Windows Memory Integrity has become one of those security options you see in the Windows Security app . It sounds important, but at the same time, you've heard it can eat up a few FPS in your games. It's not uncommon to feel torn between pushing your PC to its limits and keeping it well-protected against malware and exploits.
Before deciding whether to activate or deactivate it, it's important to understand exactly what it does, what your system gains in terms of protection, how much you might lose in performance, and how to play with all these settings (VBS, hypervisor, drivers, etc.) without messing things up and ending up with an unstable or less secure PC.
What is memory integrity in Windows and how does it work?
Windows' so-called "memory integrity" is actually the user-friendly interface for a larger security technology: virtualization-based security, or VBS. Both work together and are designed to protect the most sensitive part of the system, the kernel, from highly sophisticated attacks.
Windows relies on the system's built-in hypervisor to create an isolated virtual environment that acts as a root of trust. This environment assumes that, in the worst-case scenario, the kernel could be compromised. Therefore, it moves certain critical security checks to a protected space separate from "normal" Windows.
Within this protected environment, kernel-mode code integrity is enforced . Essentially, it verifies that the drivers and code intended for execution in the kernel are signed, trusted, and have not been tampered with. If anything that violates these rules is detected, it is not executed.
Memory integrity, as such, adds another layer: it controls and restricts how kernel memory is allocated and used . Kernel memory pages are only marked as executable after passing integrity checks. Furthermore, once they are executable, they are no longer writable. This greatly complicates matters for exploits that attempt to inject code or modify critical memory structures.
Among other things, this feature protects the modification of the Control Flow Guard (CFG) bitmap in kernel mode and strengthens the code integrity process that validates that privileged processes have valid and trusted certificates.
Hardware requirements and when it activates automatically
Microsoft cannot simply activate this protection on any older PC, as it relies on modern CPU, firmware, and storage features. Therefore, memory integrity is only automatically enabled if the computer meets a set of minimum requirements.
In clean installations of Windows 11, and in some Windows 10 systems (such as S-mode editions) on compatible hardware, memory integrity is enabled by default . It is also enabled by default on systems with a protected kernel. On other systems, it is left to the user or administrator to decide whether to turn it on.
In general, the system should have a modern processor with advanced virtualization and mitigation support . For example, an 8th generation Intel processor or later, an AMD processor with Zen 2 architecture or later, or recent Qualcomm Snapdragon SoCs. Additionally, x64 systems require a minimum of 8 GB of RAM to ensure the system doesn't crash when setting up the virtualized environment.
It is also required that the system disk be an SSD of at least 64 GB , that the BIOS/UEFI have virtualization enabled, and that the drivers installed on the system be compatible with HVCI (Hypervisor-Enforced Code Integrity). Without these requirements, automatic activation will not occur, and VBS or memory integrity may remain disabled.
OEMs and administrators preparing images can force memory integrity to be enabled by default by configuring specific registry keys, including values such as Enabled , WasEnabledBy , and the boot identifier (BootId) that Windows uses to revert the feature if it detects critical boot crashes caused by it.
How to enable memory integrity (VBS and HVCI) from the system
Beyond the switch visible in Windows Security, memory integrity and VBS are controlled with registry keys and policies that allow for fine-tuning of behavior. This is especially useful in businesses and organizations.
In the Windows Registry, virtualization-based security is governed from the path HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard . This defines whether VBS is enabled, what level of platform security is required (Secure Boot only, Secure Boot + DMA protection, etc.), whether configuration is locked from UEFI, and whether memory integrity (HVCI) is enabled.
For example, to enable VBS and memory integrity with a typical configuration, entries such as EnableVirtualizationBasedSecurity=1 and RequirePlatformSecurityFeatures are used with values that specify what type of firmware security is required (e.g., 1 for Secure Boot only or 3 for Secure Boot + DMA protection).
Memory integrity itself is managed by the subkey DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity . Setting Enabled=1 activates the feature, and you can control whether the state is locked at the firmware level using the Locked key with different values depending on whether UEFI locking is desired.
For environments where maximum security is desired, there is the option to mark the policy as Mandatory . In this mode, if the hypervisor, the secure kernel, or any of its key modules are not loaded at boot, the system will not continue booting . This is a very aggressive protection that strengthens security. However, it can complicate recovery if compatibility issues arise.
Control via App Control for businesses and PowerShell
In corporate networks, the most convenient way to manage memory integrity is usually through App Control for Business (formerly WDAC) . This allows you to enable HVCI along with application control rules from centralized policies.
The Application Control wizard allows you to create or edit policies and select the "Hypervisor-protected code integrity" option in the rules section. This way, when the policy is deployed, computers will enforce memory integrity according to the defined parameters.
Another option is to use PowerShell. With cmdlets like Set-HVCIOptions , you can automatically modify HVCI options on multiple devices. This is very useful in deployment scripts or initial device configuration.
If you work directly with App Control XML files, you can also adjust the value of the <HVCIOptions> element within the policy, fine-tuning the behavior of hypervisor-protected code integrity without touching the registry one by one on each machine.
To prevent end users from enabling or disabling memory integrity from the Windows Security interface, administrators can manipulate the WasEnabledBy key . Adjusting or deleting this value dims the UI and displays a message such as "This setting is managed by your administrator."
How to check if VBS and memory integrity are actually active
Relying on a simple switch is not enough, especially in security-critical environments. Windows offers several ways to verify the actual state of VBS and memory integrity using WMI, graphical tools, and logs.
One of the most comprehensive is the WMI class Win32_DeviceGuard, accessible from PowerShell with elevated privileges using the command Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuardThe output details which hardware-based protections are available and which ones are currently enabled.
The results include fields such as AvailableSecurityProperties. This indicates whether the device has hypervisor support, Secure Boot, DMA protection, NX protections, SMM mitigations, MBEC/GMET, or APIC virtualization. Each capability is represented by a specific numerical value.
Other important fields include:
- RequiredSecurityPropertiesSecurity features are required to enable VBS.
- SecurityServicesConfigured. To check if Credential Guard, memory integrity, secure boot protection, firmware measurement, hardware-applied stack protection, etc. are configured.
- SecurityServicesRunningThe same as above, but for services currently running.
It is also crucial to check VirtualizationBasedSecurityStatus , where a specific value indicates whether VBS is disabled, enabled but not started, or enabled and running. Finally, the direct memory integrity status can be found in the volatile registry key HKLM\System\CurrentControlSet\Control\CI\State\HVCIEnabled , as well as in the information from MsInfo32 (under the section "Running virtualization-based security services").
SkTool and other advanced resources for diagnosing VBS
For more complex scenarios, such as hypervisor problems, security keys, or errors starting VBS, Microsoft includes a utility called SkTool in the Windows SDK that greatly simplifies the diagnostic process.
SkTool is located in the SDK's bin folder , in a path like “C:\Program Files (x86)\Windows Kits\10\bin\10.0.xxx\<Arch>”, where <Arch> can be x64, arm64, etc. When run without parameters, it displays the current status of the hypervisor and VBS, clearly indicating why it started or why it failed to start.
It supports several command-line modifiers, such as /status (general hypervisor and secure kernel information), /lkey (VSM master key status), and /mitigations (active mitigations). The master key parameter is very useful for troubleshooting Windows Hello or other strong security features when the system fails to accept a PIN or facial recognition.
If, for example, Secure Boot is disabled or something changes in the state measured by the TPM, SkTool may reflect that the VSM master key cannot be unlocked , indicating the specific error code and explaining that a new key has been generated and stored in a UEFI variable.
In addition to SkTool, to check what happened with the automatic enabling of memory integrity during installation, you can consult the setupact.log file , look for the string HVCI and see if it was activated correctly or if the system decided not to enable it because it did not meet some requirement, indicating codes such as VBS_COMPAT_ISSUES with the details of the incompatibilities detected (unsupported architecture, lack of SLAT, absence of UEFI memory attribute table, disk too small, no SSD, etc.).
Impact on performance and gaming: Is it worth disabling?
One of the biggest concerns for many users is the balance between security and performance, especially in gaming. There is evidence and recommendations, including from Microsoft itself, that suggest memory integrity and other VBS features can reduce FPS by several percentage points , around 5% on average depending on the game and hardware.
In some Windows 11 updates, cases have been seen where, combined with other features such as the Virtual Machine Platform (used, for example, to run Android apps), the impact on certain titles was more noticeable, especially on computers with limited resources or with GPUs where any extra overhead is noticeable.
Microsoft, in documentation and communications related to gaming performance issues, has recommended that demanding users temporarily disable both VBS and memory integrity before playing games, and then re-enable them afterward. The practical problem is that these changes usually require restarting the computer, making the operation somewhat cumbersome to perform daily.
From a security standpoint, it's worth remembering that this feature complicates attacks against the kernel and blocks drivers or modules with dubious or vulnerable signatures . If you only use Windows Defender, download programs from sources you don't always control, and generally don't want to take too many risks, permanently disabling memory integrity leaves you more exposed to certain types of advanced malware.
The practical decision usually comes down to assessing your risk profile: if the computer is for work, you manage sensitive information, or you tend to install fewer "unusual" programs, it's advisable to leave memory integrity enabled . If the PC is purely for gaming and squeezing every last FPS out of it, you can consider turning it off while gaming, knowing that you're assuming a higher level of risk, especially if you download executables from untrusted sources.
Step-by-step solutions when memory integrity fails to turn on
When the system insists that it cannot enable memory integrity, several solutions can be pursued, from least to most "aggressive," until the operational function is restored without compromising the stability of the equipment.
The first step is usually to check for and install all available updates from Settings > Windows Update. Often, a simple updated driver or compatibility patch fixes the problem without needing to do anything else.
Next, go to Windows Security > Device Security > Kernel Isolation and, where the error message appears, click on “Check for incompatible drivers.” If a specific driver is listed there, the best course of action is to try updating it from Device Manager by searching for drivers by manufacturer or by downloading the latest version directly from the vendor's website.
If the list doesn't clearly show which file is causing the problem, you can use the command prompt with administrator privileges. From there, you can run commands such as dism /online /get-drivers /format:table to list all installed drivers. From there, the "Published Name" corresponding to the suspicious driver is identified and noted for use in other operations.
In more extreme cases, when an update is not possible, a forced uninstallation of the driver can be performed using tools like pnputil, removing the package from the system and then installing a compatible or alternative version. It is always recommended to create a backup before undertaking this type of procedure.
Other repair measures when all else fails
Not all memory integrity problems stem from drivers. Sometimes the underlying cause is corrupted system files, malware, or a Windows system heavily damaged by years of use, hardware upgrades, or registry errors.
A fairly safe step is to use the System File Checker (SFC) And, when you suspect a hardware problem, run Memtest64Opening a command prompt as administrator and running sfc /scannowWindows scans critical system files and replaces any that are corrupt or missing. After the scan, it is recommended to restart and try enabling memory integrity again from Windows Security.
It's also a good idea to run a full malware scan using Windows Security (Virus & threat protection > Scan options > Full scan) or a reliable third-party solution. Some infections rely on manipulating processes and services in memory and can interfere with this feature's activation.
If the system remains stubborn, the only option is Safe Mode . Restarting and choosing to boot into Safe Mode loads only the minimum drivers. From there, you can try enabling memory integrity and reviewing events. You can even perform cleanups of problematic software with less interference.
For very serious situations, where the computer has become unstable or simply won't boot properly after attempting to force VBS or HVCI, you can use the Windows Recovery Environment (Windows RE) . There, you can disable related group policies, modify registry keys to set Enabled=0 in the memory integrity settings, and restore the system to a more basic state that allows it to boot normally.
Memory integrity within Hyper-V virtual machines
Memory integrity isn't limited to physical machines. You can also protect Hyper-V-based virtual machines in much the same way you protect a regular PC, provided certain requirements are met.
The Hyper-V host must be running at least Windows Server 2016 or Windows 10 version 1607. Additionally, the virtual machine must be a Generation 2 virtual machine with a modern guest operating system (Windows 10, Windows 11, or Windows Server 2016 or later). Within the virtual machine itself, the steps to enable VBS and memory integrity are virtually identical to those on a physical machine.
The protection it provides focuses on preventing malware running within the VM from compromising its kernel. It does not, however, further strengthen the host's security. A host administrator still has control to, for example, disable VM memory integrity using commands like Set-VMSecurity -VMName <VMName> -VirtualizationBasedSecurityOptOut $true.
There are some limitations. Elements such as virtual Fibre Channel adapters are not compatible with memory integrity, and if you want to use them, you must exclude the VM from VBS through the virtual machine's security settings. The same applies to options like AllowFullSCSICommandSet on pass-through disks, which are incompatible with HVCI.
In Windows with nested virtualization, you can have the Hyper-V role within a VM that also has memory integrity enabled. However, you must follow a specific configuration sequence and ensure that both the host and guest VMs meet the requirements.
When should it be kept active and when should it be deactivated?
The million-dollar question, especially if you're concerned about FPS in games, is whether having this feature always on is worth it. On most modern computers and for general use, the performance sacrifice is reasonable compared to the increased security against kernel exploits and malicious drivers.
If you don't use third-party antivirus software, rely on Windows Defender, and frequently download programs from unregulated sites, memory integrity adds an important extra layer of protection. It reduces the attack surface and forces device drivers to undergo stricter vetting.
On the other hand, if your absolute priority is competitive gaming performance and every frame counts, you can consider a middle ground: disable VBS and memory integrity when you know you'll only be gaming, and re-enable them for everyday tasks like browsing, office work, and so on. Keep in mind, though, that these changes require a restart. It's not as convenient as simply pressing a button.
For advanced users or administrators, the key is a thorough understanding of the environment. From workstations handling sensitive data to administrative workstations, everyone typically benefits from having memory integrity enabled as part of a comprehensive security strategy, supported by backups and strict update policies.
Ultimately, understanding how VBS works, how it interacts with drivers, firmware, and performance, and how to diagnose its errors, allows for more informed decisions: maintaining Windows memory integrity as a powerful ally against sophisticated attacks , or disabling it at very specific times, knowing perfectly well what is gained and lost in each case.
