How To Configure Kernel Isolation Memory Integrity In Windows Security Settings

Device Security in the Windows Security App

The Windows Security app lets you check your computer’s hardware-backed defenses and virtualization capabilities. You can open this area by pressing the Start key, typing Windows Security, and clicking the matching result. Once the app opens, click Device Security to see your system’s core protection status.

To open this area, open the Start menu ⊞, type Windows Security, and press Enter. Click on Device Security in the main application window to view your available hardware security options. Depending on your system’s processor architecture and motherboard firmware, this screen displays configurations for Core isolation, Security processor (TPM), and Secure boot.

Core isolation

Core isolation is a Windows security feature that uses virtualization-based security (a technology that creates a secure memory region) to protect vital parts of your operating system. It blocks unauthorized software from reaching core system memory, even if someone gains administrator access to your machine.

To access these settings, navigate to Device Security and click the Core isolation details link. From this sub-menu, you can toggle individual integrity features and review which protections your computer’s hardware currently supports.

Memory integrity

Memory integrity is a Windows setting that stops malware from using low-level drivers to reach your computer's kernel memory (the core part of the operating system). Turning it on makes sure all drivers pass strict security checks before they load, which blocks unsafe code during startup.

To turn on memory integrity using the graphical user interface, open the Windows Security app, click Device Security, and select Core isolation details. Toggle the Memory integrity switch to On.

You must update, remove, or replace the conflicting drivers before you can successfully turn on memory integrity.

Kernel-mode Hardware-enforced Stack Protection

Kernel-mode Hardware-enforced Stack Protection uses your computer processor to watch call stacks and block advanced memory attacks. This defense helps stop hackers from hijacking system drivers and running harmful code on your machine.

To configure this setting, navigate to the Core isolation details screen within the Windows Security app and locate the Kernel-mode Hardware-enforced Stack Protection setting. Toggle the switch to On. Note that this feature requires specific processor capabilities and may prompt you to restart your computer to complete the initialization process.

Memory access protection

Memory access protection works alongside input/output memory management units (IOMMU) to block direct memory access (DMA) attacks from malicious external peripherals. When unauthorized Thunderbolt or PCIe devices attempt to read or write system memory directly, this feature intervenes to block access and protect sensitive data.

Firmware protection

Firmware protection guards the system firmware and UEFI (Unified Extensible Firmware Interface) against rootkits and low-level malware that attempt to persist across reboots. By securing the boot components and validating firmware updates, this feature ensures that attackers cannot tamper with the motherboard's underlying operating instructions.

Local Security Authority protection

Local Security Authority protection stops unauthorized apps from injecting code or stealing memory from the Local Security Authority Subsystem Service (a service that handles user logins and passwords). Turning on this setting keeps your login credentials safe from theft.

To view or configure this setting, navigate to Device Security, click Core isolation details, and locate the Local Security Authority protection option. Toggle the switch to On.

Credential Guard

Credential Guard uses VBS to isolate secrets like NTLM password hashes and Kerberos ticket-granting tickets so that only privileged system software can access them. This stops credential theft attacks from extracting session information out of computer memory.

Microsoft vulnerable driver blocklist

The Microsoft vulnerable driver blocklist maintains an active list of known vulnerable drivers that possess security flaws. When enabled, Windows blocks these vulnerable files from loading, preventing attackers from exploiting them to bypass kernel protections.

Security processor

The security processor refers to your system's Trusted Platform Module (TPM - a dedicated cryptographic microcontroller attached to the motherboard), a dedicated cryptographic microcontroller attached to the motherboard that secures hardware through integrated cryptographic keys.

Security processor details

Security processor details provide diagnostic information regarding your TPM chip, including its specification version, manufacturer details, and driver status. To check this information, open the Windows Security app, go to Device Security, and click Security processor details.

Security processor troubleshooting

Follow the on-screen instructions provided in the security processor dashboard to address hardware communication faults.

Secure boot

Secure Boot is a UEFI security standard that ensures your PC boots using only software trusted by the original equipment manufacturer. It inspects bootloaders, operating system kernel files, and option ROMs before execution begins, stopping unsigned malware from taking over the boot sequence.

Hardware security capability

Hardware security capability summarizes your computer's compliance with baseline device security requirements. It tests whether your system supports core isolation, VBS, and DMA protection out-of-the-box.

PC Manager

PC Manager complements Windows Security by offering auxiliary cleanup tools, system boost functions, and health checks to maintain overall operating system performance and storage hygiene.

Enable memory integrity using Windows Security

Enabling memory integrity through the Windows Security app takes just a few clicks in your device settings. Open the Start menu, type Windows Security, open the app, click Device Security, and open the Core isolation details to turn the switch on.

1. Open the Start menu, type Windows Security, and press Enter.

   

2. Click on Device Security from the left-hand navigation pane or the central dashboard.

   

3. Click the Core isolation details link located under the Core isolation heading.

   

4. Locate the Memory integrity toggle switch.
5. Click the toggle to switch it from Off to On.
6. Restart your computer when prompted to apply the new kernel isolation parameters.

Enable memory integrity using Group Policy

Enabling memory integrity using the Local Group Policy Editor lets administrators turn on this defense across network computers. You can change this policy by opening the Run dialog, typing gpedit.msc, and navigating to the system settings for device guard.

1. Press Windows Key + R, type gpedit.msc, and press Enter to open the Group Policy Editor.
2. In the left-hand tree, navigate to Computer Configuration › Administrative Templates › System › Device Guard
3. Double-click the Turn On Virtualization Based Security setting in the right-hand pane.
4. Select the Enabled option.
5. Under the options list, check the box or configure the dropdown for Virtualization-Based Protection of Code Integrity to enable it with or without UEFI lock.
6. Click Apply and then click OK.
7. Restart the computer to enforce the policy.

Enable memory integrity using registry

Enabling memory integrity through the Registry Editor requires adding a specific key to your Windows system settings. Open the Registry Editor by pressing Windows Key + R, typing regedit, and going to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard to update the values.

1. Press Windows Key + R, type regedit, and press Enter to open the Registry Editor.
2. Navigate to the path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard
3. Create or modify the required DWORD values specified by your enterprise deployment documentation to enforce virtualization-based protection of code integrity.
4. Restart the computer to commit the changes.

Validate enabled VBS and memory integrity features

After applying configuration changes, verifying that VBS and memory integrity are actively running on the hardware layer is essential for confirming successful deployment.

Use Win32_DeviceGuard WMI class

Using the Win32_DeviceGuard WMI class in PowerShell lets you check your security status using a command-line script. Open PowerShell as an administrator and run a specific query command to view your current virtualization and memory integrity settings.

1. Open the Start menu, type PowerShell, right-click Windows PowerShell, and select Run as administrator.
2. Type the following command and press Enter: Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard
3. Review the returned properties to confirm that VirtualizationBasedSecurityStatus displays a value indicating running status.

Use msinfo32.exe

Using the System Information tool (msinfo32) gives you a quick way to check if virtualization and memory integrity are running on your computer. Press Windows Key + R, type msinfo32, and scroll down the summary list to verify your security status.

1. Press Windows Key + R, type msinfo32, and press Enter.
2. In the System Summary window, scroll down the right-hand pane until you locate Virtualization-based security.
3. Verify that the status reads Running alongside virtualization-based security properties such as Credential Guard and Secure Boot configuration.

What to do next

You should now see that memory integrity is active within your Windows Security app or verified through your system diagnostic tools. Next, you can proceed to configure additional hardware protections such as Local Security Authority protection or explore how to manage app execution policies using App Control for Business.