Memory integrity keeps unsigned or badly written drivers out of the kernel. Windows Security hides the reason when a driver is refused, so the CodeIntegrity log and Device Guard WMI class are what tell you what happened.
Read the state with **Win32_DeviceGuard**, enable the scenario under **HypervisorEnforcedCodeIntegrity**, reboot, and use the **CodeIntegrity/Operational** log to find the driver that was refused.
**SecurityServicesRunning** contains 2 when memory integrity is active. The Settings toggle can look on while the service is off after a failed driver load.
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object VirtualizationBasedSecurityStatus,SecurityServicesConfigured,SecurityServicesRunning
msinfo32
# look for Virtualization-based security and HVCI entriesThe registry value under **Scenarios\HypervisorEnforcedCodeIntegrity** is what the Windows Security slider writes. Set it to 1 and reboot, because the hypervisor only loads the policy at boot.
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 1 /f
reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /s**Microsoft-Windows-CodeIntegrity/Operational** records every blocked image with event 3077 and the file name. The log is disabled by default on some builds, so enable it before rebooting.
wevtutil sl Microsoft-Windows-CodeIntegrity/Operational /e:true
Get-WinEvent -LogName Microsoft-Windows-CodeIntegrity/Operational -MaxEvents 30 | Where-Object Id -in 3077,3033 | Select-Object TimeCreated,Id,Message | Format-ListThe blocked file name is a sys file in System32\drivers. **Get-WindowsDriver** maps it back to the package and the vendor, which decides whether an update exists.
Get-WindowsDriver -Online | Where-Object Driver -like '*\<name>.sys' | Select-Object Driver,ProviderName,Date,Version,OriginalFileName
driverquery /v | Select-String -Pattern '<name>' -Context 0,3Most refusals are old drivers with a signed but non-compliant image. Install the current package from the vendor, reboot, and check SecurityServicesRunning again before touching any setting.
Get-WindowsDriver -Online -All | Sort-Object Date -Descending | Select-Object -First 5 Driver,ProviderName,Version,Date
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object SecurityServicesRunningIf a required device has no compliant driver, setting the value to 0 and rebooting restores the old behaviour. The machine then runs without kernel code integrity checking.
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 0 /f
shutdown /r /t 0
# after the reboot
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object SecurityServicesRunningVirtualisation is off in the firmware, or a hypervisor from another product is running. Check msinfo32 for Hyper-V requirements and enable SVM or VT-x in the BIOS.
Read the CodeIntegrity log from step 3. The UI only summarises; the event message contains the exact file and the signature reason.
The anti-cheat driver is not signed for this mode. Update the game and its anti-cheat, or leave memory integrity off on a machine used only for that title.
That device's driver was blocked. Re-enable the driver in Device Manager after disabling memory integrity, then look for a compliant driver version.
Usually by a low single-digit percentage, and the hypervisor layer costs more than the code integrity check itself. Measure with your own benchmark before deciding.
No. Secure Boot checks the boot chain before Windows starts; memory integrity checks every driver image that loads in the kernel afterwards. Both can be on at the same time.
Yes, under Computer Configuration, Administrative Templates, System, Device Guard. On a managed machine the setting is not yours to change and the policy wins.
Set the Enabled value under Scenarios\HypervisorEnforcedCodeIntegrity back to 0 and reboot. Memory integrity returns to whatever the Windows Security slider says, and the CodeIntegrity log keeps the events it already recorded.
Free · no account needed · tracks your progress