Win 11 Core Isolation - Memory Integrity Option

[alt3rn1ty]

I found something else.
Windows 11 has a thing called "Core Isolations"
Within that group of settings is one called "Memory Integrity", apparently if you can't turn it on it is something to do with incompatible drivers, and it is supposed to list the offending driver/s.
I do not have any listed, but still can not turn "Memory integrity" on.

Recently Microsoft updated something called "Microsoft Vulnerable Driver Blocklist"

So maybe this is blocking a driver I am not aware of causing the DXDiag errors?

Who knows, I cant find anything about it, I think because its so new.

Whatever it is doing which is preventing "Memory Integrity" being switched on I have no idea, nor any idea how to solve it.
I think as mentioned previously this will be stealth fixed at some point by MS, meanwhile its annoying me

Anyway as far as I can tell I don't have any driver issues, I downloaded sysinternals autoruns to see if there was anything to be concerned about in the drivers and found nothing. Games still running fine though <shrugs>

[alt3rn1ty]

Good news I found a solution to the "Memory Integrity" issue.
Apparently it is a Microsoft issue and has been acknowledged by them ..
See this topic https://www.elevenforum.com/t/memory-in ... ost-293603
.. and scroll down to Post #50

I used the Registry edit linked further in that topic which was provided by Microsoft.

Microsoft apparently are working on solutions to the issues created by their recent Driver blocking update. (When they push out an update to this problem is anyones guess)

I also had to ensure Virtual Memory Management was switched on in the BIOS (it was, but on my Dell laptop it was named as "Intel Virtualization")
Plus I had to go to the traditional "Control Panel", Programs and features, "Turn Windows features on and off" .. and enable Virtual Machine Platform

The latter I presume was not enabled by default when I did a new OS installation, where prior to that it was.

After that I checked Windows Updates, surprise surprise there was another update https://support.microsoft.com/en-gb/top ... 10ccbd34e8
(Which is not the update to solve the no drivers listed blocking the "Memory Integrity" feature, but has some resolutions that my newly installed windows was not previously downloading).

Result of all that ..

Code: Select all

---------------
Diagnostics
---------------

Windows Error Reporting:
+++ WER0 +++:
Fault bucket 1398763797016639251, type 5
Event Name: BEX64
Response: Not available
Cab Id: 0

Problem signature:
P1: SecurityHealthService.exe
P2: 10.0.22621.1635
P3: c9cb2878
P4: ucrtbase.dll
P5: 10.0.22621.608
P6: f5fc15a3
P7: 000000000007f61e
P8: c0000409
P9: 0000000000000007
P10: 


+++ WER1 +++:
Fault bucket , type 0
Event Name: BEX64
Response: Not available
Cab Id: 0

Problem signature:
P1: SecurityHealthService.exe
P2: 10.0.22621.1635
P3: c9cb2878
P4: ucrtbase.dll
P5: 10.0.22621.608
P6: f5fc15a3
P7: 000000000007f61e
P8: c0000409
P9: 0000000000000007
P10: 


+++ WER2 +++:
Fault bucket 1398763797016639251, type 5
Event Name: BEX64
Response: Not available
Cab Id: 0

Problem signature:
P1: SecurityHealthService.exe
P2: 10.0.22621.1635
P3: c9cb2878
P4: ucrtbase.dll
P5: 10.0.22621.608
P6: f5fc15a3
P7: 000000000007f61e
P8: c0000409
P9: 0000000000000007
P10: 


+++ WER3 +++:
Fault bucket , type 0
Event Name: BEX64
Response: Not available
Cab Id: 0

Problem signature:
P1: SecurityHealthService.exe
P2: 10.0.22621.1635
P3: c9cb2878
P4: ucrtbase.dll
P5: 10.0.22621.608
P6: f5fc15a3
P7: 000000000007f61e
P8: c0000409
P9: 0000000000000007
P10: 


+++ WER4 +++:
Fault bucket 1398763797016639251, type 5
Event Name: BEX64
Response: Not available
Cab Id: 0

Problem signature:
P1: SecurityHealthService.exe
P2: 10.0.22621.1635
P3: c9cb2878
P4: ucrtbase.dll
P5: 10.0.22621.608
P6: f5fc15a3
P7: 000000000007f61e
P8: c0000409
P9: 0000000000000007
P10: 


+++ WER5 +++:
Fault bucket , type 0
Event Name: BEX64
Response: Not available
Cab Id: 0

Problem signature:
P1: SecurityHealthService.exe
P2: 10.0.22621.1635
P3: c9cb2878
P4: ucrtbase.dll
P5: 10.0.22621.608
P6: f5fc15a3
P7: 000000000007f61e
P8: c0000409
P9: 0000000000000007
P10: 


+++ WER6 +++:
Fault bucket 1398763797016639251, type 5
Event Name: BEX64
Response: Not available
Cab Id: 0

Problem signature:
P1: SecurityHealthService.exe
P2: 10.0.22621.1635
P3: c9cb2878
P4: ucrtbase.dll
P5: 10.0.22621.608
P6: f5fc15a3
P7: 000000000007f61e
P8: c0000409
P9: 0000000000000007
P10: 


+++ WER7 +++:
Fault bucket , type 0
Event Name: BEX64
Response: Not available
Cab Id: 0

Problem signature:
P1: SecurityHealthService.exe
P2: 10.0.22621.1635
P3: c9cb2878
P4: ucrtbase.dll
P5: 10.0.22621.608
P6: f5fc15a3
P7: 000000000007f61e
P8: c0000409
P9: 0000000000000007
P10: 


+++ WER8 +++:
Fault bucket 1398763797016639251, type 5
Event Name: BEX64
Response: Not available
Cab Id: 0

Problem signature:
P1: SecurityHealthService.exe
P2: 10.0.22621.1635
P3: c9cb2878
P4: ucrtbase.dll
P5: 10.0.22621.608
P6: f5fc15a3
P7: 000000000007f61e
P8: c0000409
P9: 0000000000000007
P10: 


+++ WER9 +++:
Fault bucket , type 0
Event Name: BEX64
Response: Not available
Cab Id: 0

Problem signature:
P1: SecurityHealthService.exe
P2: 10.0.22621.1635
P3: c9cb2878
P4: ucrtbase.dll
P5: 10.0.22621.608
P6: f5fc15a3
P7: 000000000007f61e
P8: c0000409
P9: 0000000000000007
P10: 

Which I presume will be solved with Microsoft updates in future, now that I have used their forced enabling of "Memory Integrity".

SFC and DISM dont report any issues, and autoruns still has no issues with my drivers, which all seem up to date.

Everything was fubarred it seems with Microsofts update to Blocking vulnerable drivers on this newly installed OS, but was not listing any drivers it had issues with.

Effing Microsoft and the bright ideas club.

[alt3rn1ty]

I think the fix for the MS Windows Block Incompatible Drivers foobar is happening ..
https://support.microsoft.com/en-us/top ... c2770ee2e8
.. Just downloading now. Fingers crossed this will make my DXDiag errors go away.

[alt3rn1ty]

Nope, thats not it.

[Alan Phipps]

It might be worth taking the MS discussion to off topic as few people are likely to read about it here under this thread title.

[alt3rn1ty]

Yes please alan, it is a bit out of place here now.

[mr.WHO]

I had core isolation issue a few months ago.

Here is my post from W11 topic, maybe you will find it useful:

Recently I had another issue with Windows Defender (probably valid for both Win11 and Win10).

Aparently, out of blue, one day, some old drivers caused my Defender to be unable to trigger Memory Core Isolation.

Had to do some 30 minute search on Google to diagnose and fix the issue.



In case someone has same issue pop-up, here is quick guide how to fix it:
When defender pop-up with warning icon and say it's unable to trigger core isolation, try to trigger it, it will fail and go to the details to see which drivers trigger the problem, it should be like that:
<Driver name>
<version,date>
<oem#.inf> , where # is a ID number on your system (e.g. order of driver instalation, so can differ for each system).



Then identify, what are those drivers and if you can:
- update them - in my case, those were old, no longer used smart card reader drivers...from 2008,which I installed in 2019, but no longer need.
- delete them from WIndows application

For me, the drivers were so old, that they weren't listed in applications, unused, but somehow still noticable by Windows defender.


Therefore I had to dig deeper.

Run commandline/PowerShell as administrator:

type
pnputil /enum-drivers

it will give you the list of drivers currently used by your system.
Try to find the drivers that trigger issue with Defender.
My problematic drivers weren't listed in application list, nor here, so this strongly suggest there were old and redundant.


then type this (remember to have the temp folder created, if you don't have it):
dism /Online /get-drivers /format:table > C:\temp\drivers.txt

it will create a txt file with nice table list of ALL your drivers.
Here, I found the problematic drivers and confirmed their oem#.inf number


Now, finally go back to command line/Powershell and run this (IMPORTANT, be careful and double sure you type the correct driver number, not to delete wrong driver by accident, so if your problematic driver is oem40.inf, type that number)
pnputil /delete-driver oem#.inf

It will delete drivers (+ aparently in case if driver is used, e.g. by some device, it will reject the delete command).

Now you can go back to Windows Defender and trigger core isolation, restart and enjoy again that cheerful green Defender icon.

[alt3rn1ty]

mr.who thank you for posting that, but the problem in my case is there is nothing listed as a problem driver..
https://i.imgur.com/xCthiQ2.png
.. MS are aware of this issue, and are working on a solution, meanwhile I just need to do without the Memory Integrity in Core Isolations. I'm a very careful computer user anyway so I don't think its a big concern, it just bugs the heck out of me that previously I could use this setting and now for apparently no reason after the update to Windows Incompatible Drivers, I cant