I cant use Memory Integrity (HVCI)

glasskuter said:

It doesn't. I have SB off and memory integrity ON.

Click to expand...

Value    Description
0    Nothing is required.
1    If present, hypervisor support is needed.
2    If present, Secure Boot is needed.
3    If present, DMA protection is needed.
4    If present, Secure Memory Overwrite is needed.
5    If present, NX protections are needed.
6    If present, SMM mitigations are needed.
7    If present, MBEC/GMET is needed.
SecurityServicesConfigured: This field indicates whether Credential Guard or memory integrity is configured.

Enable memory integrity

This article explains the steps to opt in to using memory integrity on Windows devices.

learn.microsoft.com

glasskuter said:

View attachment 119499

Click to expand...

dacrone said:

What peripherals do you have connected to the pc?

Click to expand...

glasskuter said:

Are you asking me or the OP? I have mouse, KB, 2 external nvme drives.

Click to expand...

glasskuter said:

This is Greek to me and I'm confused. Does your response in post #27 indicate that mine or his report does not look right. For me, This is coming right after a clean install of 24h2 4 weeks ago.

Click to expand...

If the Core isolation options are greyed out, you may be able to enable the features from the Registry:

1. Open Start.
2. Search regedit and click the top result to open the Registry Editor.
3. Browse the following path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity
4. Double-click the Enabled key and change its value from 0 to 1.
5. Click the OK button.
6. Restart

Click to expand...

How to enable Core isolation's Memory integrity feature on Windows 11

Here's how and why to enable (or disable) Core isolation's Memory integrity feature on Windows 11.

www.windowscentral.com

XxXxX said:

you should be able to force memory integrity via the registry. Enable Core isolation from Registry.

the information is available here.

How to enable Core isolation's Memory integrity feature on Windows 11

Here's how and why to enable (or disable) Core isolation's Memory integrity feature on Windows 11.

www.windowscentral.com

Click to expand...

Enable memory integrity

This article explains the steps to opt in to using memory integrity on Windows devices.

learn.microsoft.com

zbook said:

In case there is instability after manually turning on memory integrity it may be able to be turned off by booting to Windows RE > command prompt:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f

Enable memory integrity

This article explains the steps to opt in to using memory integrity on Windows devices.

learn.microsoft.com

Click to expand...

Almighty1 said:

Microsoft has a Powershell tool called DG Rediness that can enable or disable several things which works when nothing else will:

Download Device Guard and Credential Guard hardware readiness tool from Official Microsoft Download Center

Use this tool to see if your hardware is ready for Device Guard and Credential Guard. You can also use this to enable Device Guard or Credential Guard.

www.microsoft.com

Code:

Usage:
Usage: DG_Readiness_Tool_v3.6.ps1 -[Capable/Ready/Enable/Disable] -[DG/CG/HVCI] -[AutoReboot] -Path
Log file with details is found here: C:\DGLogs

To Enable DG/CG. If you have a custom SIPolicy.p7b then use the -Path parameter else the hardcoded default policy is used
Usage: DG_Readiness_Tool_v3.6.ps1 -Enable OR DG_Readiness.ps1 -Enable -Path <full path to the SIPolicy.p7b>

To enable only HVCI
Usage: DG_Readiness_Tool_v3.6.ps1 -Enable -HVCI

To enable only CG
Usage: DG_Readiness_Tool_v3.6.ps1 -Enable -CG

To Verify if DG/CG is enabled
Usage: DG_Readiness_Tool_v3.6.ps1 -Ready

To Disable DG/CG.
Usage: DG_Readiness_Tool_v3.6.ps1 -Disable

To Verify if DG/CG is disabled
Usage: DG_Readiness_Tool_v3.6.ps1 -Ready

To Verify if this device is DG/CG Capable
Usage: DG_Readiness_Tool_v3.6.ps1 -Capable

To Verify if this device is HVCI Capable
Usage: DG_Readiness_Tool_v3.6.ps1 -Capable -HVCI

To auto reboot with each option
Usage: DG_Readiness_Tool_v3.6.ps1 -[Capable/Enable/Disable] -AutoReboot

Please post the output for the following.

So what you would do is the following in Powershell:
#1

Code:

./DG_Readiness_Tool_v3.6.ps1 -Enable

which would enable DG/CG/HVCI
Reboot and then continue with #2-#5

#2

Code:

./DG_Readiness_Tool_v3.6.ps1 -Capable

which is to Verify if this device is DG/CG Capable

#3

Code:

./DG_Readiness_Tool_v3.6.ps1 -Capable -HVCI

which is to verify if device is HVCI capable

#4

Code:

./DG_Readiness_Tool_v3.6.ps1 -Ready

which is to verify if DG/CG is enabled/disabled

#5

Code:

./DG_Readiness_Tool_v3.6.ps1 -Ready -HVCI

which is to verify if HVCI is enabled/disabled

Click to expand...

Almighty1 said:

@345boost - Something tells me that is the actual boot screen and not the BIOS.
Not sure if enabling verbose mode will help so it will show where it got stuck which is done as follows with registry editor.

Before doing that, can you take a screenshot of msinfo32.exe after you run it?

Code:

To use enable verbose status messages by editing the registry, follow these steps:

[1] Click Start > Run.
[2] In the Open box, type regedit, and then click OK.
[3] Locate and then click the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
[4] On the Edit menu, point to New, and then click DWORD (32-bit) Value.
[5] Type verbosestatus, and then press ENTER.
[6] Double-click the new key that you created, type 1 in the Hexadecimal Value data box, and then click OK.
[7] Quit Registry Editor.

Then reboot, if you want to disable verbose mode, just go back to the verbosestatus and change it to 0 for the Hexadecimal Value data box.

And then let's try something else. Can you take a photo of your BIOS settings screen? The main one for now and then I'll tell you what other screens to show after I know what it looks like.

Click to expand...