Does Turning Off Memory Integrity (HVCI) Make Windows Faster? — What It Means, How to Do It, and How to Decide

You hear that “turning off Memory integrity makes the PC faster,” but when Windows Security shows a warning, you hesitate to change it. This article separates two questions: “can it get faster?” and “is it acceptable to turn it off on my PC?”

The subject is the Memory integrity toggle under Device security > Core isolation in Windows Security. Memory integrity is a feature that protects the core of Windows from attacks that come through drivers; it is not a setting that exists merely to reduce performance. At the same time, Microsoft itself states that on gaming devices, in some scenarios and configurations, it can affect performance.¹

We start with the conclusion and a reading guide by purpose, then explain the mechanism, how to compare performance, the decision criteria, how to verify before and after the change, and the steps for turning it off and back on. If you want to go deeper into the mechanism, see the series article “The Depths of Windows Virtualization (Part 2) — Memory Even the Kernel Cannot See: How VBS, HVCI, and Credential Guard Work.” This article is the introductory entry point to that one.

Assumptions of This Article

1. The Bottom Line First

There are configurations that get faster when it is turned off. But not every PC gets faster, and a performance difference alone does not settle whether it is acceptable to turn it off.

Memory integrity (HVCI) performs the signature verification of drivers loaded into the kernel (the core of the OS) inside an isolated environment created by the hypervisor. By making only memory pages that pass verification executable, and by never allowing writes to executable pages, it makes it harder to take over the PC through a driver.²³

The axis of the decision is “what is this PC used for?” If you measure and find a difference, that difference matters for how you use the PC, you do not play games whose anti-cheat names HVCI in its error, and the PC handles no company assets or sensitive information, then turning it off is an option. Otherwise, keeping it on and looking for another cause is the more practical course.

The Conclusion, and Where to Read More

Even if you only want the steps, read the decision criteria in Chapter 5 and the verification method in Chapter 6 before going on to Chapter 7. The operation that turns it off is short, but the restart and the verification are part of the same job. If the toggle is grayed out and cannot be operated, do not work around an administrator’s setting or a UEFI lock on your own.

In the diagram a solid line marks a relation that always holds and a dashed line marks a conditional one (the conditions are given per relation on the detail page). The full list of relations (28 in total, with evidence and certainty) and the definitions of the main concepts are collected on the knowledge map detail page (in Japanese). Data: JSON-LD / Turtle

2. Separate the Four Terms That Get Mixed Up

First, let us separate the names on the settings screen from the names of the mechanisms behind them. What we are turning off here is “Memory integrity,” not all of the following.

2.1 Memory Integrity (HVCI)

This is the name of the toggle on the Core isolation screen in Windows Security. Formally it is called hypervisor-protected code integrity (HVCI), and Microsoft’s documentation treats “Memory integrity” and “HVCI” as the same thing.² When this article says “turn it off,” this is what it means.

2.2 Core Isolation

This is the name of a screen in Windows Security. It groups the security features that “protect against malicious software by isolating Windows core processes in memory,” and Memory integrity is one toggle on it.³

The screen may also list other items, such as Kernel-mode Hardware-enforced Stack Protection. You often see the phrase “turn off Core isolation,” but the screen as a whole has no switch; what is actually being switched is the Memory integrity toggle.

2.3 Virtualization-Based Security (VBS)

This is the mechanism that Memory integrity rests on. It uses the Windows hypervisor to create an isolated environment that stays protected even if the OS kernel is taken over, and houses security features there.⁵

Memory integrity is one of the features that sit on top of VBS; Credential Guard (protection of domain credentials) and others also sit there. Turning off Memory integrity does not necessarily stop VBS itself (Chapter 6).

2.4 Virtual Machine Platform (VMP) and Hyper-V

This is an item under “Turn Windows features on or off,” and it is the foundation for running lightweight virtual machines such as WSL 2.⁶ In Microsoft’s guidance on gaming performance, it is listed alongside Memory integrity as a factor in the performance impact.¹ It is a separate toggle and a separate feature from Memory integrity.

Note that Windows Sandbox is enabled not through VMP but through a dedicated optional feature called “Windows Sandbox”; it does not depend on VMP, but it runs on the same Windows hypervisor.⁷

flowchart TB
    accTitle: How the four terms relate
    accDescr: Shows the containment relationship in which Virtualization-based Security (VBS) and Virtual Machine Platform sit on the Windows hypervisor, Memory integrity and Credential Guard sit on VBS, and the Core isolation screen in Windows Security displays the Memory integrity toggle
    hv["Windows hypervisor"]
    vbs["Virtualization-based Security (VBS)"]
    vmp["Virtual Machine Platform"]
    hvci["Memory integrity (HVCI)"]
    cg["Credential Guard etc."]
    ui["Core isolation screen (shows the toggle)"]
    hv --> vbs
    hv --> vmp
    vbs --> hvci
    vbs --> cg
    ui -.->|"reflects the setting"| hvci

Figure 1: “Core isolation” is the name of a screen, “Memory integrity” is a toggle on it, VBS is its foundation, and VMP is a separate feature that sits on the same hypervisor.

In other words, what people mean by “it gets faster when you turn it off” is really two features that sit on the hypervisor (Memory integrity and VMP), and the toggle on the settings screen switches off only the former.

3. What Memory Integrity Does

This chapter goes in the order what it protects → why it affects performance → whether it is enabled on your PC in the first place. If you want to know the expected performance difference first, you can start from the table in Chapter 4.

3.1 Moving the Driver Checkpoint Outside the Kernel

Windows has always had a mechanism (code integrity) that checks whether drivers loaded into the kernel are properly signed. The problem is that the code performing that check is itself inside the kernel. An attacker who has taken over the kernel can replace the check itself.

Memory integrity runs this check inside the isolated environment of VBS.² The isolated environment is guarded by the hypervisor, so even an attacker who has taken over the kernel cannot reach the check. In addition, it imposes the following two rules on kernel memory.²

• A kernel memory page becomes executable only after it passes verification.
• An executable page never becomes writable.

flowchart TB
    accTitle: Driver loading while Memory integrity is enabled
    accDescr: A driver-load request receives signature verification in VBS's isolated environment; if it passes it is allowed as an executable, non-writable page, and if it fails the load is blocked and recorded in the CodeIntegrity Operational log
    req["Driver-load request"] --> chk{"Verify the signature in the isolated environment"}
    chk -->|"Pass"| ok["Allowed as executable, non-writable"]
    chk -->|"Fail"| ng["Load blocked"]
    ng --> log["Recorded in the CodeIntegrity log (3087)"]

Figure 2: Because the checkpoint is outside the kernel, taking over the kernel does not let you replace the checkpoint.

With these rules in place, even if a vulnerability lets an attacker rewrite kernel memory, the rewritten content cannot be put into execution: a writable page cannot be executed, and an executable page cannot be written.² The description in Windows Security, “makes it harder for malicious programs to use low-level drivers to hijack your PC,”³ refers to this.

3.2 Why It Affects Performance

Protection has a processing cost. Here we separate the cost of using a hypervisor from the cost of Memory integrity managing execute permissions.

Cost 1: A Hypervisor Runs Underneath Windows

VBS requires a hypervisor, and the hypervisor requires a CPU feature called SLAT (second level address translation).⁵ Because the host Windows itself runs as a partition on top of the hypervisor, memory address translation becomes two-level, and that adds overhead. This structure is covered in detail in “Where Is Your Windows Actually Running?”

Cost 2: Managing Whether Kernel Memory May Be Executed

Memory integrity enforces the rule “only pages that pass verification are executable” not in the kernel itself but through the hypervisor’s memory protection. This is where the CPU generation makes a difference.

Microsoft’s documentation explains that Memory integrity works better on processors with Mode-Based Execution Control (MBEC) on Intel Kaby Lake (7th generation) and later or Guest Mode Execute Trap (GMET) on AMD Zen 2 and later. Older processors rely on an emulation called Restricted User Mode, so the performance impact is larger.⁸

MBEC is a feature that splits memory execute permission into “may execute in user mode” and “may execute in kernel mode” so that the hardware can tell them apart.⁹ Memory integrity wants to restrict only kernel-mode execution, so with this distinction it can leave the work to the CPU. Without it, the hypervisor takes over the work in software.

flowchart TB
    accTitle: The two places where the performance cost arises
    accDescr: The performance cost of Memory integrity arises in two places, the two-level address translation caused by the hypervisor sitting underneath, and the enforcement of execute permission for kernel pages on the hypervisor side, and the size of the latter depends on whether MBEC/GMET is present
    hvci["Memory integrity enabled"] --> c1["Hypervisor sits under the OS"]
    hvci --> c2["Hypervisor enforces execute permission"]
    c1 --> t1["Address translation becomes two-level"]
    c2 --> q{"Does the CPU have MBEC / GMET?"}
    q -->|"Yes"| small["Handled in hardware (smaller impact)"]
    q -->|"No"| big["Emulation (larger impact)"]

Figure 3: The size of “it gets faster when you turn it off” is decided mainly by the branch on the right.

Whether your CPU has MBEC/GMET can be seen from whether AvailableSecurityProperties of Win32_DeviceGuard, introduced in Chapter 6, contains 7.⁸

3.3 Is It Even Running on Your PC?

Before moving on to the performance comparison, one more check is needed. Windows 11 does not automatically mean that Memory integrity is running.

Memory integrity is enabled by default when Windows 11 is clean-installed on supported hardware; it is not enabled automatically on an upgrade from Windows 10.⁴ The conditions for automatic enablement are as follows.⁴

In other words, on a PC upgraded from Windows 10 and used as is, a PC that does not meet the conditions, or a PC that had even one incompatible driver, it may have been off from the start. If you felt that “it got faster after I turned it off” in that state, something else was responsible. First check the current state using the method in Chapter 6.

flowchart TB
    accTitle: Conditions under which Memory integrity is enabled by default
    accDescr: On a clean install of Windows 11, it is enabled by default when all of the conditions are met, the CPU generation, 8 GB or more of memory, an SSD of 64 GB or more, compatible drivers, and virtualization enabled in firmware, and it is not enabled on an upgrade or when the conditions are not met
    start["Windows 11 installed"] --> how{"Clean install?"}
    how -->|"Upgrade"| off1["Not enabled automatically"]
    how -->|"Yes"| cond{"CPU, RAM, SSD, driver conditions"}
    cond -->|"Met"| on["Enabled by default"]
    cond -->|"Not met"| off2["Not enabled (can be enabled manually)"]

Figure 4: “My PC was off from the start” is not unusual. Look at the current state before you experiment.

4. Does It Really Get Faster? — Material for the Decision

The point of this chapter is that a performance impact is possible, but no single percentage can be given for how much faster it gets. We read the official explanation, the expectation for each configuration, and measurement on your own PC separately.

4.1 What Microsoft Says

Microsoft’s support article “Options to optimize gaming performance in Windows 11” states that Windows 11 uses virtualization for Memory integrity (HVCI) and Virtual Machine Platform (VMP), and that on gaming devices, in some scenarios and some configurations, there may be a performance impact from having Memory integrity and VMP on, and it gives the steps for turning each of them off.¹

So “it can get faster” is Microsoft’s official position. But it comes with the qualifier “in some scenarios and some configurations,” and no figure is given for how much faster.

4.2 Conditions Where a Difference Is Likely, and Where It Is Not

Here is what the mechanism in 3.2 tells us, by situation. The “expectation” written here is a tendency derived from the mechanism, not measurements published by Microsoft. For your own PC, measure using the method in 4.3.

flowchart TB
    accTitle: Decision flow for whether turning it off makes the PC faster
    accDescr: First confirm whether Memory integrity is currently running; if not, look for another cause; if it is, split the expectation by whether the CPU has MBEC/GMET and whether the bottleneck is the CPU, and finally decide by measuring under the same conditions
    s["Feels slow"] --> run{"Is Memory integrity running?"}
    run -->|"No"| other["Look for another cause"]
    run -->|"Yes"| cpu{"Does the CPU have MBEC / GMET?"}
    cpu -->|"No"| likely["A difference is likely"]
    cpu -->|"Yes"| bn{"Is the bottleneck the CPU?"}
    bn -->|"Yes"| maybe["A difference can appear"]
    bn -->|"No (GPU etc.)"| small["Difference expected to be small"]
    likely --> measure["Measure under the same conditions"]
    maybe --> measure
    small --> measure

Figure 5: “Will it get faster?” is decided by the PC’s configuration. What settles it in the end is not knowledge of the mechanism but measurement on your own PC.

4.3 Measure, Do Not Guess

“It feels faster since I turned it off” is not enough to judge the effect of the setting. You restarted the PC to change the setting, and that alone makes it temporarily lighter.

Before you actually change the setting, check in Chapter 5 whether this is a PC on which it is acceptable to turn it off. If you then compare, keep the following points in mind. The order of measurement is as shown in Figure 6: “confirm it is on and measure → turn it off and restart → confirm it is off and measure under the same conditions.” Chapter 6 covers how to verify, and Chapter 7 covers how to change the setting.

The State and the Conditions to Pin Down When Measuring

• Confirm that the state really changed. After turning it off and restarting, use the method in Chapter 6 to confirm that Memory integrity has disappeared from the running services. If you measure without doing this, you may be comparing on against on.
• Keep the conditions the same. AC power or battery, the power mode, what is running in the background, and for a game the same scene and the same quality settings. How to align the comparison conditions is covered in “How to Correctly Compare the Speed of Different Program Versions on Windows.”

Measure Several Times, and Ask Whether the Difference Matters for How You Use the PC

Use something that produces a number: a game’s built-in benchmark, or the time a fixed task takes. Measure about three times each with it on and off, and compare the medians.

What you look at is not just whether the number went up. A 2% rise in average fps is indistinguishable on screen. Whether the minimum fps (stutter) improved matters more to how it feels. Check whether the difference is large enough to matter for how you use the PC.

flowchart TB
    accTitle: The on/off comparison procedure
    accDescr: Confirm the current state and fix the conditions, run the same measurement several times, change the setting and restart, confirm that the state changed, repeat the same measurement, and decide by whether the size of the difference matters for how the PC is used
    a["Confirm the current state (Chapter 6)"] --> b["Fix the conditions and measure 3 times"]
    b --> c["Change the setting and restart"]
    c --> d["Confirm that the state changed"]
    d --> e["Measure 3 times under the same conditions"]
    e --> f{"Is the difference large enough to matter?"}
    f -->|"Yes"| g["Go to the decision in Chapter 5"]
    f -->|"No"| h["Turn it back on and look for another cause"]

Figure 6: Do not confuse the lightness right after a restart with the effect of the setting. Confirming the state is the precondition for measuring.

If There Is No Difference, Look for Another Cause

If no difference appeared, the cause of the slowness lies elsewhere. For how to investigate when the whole PC is slow, see “WPR/WPA in Practice — An Introduction to System-Wide Performance Investigation for “the Whole PC Is Slow”,” and if Task Manager’s Efficiency mode might be the cause, see “What Is Windows Efficiency Mode? - The Green Leaf Icon and How to Turn It Off.”

5. Is It Acceptable to Turn It Off? — What You Lose

“It gets faster” and “it is acceptable to turn it off” are separate decisions. Even if you measure and find a difference, that alone is not a reason to turn it off. Weigh the protection you lose against what the PC is used for.

5.1 What You Lose

There are three things to be aware of: weaker protection, a warning, and software that stops working.

The Barrier Against Code Injection into the Kernel Is Gone

Memory integrity makes it harder to take over the kernel through a vulnerable driver or an unsigned driver.² When it is off, against that kind of attack the PC is back to being an ordinary Windows.

Windows Security Shows a Warning

From Windows 11 22H2 onward, when Memory integrity is off, Windows Security displays a warning, and a warning mark appears on the taskbar icon and in the notification center as well. The warning can be dismissed from the Windows Security screen.⁸

Games That Require HVCI May No Longer Start

Some anti-cheat systems (such as Riot Games’ Vanguard) use HVCI (Memory integrity) on Windows 11 to verify system integrity.

Riot’s support article tells you to enable each of the security features listed in the VAN: RESTRICTION error (any of TPM 2.0, Secure Boot, Memory integrity, and IOMMU). On a PC where the error names HVCI, the game will not start unless it is on.¹⁰

This is not a condition imposed uniformly on every PC, but turning it off for “the game you want to speed up” can leave another game unable to start.

flowchart TB
    accTitle: What you lose when Memory integrity is turned off
    accDescr: When Memory integrity is turned off, the barrier against code injection into the kernel is gone, on Windows 11 22H2 and later Windows Security keeps showing a warning, and games whose anti-cheat names HVCI in its error no longer start
    off["Memory integrity off"] --> l1["Barrier against kernel code injection is gone"]
    off --> l2["Windows Security shows a warning"]
    off --> l3["Games that name HVCI stop working"]

Figure 7: You lose three things. Decide whether the speed difference is worth it only after looking at these three.

5.2 Guidelines for the Decision

flowchart TB
    accTitle: Deciding whether it is acceptable to turn it off
    accDescr: PCs involved with business data or the office network stay on, PCs that play games whose anti-cheat names HVCI in its error stay on, only a dedicated machine where measurement showed a difference is a candidate for off, and everything else stays on and looks for another cause
    q1{"Involved with business data or the office network?"} -->|"Yes"| keep1["Keep it on (look for another cause)"]
    q1 -->|"No"| q2{"Play games that name HVCI?"}
    q2 -->|"Yes"| keep2["Keep it on"]
    q2 -->|"No"| q3{"Did measurement show a difference?"}
    q3 -->|"Yes"| off["Off is an option (turn it back on if the use changes)"]
    q3 -->|"No"| keep3["Keep it on"]

Figure 8: Only a PC that reaches the final branch is a candidate for turning it off.

6. Checking Whether It Is Off

From here on we prepare for the operation. Learn the verification method first, and use the same method before and after the change. It is important not to conclude “it was on” or “it is now off” just from looking at the toggle.

6.1 The Toggle Shows the Setting, Not the Running State

The toggle on the Core isolation screen in Windows Security displays the value of the setting. Right after enabling it while waiting for a restart, or while Memory integrity could not start at boot because of a compatibility problem, the toggle can still look on. Check the running state in one of the following two ways.⁴

Check on Screen: msinfo32 (System Information)

1. Run msinfo32 from Win + R.
2. Look at the “Virtualization-based security” section near the bottom of “System Summary.”
3. If “Services Running” includes “Hypervisor enforced Code Integrity,” Memory integrity is running.⁸

Check by Number: PowerShell

Run the following in a PowerShell window opened as administrator.⁸

Get-CimInstance -Namespace root/Microsoft/Windows/DeviceGuard `
    -ClassName Win32_DeviceGuard |
    Select-Object VirtualizationBasedSecurityStatus,
                  SecurityServicesConfigured,
                  SecurityServicesRunning,
                  AvailableSecurityProperties

Read the output as follows.⁸

After turning it off and restarting, it succeeded if 2 has disappeared from SecurityServicesRunning. If SecurityServicesConfigured no longer contains 2 either, it is off in the settings as well. Read the state of VBS as a whole and the running state of Memory integrity separately.

flowchart TB
    accTitle: The flow for checking whether Memory integrity is running
    accDescr: Query Win32_DeviceGuard; if SecurityServicesRunning contains 2, Memory integrity is running, and if not, it is not running. If SecurityServicesConfigured on the settings side has 2 but it is not running, suspect a pending restart or a compatibility problem at boot
    q0["Query Win32_DeviceGuard"] --> r{"Does SecurityServicesRunning contain 2?"}
    r -->|"Yes"| on["Memory integrity is running"]
    r -->|"No"| c{"Does Configured contain 2?"}
    c -->|"Yes"| wait["Pending restart or compatibility problem at boot"]
    c -->|"No"| off["Off in both settings and operation"]

Figure 9: Look at Running, not Configured. Read the setting and the operation separately.

6.2 Configurations Where the Hypervisor Remains After Turning It Off

Stopping Only Memory Integrity Does Not Necessarily Stop the Foundation

Memory integrity is one of the features that sit on top of VBS. What you turned off is Memory integrity alone; whether VBS is enabled is managed by a separate setting (EnableVirtualizationBasedSecurity). Microsoft’s documentation explicitly describes a configuration that “enables VBS only (without Memory integrity).”⁸

Furthermore, if you use Hyper-V, WSL 2, Windows Sandbox, or Virtual Machine Platform, the hypervisor keeps starting for their sake.⁶

Of the two costs we saw in 3.2, the “hypervisor sits under the OS” one remains in this case even after turning it off. If “Virtualization-based security” in msinfo32 still says “Running” after you turn off Memory integrity, the foundation is still there.

flowchart TB
    accTitle: What remains after Memory integrity is turned off
    accDescr: Even when the Memory integrity toggle is turned off, if any of the VBS enablement setting, Hyper-V, WSL 2, Windows Sandbox, or Virtual Machine Platform is enabled, the hypervisor keeps running and the cost of two-level address translation remains
    off["Memory integrity off"] --> q{"Anything else using the hypervisor?"}
    q -->|"VBS setting, Credential Guard"| stay1["Hypervisor remains"]
    q -->|"Hyper-V, WSL 2, Sandbox, VMP"| stay2["Hypervisor remains"]
    q -->|"Nothing"| gone["The foundation may stop as well"]
    stay1 --> cost["Two-level address translation cost remains"]
    stay2 --> cost

Figure 10: The toggle switches off only Memory integrity. If other features need the hypervisor, the foundation stays as it is.

Stopping the Whole Foundation Is Outside the Scope of This Article

There are settings that disable VBS itself and configurations that do not start the hypervisor, but they take away every feature on top of VBS, including Credential Guard, as well as Hyper-V, WSL 2, and Windows Sandbox. That is a far larger change than “turning off Memory integrity,” and it is not the same thing. This article does not cover those steps. If you want to make that decision with an understanding of the mechanism, read Parts 1 and 2 of the series first.

7. How to Turn It Off

Normally you operate from the Windows Security screen in 7.1. Section 7.2 covers what to check when it cannot be operated, and 7.3 is an alternative for environments where the screen cannot be used. VMP in 7.4 is a separate feature, so it is not a step you carry out in sequence to turn off Memory integrity.

7.1 From Windows Security (The Standard Procedure)

Turning It Off: Change the Setting, Restart, and Verify

1. Open “Windows Security” from Start.
2. Select “Device security” in the left menu.
3. Open “Core isolation details” under “Core isolation.”
4. Switch the “Memory integrity” toggle off. If the administrator confirmation (UAC) appears, allow it.
5. Restart the PC. The change does not take effect until you restart.¹
6. After the restart, confirm that it is off using the method in 6.1.

Turning It Back On: Use the Same Screen

To restore it, switch the toggle on in the same screen and restart. When you turn it on, a scan for incompatible drivers may run. If a list appears, do not force it; handle it in the order given in Chapter 8.

If you are comparing, confirm the running state before and after the change and then measure using the method in 4.3. If the difference does not matter for how you use the PC, turn it back on and look for another cause.

flowchart TB
    accTitle: Steps for turning off Memory integrity from Windows Security
    accDescr: From Device security in Windows Security, open Core isolation details, switch the Memory integrity toggle off, restart, and confirm with msinfo32 or Win32_DeviceGuard that it is off
    s1["Open Windows Security"] --> s2["Device security"]
    s2 --> s3["Core isolation details"]
    s3 --> s4["Memory integrity off"]
    s4 --> s5["Restart"]
    s5 --> s6["Verify with the method in Chapter 6"]

Figure 11: The procedure itself is short. The parts that get skipped are the last two (restart and verify).

7.2 When the Toggle Is Grayed Out and Cannot Be Touched

On a company or school PC, do not work around it yourself; ask the administrator. When the toggle is grayed out and cannot be operated, the reasons include the following.

Locked by Policy or the Registry

If the toggle is grayed out and says “This setting is managed by your administrator,” the PC’s setting is locked by Group Policy, Intune, or similar, or the screen has been disabled through the registry.⁸ On a company or school PC, this is the administrator’s intent.

Enabled with a UEFI Lock

On a PC deployed with “Enabled with UEFI lock” selected under the Group Policy setting “Turn On Virtualization Based Security,” the setting is stored in a UEFI (firmware) variable, so Memory integrity cannot be turned off remotely or through a policy update.⁸

Undoing it requires removing the policy or registry setting and then a person in front of that PC carrying out the steps to clear the configuration stored in UEFI. The Credential Guard documentation, which uses the same UEFI lock, shows the procedure: delete the EFI variable with bcdedit under administrator rights, and physically accept the confirmation prompt shown at restart.¹¹

Merely disabling Secure Boot in the UEFI menu does not clear the stored configuration. It can also prompt you for the BitLocker recovery key. This setting exists precisely so that it cannot be turned off casually, so again it is the administrator’s domain.

flowchart TB
    accTitle: Isolating the cause when the toggle is grayed out
    accDescr: If the toggle is grayed out, it is either managed by an administrator (policy or registry) or under a UEFI lock (which requires clearing the configuration stored in UEFI in front of the PC); in both cases do not work around it yourself but consult the administrator
    gray["Toggle is grayed out"] --> why{"What reason is displayed?"}
    why -->|"Managed by your administrator"| pol["Locked by policy or the registry"]
    why -->|"UEFI lock"| lock["Requires clearing the UEFI configuration in front of the PC"]
    pol --> ask["Consult the administrator"]
    lock --> ask

Figure 12: Gray is not a malfunction; it is the sign that someone deliberately locked it.

7.3 Setting It Through the Registry (When the Screen Cannot Be Used)

This method is an alternative for environments where the Windows Security screen cannot be used, or when you want to set it from a script. It is not a way to bypass an administrator’s setting. And when turning it back on, use the screen in 7.1.

The Value and Command for Turning It Off

The setting values Microsoft documents for enabling and disabling Memory integrity are as follows.⁸

Run the following in a terminal opened as administrator, then restart.

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 0 /f

This is the same operation Microsoft gives as the procedure for recovering, from the recovery environment (Windows RE), a PC that can no longer boot after Memory integrity was enabled.⁸

Why Not to Write 1 to the Registry When Turning It Back On

When restoring it, do not write 1 back to the registry; turn it on from the Windows Security screen in 7.1. When you turn it on from the screen, the scan for incompatible drivers runs first, and if any are found a list is displayed (Chapter 8).³

If you write 1 in the registry, Memory integrity is demanded at the next boot without passing through that scan. If an incompatible driver remains, you invite exactly the boot failure that Chapter 8 warns about. Enabling it through policy or the registry is acceptable only after you have confirmed in the incompatible-driver list and the CodeIntegrity log that there is no problem.

When the Change Has No Effect, or Reverts

On a PC where Locked under the same key is 1 (UEFI lock), changing this value has no effect.⁸ And on a PC managed by an organization’s policy, the setting reverts the next time the policy is applied. The registry is “a substitute for the screen,” not “a means of overriding the administrator’s setting.”

flowchart TB
    accTitle: Conditions under which the registry setting has no effect
    accDescr: Even if Enabled under HypervisorEnforcedCodeIntegrity is set to 0, it has no effect if Locked under the same key is 1 (UEFI lock), and on a PC managed by an organization's policy the setting reverts the next time the policy is applied. Turn it back on from the Windows Security screen, not the registry
    reg["Set Enabled to 0 and restart"] --> lk{"Is Locked 1 (UEFI lock)?"}
    lk -->|"Yes"| no1["No effect (UEFI-side release required)"]
    lk -->|"No"| pol{"Managed by policy?"}
    pol -->|"Yes"| no2["Reverts at the next policy application"]
    pol -->|"No"| ok["Turned off (verify in Chapter 6)"]
    ok -.-> back["Turn it back on from the screen (the scan runs)"]

Figure 13: The registry value writes the same setting as the screen; it cannot stand above the lock or the policy.

7.4 Virtual Machine Platform (VMP) Is a Separate Procedure

Microsoft’s guidance on gaming performance also lists VMP, but it is a separate feature from Memory integrity. You do not need to remove VMP as well in order to turn off Memory integrity.

Check Which Features You Use Before Removing It

VMP is a prerequisite for WSL 2.⁶ If you remove it on a PC that uses WSL 2, or Docker Desktop on top of WSL 2, those stop working.

Windows Sandbox is enabled through a dedicated optional feature rather than VMP, so it still works after VMP is removed.⁷ But because Sandbox also runs on the same hypervisor, as long as you keep using it, it is one of the “foundation remains” factors we saw in 6.2.

The criterion is “remove it if you do not use it,” not “remove it because it gets faster.”

The Operation When VMP Is Not Used

VMP is switched off not in Windows Security but under “Windows Features.”¹

1. Search for “Windows features” from Start and open “Turn Windows features on or off.”
2. Clear the “Virtual Machine Platform” check box and press “OK.”
3. Restart.

flowchart TB
    accTitle: Is it acceptable to remove Virtual Machine Platform?
    accDescr: If you use features that depend on Virtual Machine Platform, such as WSL 2 or Docker Desktop (WSL 2 backend), do not remove it; only when they are not used is it a candidate for removal. Windows Sandbox is a dedicated feature, so it works after VMP is removed, but it uses the same hypervisor, so the foundation remains
    vmp["Want to remove VMP"] --> use{"Use WSL 2 or Docker Desktop?"}
    use -->|"Yes"| keep["Do not remove (they stop working)"]
    use -->|"No"| ok["Candidate for removal (from Windows Features)"]
    ok --> reboot["Restart and verify"]
    ok -.-> sb["Sandbox is a separate feature (foundation remains)"]

Figure 14: Whether to remove VMP is decided by “do you use that feature,” not by speed.

8. Turning It Back On — Handling “Incompatible Drivers”

This chapter separates the case where you cannot turn it back on yourself from the case where it turned itself off at some point on a PC where it had been enabled automatically. In both cases, check the driver list and the log before acting.

8.1 When You Cannot Turn It Back On, Check the Drivers

When you try to turn Memory integrity back on on a PC where it had been off, you may be told there are “incompatible drivers” and be unable to turn it on. Windows Security scans the drivers when you switch the toggle on, and if any driver does not conform to the Memory integrity rules (3.1), it displays a list.³

The order of handling is as follows.

1. Identify the drivers in the list. From “Review incompatible drivers” on the Core isolation screen, look at the driver file names and their publishers.
2. Replace them with updated drivers. As Microsoft advises, check whether the device manufacturer provides an updated driver.³ It may also be available under “Optional updates” in Windows Update.
3. If the driver belongs to a device you no longer use, delete it. Drivers for peripherals connected long ago, or for utilities that were never fully uninstalled, are often left behind.
4. Confirm in the log which driver was blocked. Blocks by Memory integrity are recorded in Event Viewer under Applications and Services Logs\Microsoft\Windows\CodeIntegrity\Operational, with event ID 3087 as the typical one.⁴

Do not force it on while incompatible drivers remain. Microsoft warns that drivers incompatible with Memory integrity can cause devices or software to malfunction and, in rare cases, lead to a boot failure (blue screen).⁸ If the PC actually fails to boot, a procedure exists to restore booting by setting the registry value in 7.3 to 0 from the recovery environment.⁸

flowchart TB
    accTitle: Handling the case where it cannot be turned back on
    accDescr: Identify the drivers in the incompatible-driver list, replace them if the manufacturer has an updated version, delete them if the device is no longer used, and if neither is possible, do not force it, leave it off, and ask the manufacturer for a compatible version
    fail["Cannot turn it on"] --> list["Look at the incompatible-driver list"]
    list --> upd{"Does the manufacturer have an update?"}
    upd -->|"Yes"| fix["Replace and turn it on"]
    upd -->|"No"| used{"Is the device in use?"}
    used -->|"Not in use"| rm["Delete the driver and turn it on"]
    used -->|"In use"| wait["Do not force it; ask the manufacturer"]

Figure 15: The proper fix is a driver update. Forcing it on is not worth the price of a PC that cannot boot.

8.2 The Safeguard That Turns It Off Automatically Has Conditions

A Mechanism Limited to PCs Where It Was Enabled Automatically

A PC on which Windows enabled Memory integrity automatically (the default enablement in 3.3, or a PC where the manufacturer enabled it in the shipping image) may carry a safeguard that automatically turns Memory integrity back off if a crash occurs at boot right after enablement.

Microsoft’s documentation describes this safeguard as working when the registry values WasEnabledBy and EnabledBootId are set, as being active only for the three boots after enablement, and as a configuration that manufacturers set in the shipping image.⁴

This behavior is not documented for the case where you turned it on yourself from the Core isolation screen. When turning it back on manually, do not rely on this safeguard; clear up incompatible drivers first with the steps in 8.1.

Even When It Turned Off Automatically, the Cause Is Not Settled

The phenomenon “right after a clean install, it was off at some point” can be the result of this safeguard having acted. But what it records is only the fact that “the boot failed right after enablement.” It does not establish that the cause was an incompatible driver. A boot failure for an unrelated reason during that period produces the same result.

Microsoft’s documentation also explains that if boot failures continue after Memory integrity is turned off, the setting is restored on the grounds that Memory integrity was not the cause.⁴

An incompatible driver is a likely cause, so first get corroboration from the incompatible-driver list and the CodeIntegrity log. If something is found, handle it with the steps in 8.1; if nothing is found, investigate the cause of the boot failure elsewhere.

flowchart TB
    accTitle: The safeguard that turns it off automatically on PCs where it was enabled automatically
    accDescr: On a PC where Windows enabled it automatically (WasEnabledBy and EnabledBootId are set), Memory integrity may automatically turn back off if a crash occurs at boot within three boots of enablement. When it was turned on manually this behavior is not documented, so do not rely on the safeguard. Even when it turned off automatically, that is a record of a boot failure and not a settled cause, so get corroboration from the incompatible-driver list and the CodeIntegrity log, handle a hit by updating or deleting, and otherwise investigate another cause
    en["Memory integrity becomes enabled"] --> how{"Enabled automatically (WasEnabledBy)?"}
    how -->|"Turned on manually"| manual["Safeguard is not documented"]
    how -->|"Automatic"| boot{"Crash within 3 boots?"}
    boot -->|"No"| fine["Stays enabled and running"]
    boot -->|"Yes"| auto["Automatically turns back off"]
    auto --> chk{"Hit in the list or the log?"}
    chk -->|"Yes"| fix["Handle by updating or deleting"]
    chk -->|"No"| other["Investigate another cause"]

Figure 16: The safeguard acts only on PCs where it was enabled automatically; it cannot be relied on when you turned it on manually. Even when it acts, it is a signal and not a diagnosis, so get corroboration from the list and the log before fixing anything.

9. Common Misunderstandings

Finally, let us check the points that are easy to confuse before and after changing the setting.

9.1 “I Turned Off Core Isolation”

Core isolation is the name of a screen; what you actually switched off is the Memory integrity toggle (Chapter 2). The other items on the same screen, and VBS itself, are not switched off.

9.2 “Turning It Off Always Makes It Faster”

It can get faster when Memory integrity is actually running, the CPU is the bottleneck, and especially when the CPU lacks MBEC/GMET (Chapter 4). GPU-bound games, and slowness with another cause, do not change.

9.3 “Switching the Toggle Off Is the End of It”

It does not take effect until you restart, and after the restart the running state still has to be checked separately (Chapter 6). Conversely, on a PC locked by policy or a UEFI lock, the toggle reverts even if you touch it.

9.4 “Turning It Off Has No Other Effects”

The barrier against code injection into the kernel is gone, Windows Security keeps showing a warning, and games whose anti-cheat names HVCI in its error no longer start (Chapter 5).

9.5 “Turning It Off Also Stops the Hypervisor”

Memory integrity is one feature on top of VBS; if any of the VBS setting, Credential Guard, Hyper-V, WSL 2, Windows Sandbox, or VMP is enabled, the hypervisor keeps running (6.2).

flowchart TB
    accTitle: Misunderstandings and what actually happens
    accDescr: The misunderstanding that Core isolation was turned off corresponds to the fact that it was the Memory integrity toggle; the misunderstanding that it always gets faster corresponds to it depending on the configuration; the misunderstanding that the toggle is the end corresponds to a restart and verification being required; and the misunderstanding that the hypervisor also stops corresponds to it remaining for other features
    m1["Turned off Core isolation"] --> r1["What was switched off is the Memory integrity toggle"]
    m2["Always gets faster"] --> r2["Depends on the configuration. Measure and decide"]
    m3["The toggle is the end"] --> r3["A restart and a running-state check are required"]
    m4["The hypervisor also stops"] --> r4["It remains if other features need it"]

Figure 17: Most misunderstandings come from mixing up “the name of the screen” with “the name of the mechanism.”

10. Summary

Memory integrity (HVCI) is a mechanism that moves the checkpoint for drivers entering the kernel into an isolated environment outside the kernel. That move has a price, laying a hypervisor underneath and having the hypervisor enforce execute permission, and depending on the configuration it affects performance.

The decision is easier to organize in the following three stages.

1. Check the use and what you lose. The candidate for off is a dedicated machine that is not involved with business data or the office network and that does not play games whose anti-cheat names HVCI. Speed alone does not decide it.
2. Confirm the running state, then measure under the same conditions. Use msinfo32 or Win32_DeviceGuard to confirm that the state changed before and after the change. A difference is most likely on older CPUs without MBEC/GMET and in CPU-bound games, and unlikely in GPU-bound games and everyday use. Measure several times and see whether the difference matters for how you use the PC.
3. Decide whether to keep it or restore it according to the difference and the use. Off is an option when measurement shows a difference. On a PC that uses Hyper-V, WSL 2, Sandbox, or VMP, the foundation remains and the expected difference is unlikely. If the difference does not matter for how you use the PC, turn it back on, and revisit it when the use changes. When it cannot be turned back on, the proper fix is a driver update; do not force it on.

“It gets faster when you turn it off” is not a lie. But only with three conditions attached, “on your own PC,” “measured,” and “knowing what you lose,” does it become material for a decision.

Related Articles

• The Depths of Windows Virtualization (Part 2) — Memory Even the Kernel Cannot See: How VBS, HVCI, and Credential Guard Work
• The Depths of Windows Virtualization (Part 1) — Where Is Your Windows Actually Running? The Hypervisor and Partitions
• The Depths of Windows Virtualization (Part 3) — Virtual Machines That Boot in Seconds: WSL2, Windows Sandbox, and Containers
• What Is Windows Efficiency Mode? - The Green Leaf Icon and How to Turn It Off
• How to Correctly Compare the Speed of Different Program Versions on Windows: From Aligning the Environment, Such as the Power Mode, to the Limits
• WPR/WPA in Practice — An Introduction to System-Wide Performance Investigation for “the Whole PC Is Slow”
• Windows Processor Scheduling Settings - Background Services and P/E Cores

Related Consulting Areas

KomuraSoft LLC handles compatibility investigations between Windows applications and security features (Memory integrity, VBS, App Control), analysis of driver-caused defects, and performance investigations that isolate the cause of “the PC or the app is slow” through measurement. Come to us from the point where “turning it off did not make it faster.”

• Bug Investigation & Root-Cause Analysis
• Technical Consulting & Design Review
• Windows Application Development
• Contact Us

References

Related Articles

Recent articles sharing the same tags. Deepen your understanding with closely related topics.

Related Topics

These topic pages place the article in a broader service and decision context.

Frequently Asked Questions

Common questions about the topic of this article.

What is Memory integrity (HVCI)?

It is the feature under Device security > Core isolation in Windows Security, formally called hypervisor-protected code integrity (HVCI). It performs the signature verification of drivers loaded into the kernel (the core of the OS) inside an isolated environment created by the hypervisor, makes only pages that pass verification executable, and never allows writes to executable pages. Its purpose is to make it harder for malicious programs to take over the PC through low-level drivers.

Does turning off Memory integrity really make the PC faster?

Some configurations get faster; others barely change. Microsoft states that on gaming devices, in some scenarios and configurations, Memory integrity and Virtual Machine Platform can affect performance. The impact is most likely on older CPUs without Mode-Based Execution Control (present on Intel from the 7th generation onward) or Guest Mode Execute Trap (present on AMD from Zen 2 onward), because on those CPUs the function is emulated and the performance cost grows. On the other hand, in GPU-bound games, or when the slowness comes from a memory shortage, the disk, heat, or the power mode, turning it off changes nothing. The reliable way to decide is to measure on your own PC under the same conditions.

How do I turn off Memory integrity?

Open Windows Security, go to Device security > Core isolation details, switch the Memory integrity toggle off, and restart the PC. The setting does not take effect until you restart. If the toggle is grayed out and says "This setting is managed by your administrator," it is locked by your organization's policy; do not change it yourself, ask the administrator.

I turned it off, so why is it not faster?

First, confirm that it really is off, using the Virtualization-based security section of msinfo32 (System Information) or the Win32_DeviceGuard class in PowerShell. It can still be on because you have not restarted or because a policy reverted it. Next, if you use Hyper-V, WSL 2, Windows Sandbox, or Virtual Machine Platform, the hypervisor itself keeps running even after Memory integrity is turned off. And if Memory integrity was never the cause of the slowness in the first place, turning it off will not make anything faster.

What should I do when I cannot turn Memory integrity back on (it says there are incompatible drivers)?

Check the list of incompatible drivers shown on the Core isolation screen in Windows Security, and the proper fix is to replace them with updated drivers from the device manufacturer. If the driver belongs to a device you no longer use, you can delete it. Which driver was blocked can also be confirmed in the CodeIntegrity Operational log in Event Viewer (event ID 3087 is the typical one). Forcing it on while incompatible drivers remain is not supported by Microsoft either, and the PC may fail to boot.

I turned it off for a game, and now another game will not start.

Some anti-cheat systems (such as Riot Games' Vanguard) use Memory integrity (HVCI) on Windows 11 to verify system integrity, and on a PC where a VAN: RESTRICTION error names HVCI, the game will not start unless it is on. This is not required uniformly on every Windows 11 PC; it depends on what the error lists. If it applies to you, turn Memory integrity back on and restart. Decide whether to turn it off by looking at both the game you want to speed up and the game that requires HVCI.

Author Profile

Profile page for the article author.

Go Komura

Representative of KomuraSoft LLC

Focused on Windows software development, technical consulting, and investigations into failures that are difficult to reproduce.