Core isolation explained in practice: read the state, flip the switch, and deal with the one driver that refuses to load afterwards.
Read the state with **Win32_DeviceGuard**, switch **Memory integrity** on under **Windows Security > Device security**, and remove or update the driver the console lists as incompatible.
The numeric list is the honest answer: the UI can show a toggle while the service is not running. A 2 in the running list means hypervisor enforced code integrity is active.
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object SecurityServicesRunning,SecurityServicesConfiguredThe toggle lives in the device security page. Enabling it takes effect after a reboot, because the hypervisor has to start with the new policy.
Windows Security > Device security > Core isolation details > Memory integrityWhen a third-party kernel driver is not compatible, the console names it instead of guessing. That name is the only thing you have to act on.
Windows Security > Core isolation details > Review incompatible driversOnce the file name is known, the driver store finds the package that provides it. Removing it is the step that lets the toggle stay on.
pnputil /enum-drivers | Select-String -Pattern driver -Context 3On a managed machine the switch can be greyed out. The registry value is what the feature reads, and a reboot applies it.
reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 1 /fRepeat the first command. Running should now contain 2 or 3, and the console shows a green check without a warning banner.
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object SecurityServicesRunningA driver on the block list, or a policy. Check the incompatible list first, then gpresult.
Its kernel driver is incompatible. Decide per game whether the feature is worth it; the console names the driver.
Nested virtualization takes the performance hit twice. Exclude the VM workload if it is the main use.
Home builds on old releases, or virtualization is disabled in the firmware. Check Task Manager for the Virtualization line.
No. Secure Boot checks what starts at boot, memory integrity checks kernel code while it runs.
A few percent in normal work, more in workloads that hammer the kernel. Measure before and after if that matters to you.
Turn the toggle off in the same page or set the registry value to 0, then reboot. Driver packages you removed have to be reinstalled separately.
Free · no account needed · tracks your progress