I'm aware that not all systems will support the same things as shown here (e.g. DMA Protection).

Also, at first I thought that there was a UI bug in the "Windows Security" app, under "Device security" > "Core isolation details". There, my "Firmware protection" slider is in the off position, but in the registry, "SystemGuard" is enabled. You can clearly see from msinfo32 that "Secure Launch" is configured, but not running. I guess the fact that it's not running is why the slider is off. Wish I knew why it wasn't running...

Turn On or Off Core Isolation Memory Integrity in Windows 10-vbs.png

itsme1 · 23 Jul 2022

When an offline chkdsk (when restarting the computer)is done it disables memory integrity. Does any type of offline chkdsk disable memory integrity I don't know.
I also noticed that on an old computer having Memory Integrity enabled could reduce the internet connection speed by 400 Mbps or even a bit more. Check your internet speed after activating it.

corvairbob · 25 Mar 2024

well that is a lot to take in. so tell me do i really need that turned on? i ran that on this pc with win10 on it and the core is off and will not turn on. so should i be worried? it looks like the siemens hearing aid fitting software has the issue and they have not yet fixed it so i can uninstall that program for now and then if or when i need it again reinstall it.

or in win11 just dismiss the warning and keep using the pc? I'm bit lost on all of this at this time.

Brink · 25 Mar 2024

corvairbob said:

well that is a lot to take in. so tell me do i really need that turned on? i ran that on this pc with win10 on it and the core is off and will not turn on. so should i be worried? it looks like the siemens hearing aid fitting software has the issue and they have not yet fixed it so i can uninstall that program for now and then if or when i need it again reinstall it.

or in win11 just dismiss the warning and keep using the pc? I'm bit lost on all of this at this time.

Hello,

It just depends on if you feel you need the extra security provide by Core Isolation or not.

If it causes issues while turned on, then I wouldn't. Otherwise, it does provide better protection of the Windows Kernel while turned on.

corvairbob · 25 Mar 2024

ok thanks it may not show up on the win10 OS and if i decide to install win11 anytime soon and it shows up i will just dismiss it then. i have to have the hearing aid fitting program installed for tweaking my aids. i may be able to uninstall it but it is a bear to reinstall and then get my setting back into it. maybe the company will send out an update that fixes that issue soon.

jrolson · 6 Days Ago

Not sure why but when I enable it, my CPU doesn't idle and fan speed ramps up...
Turn it off and idle comes back.

corvairbob · 6 Days Ago

so i have win11 running and all the updates they sent out so far and sure enough the core isolation will not activate. these are the files so far causing that so far. i do not yet have the ! in the device security section so it has not yet been giving win11 an issue yet but in a day or so it will show up.. also i did run the program called autoruns and it did not find these files in the drivers tab, but it did find a bunch of other files. it has adobe and somehow it opened the reg files and i just deleted that one in the reg files.

anyway at this time the shield down by the clock has a green check so all looks good, but like i said in a few days that will have the yellow ! in it and i bet it will lead to the device security. it did last time i have win11 running. we will deal with it then if i have to thanks.

Turn On or Off Core Isolation Memory Integrity in Windows 10-screenshot-2024-05-06-133814.png

screen shot of the autoruns app a bunch at the end and one in the center of the files

Turn On or Off Core Isolation Memory Integrity in Windows 10-screenshot-2024-05-06-134720.png

Turn On or Off Core Isolation Memory Integrity in Windows 10-screenshot-2024-05-06-134841.png

- - - Updated - - -

- - - Updated - - -

i just went in and used win-x admin and ran pnputil /enum-drivers to find the affected inf files they are listed as sys but dropping the tab down they are inf files anyway i ran pnputil /delete-driver oem<XX>.inf and entered the correct inf and deleted them and now the core isolation is ok. but i will not have to see if the hearing aid fitting program runs. as those are siemens files in that fitting program. now to test that.

ok it seems i was able to open the siemens app and log onto my hearing aids and make a change so for now it seems to be working. but i have not had to actually do a full program. but if i do have an issue i will reinstall the app and do what i need to do and then if i have to uninstall it i will. but for now i will wait a few days or weeks to see if the issue returns. also i have to assume those files were in the siemens app.