Core Isolation Memory Integrity on Windows

Core Isolation Memory Integrity is a Windows security feature that helps protect your system from malware that tries to inject code into high-integrity processes. You can turn it on or off in Windows Security under Device Security, and it works by running key parts of the operating system in a virtualized, isolated environment. This article explains what it actually does, how it affects performance, and how to decide whether to enable it.

What Is Core Isolation?

Core Isolation is a group of virtualization-based security (VBS) features in Windows 10 and Windows 11. The name comes from the fact that the core of the operating system — the kernel and critical drivers — is isolated from the rest of the system using hardware virtualization. Instead of running directly on the CPU with full access to memory, these protected processes run inside a secure virtual machine. This means that even if malware compromises a regular driver or application, it cannot easily read or modify the memory of the protected kernel.

Memory Integrity is the specific component of Core Isolation that prevents malicious code from being inserted into high-security processes. It is sometimes called Hypervisor-protected Code Integrity (HVCI). When enabled, the Windows hypervisor checks every piece of code before it is allowed to run in kernel mode, and blocks anything that does not meet its signing and integrity rules.

How Memory Integrity Works

Memory Integrity works by using the CPU’s virtualization extensions (Intel VT-x or AMD-V) to create a separate, isolated region of memory. The hypervisor runs at a higher privilege level than the Windows kernel, so it can enforce stricter rules on what the kernel is allowed to execute.

When a driver or a piece of kernel code tries to load, the hypervisor verifies its digital signature and checks whether it has been tampered with. If the code is not signed by a trusted authority, or if it tries to modify already-loaded kernel code, the hypervisor blocks it. This prevents common attack techniques like DLL injection into kernel processes, driver exploitation, and attempts to disable security software.

The key point is that Memory Integrity does not scan files for viruses. It is a runtime protection that checks code as it is executed. That is why it can stop attacks that traditional antivirus might miss, because it does not rely on known malware signatures.

Why It Matters for Security

Modern malware often tries to gain kernel-level access, because that gives it full control over the system. Once a rootkit or a malicious driver is running in kernel mode, it can hide its presence, steal data, and disable security tools. Memory Integrity makes this much harder by ensuring that only trusted code can run in the kernel.

It is particularly effective against:

Driver-based rootkits that load fake or vulnerable drivers.
Code injection attacks that try to modify running processes.
Exploits that take advantage of vulnerable signed drivers.

For most users, leaving Memory Integrity enabled is a good idea because it adds a strong layer of defense with minimal downside on modern hardware.

Performance Impact and Compatibility

The most common reason people disable Memory Integrity is because of performance concerns or compatibility issues. The feature does add some overhead because every kernel-mode operation must be checked by the hypervisor. On modern CPUs with hardware virtualization support, the impact is usually small — typically in the range of 0% to 5% for most workloads. However, on older or low-end processors, the slowdown can be more noticeable, especially for games or applications that rely heavily on kernel operations.

Compatibility is a bigger issue. Some older drivers, particularly those for printers, audio devices, and certain games with anti-cheat systems, are not compatible with Memory Integrity. When you enable the feature, Windows will warn you if it detects an incompatible driver. In some cases, the driver will simply stop working, and the device or game may fail to launch.

If you encounter such issues, you have two options: update the driver to a compatible version, or disable Memory Integrity. Updating is the better choice because it keeps the security benefit. Check the hardware manufacturer’s website for a newer driver, or look for a “VBS-compatible” version.

How to Enable or Disable It

Here is how to check and change the Memory Integrity setting in Windows 10 and 11:

Open the Start menu and type Windows Security, then press Enter.
Select Device Security from the left sidebar.
Under Core Isolation, click Core Isolation details.
Toggle the Memory Integrity switch to On or Off.
If you turn it on, you will need to restart your PC for the change to take effect.

If you see a message that says “Incompatible drivers” when you try to turn it on, you can still force it on, but those drivers will not load. That may cause hardware to stop working. It is safer to first update or remove the conflicting drivers.

Common Problems and Misconceptions

One common misconception is that Memory Integrity is the same as the Windows Defender antivirus. It is not. Windows Defender scans files for known threats, while Memory Integrity blocks code execution based on integrity rules. They work together, but they are separate features.

Another misconception is that disabling Memory Integrity will make your PC faster in games. In most cases, the performance gain is negligible, and you lose a significant security layer. Only disable it if you have a specific compatibility problem that cannot be solved otherwise.

If you have an older CPU that does not support virtualization, Memory Integrity will not be available. You can check by running the command systeminfo in Command Prompt and looking for “Virtualization-Based Security” or by checking the BIOS for a virtualization setting. If virtualization is disabled in the BIOS, you must enable it there before Memory Integrity can work.

Frequently Asked Questions

Does Memory Integrity slow down games?

It can cause a small performance dip on some systems, but on modern CPUs the impact is usually under 5%. If you have a compatible system, the security benefit outweighs the tiny performance cost for most users.

Why is Memory Integrity off by default on some PCs?

Microsoft enables it by default on many new PCs, but it may be off if the hardware is older or if incompatible drivers are present. Windows will typically notify you if the feature can be turned on safely.

Can Memory Integrity break my printer or audio?

Yes, if the driver for that device is not compatible with VBS. The solution is to update the driver from the manufacturer’s website. If no update is available, you may need to disable Memory Integrity to use the device.

Is Memory Integrity the same as Secure Boot?

No. Secure Boot checks the boot loader and prevents unauthorized firmware from loading. Memory Integrity protects the kernel after the system has booted. They are complementary security features.

Should I turn on Memory Integrity if I have an old PC?

If your CPU supports virtualization and you have compatible drivers, it is still recommended. However, on very old hardware the performance impact may be more noticeable, so you should test it and see if the slowdown is acceptable.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →