Windows 11 Memory Integrity: What It Protects and Driver Warnings

Windows 11 may warn that a device driver cannot load, or Windows Security may show Memory Integrity turned off. Memory Integrity (also called hypervisor-protected code integrity, or HVCI) checks kernel-mode code inside a virtualisation-based security environment. It helps make it harder for malicious code to tamper with Windows’ kernel; it is not a general malware scan or a guarantee that every driver is safe.

This guide follows the Windows 11 controls available on 12 September 2024. If you see an incompatible-driver warning, identify the driver and look for a compatible update from Windows Update or the device maker before changing the protection setting.

What Memory Integrity protects

Windows uses drivers to communicate with devices such as graphics cards, webcams and keyboards. Some drivers run with kernel-level privileges, so a flaw in one can affect more than the device it supports.

Memory Integrity uses virtualisation-based security (VBS) to run kernel code-integrity checks inside an isolated environment protected by the Windows hypervisor. Microsoft’s Windows 11 Security Book (September 2023) explains that HVCI checks whether kernel code is properly signed and has not been tampered with before Windows allows it to run. Microsoft’s memory-integrity guidance , last updated in April 2023, describes the feature as part of VBS and applies it to Windows 11.

The setting controls what code can run in kernel mode. It does not inspect every application’s behaviour or replace antivirus protection. An incompatible-driver warning means Windows is refusing to load that driver under this security setting; it is not, by itself, a malware verdict.

Check the setting in Windows Security

1. Open Windows Security from Start.
2. Select Device security, then open Core isolation details . On some Windows builds the page may be labelled Core isolation.
3. Read the Memory integrity status and any listed incompatible drivers before changing the switch.
4. If you want to turn it on, check that hardware virtualisation is enabled in your PC’s UEFI or BIOS. If you are unsure how to check that, use the instructions from your PC maker rather than changing firmware settings at random.
5. Turn Memory integrity on. Save your work and restart if Windows asks.
6. After restarting, return to the same page and confirm that the setting shows as on.

Memory Integrity depends on hardware virtualisation, and Windows’ security controls can vary by hardware, Windows build and organisation policy. If the page or switch is missing or managed, check with your PC maker or IT administrator instead of trying registry workarounds.

If Windows reports an incompatible driver

Treat the warning as a compatibility issue to investigate. A legitimate driver can be too old or otherwise incompatible with Memory Integrity; the message alone does not tell you that the device maker or the whole application is malicious.

1. Write down the driver and company names shown in the warning or Core isolation page. Note which device or application you expect to use.
2. Check Windows Update for a newer driver. Then check the device maker’s official support page for your exact model and Windows version. Microsoft’s driver warning guidance also points readers to Windows Update or the driver manufacturer for an updated, compatible version.
3. Install an official compatible update and restart. Return to Core isolation details and check Memory Integrity again.
4. If no update exists, decide whether you still need the device or software. For something you no longer use, remove it with its official uninstaller or Windows’ device settings; do not delete driver files from Windows folders by hand.
5. If the device is essential and no compatible driver is available, contact the manufacturer or your organisation’s IT team. Keep the warning details so they can identify the driver.

Microsoft documents turning Memory Integrity off as one possible compatibility option, but doing so lowers this layer of kernel protection. Consider that only after checking for updates and confirming that the device is necessary. On a work or school PC, ask IT first. If you make that choice on a personal PC, use the Windows Security switch, follow its restart prompt, and turn protection back on once a compatible driver is available.

What to take away

Memory Integrity is useful when the PC and its drivers support it. If Windows names a driver, start with the driver rather than hiding the warning: check its publisher, look for an official compatible update, and decide whether the device is worth keeping if no update exists. That preserves a clearer choice between a working peripheral and stronger kernel protection.