Windows Security · The Windows Security App · Lesson 4 of 5

Device Security and Core Isolation

The hardware guards Windows uses, and why an old driver can block them.

A locked room inside Windows

Open Windows Security and choose Device security. This page shows guards built into your PC's hardware. Let's go through them in plain words.

First, a word you need. A driver is a small program that lets Windows talk to a piece of hardware, like a printer, a webcam or a graphics card. Drivers run deep inside Windows, with a lot of power. That makes them a favorite target. Malware that gets in through a driver can hide from almost everything.

Core isolation builds a locked room inside your computer's memory. It uses a feature of the processor called virtualization, which lets the PC keep one part of memory walled off from the rest. Even if malware gets into normal Windows, it can't get into that room.

Memory integrity is the guard who works inside the locked room. Before any driver or other deep code is allowed to run, Memory integrity checks it. Code that isn't properly signed, or looks tampered with, is refused. You may also see its technical name, HVCI.

To see it, choose Core isolation details. Memory integrity has an on and off switch. On many new Windows 11 PCs it is on already. If it is off, try turning it on. Windows will ask you to restart.

The same page may list other guards:

• Memory access protection stops a gadget plugged into a fast port from reading your memory directly.
• Microsoft Vulnerable Driver Blocklist blocks drivers known to have security holes. It is on when Memory integrity is on.
• Local Security Authority protection guards the part of Windows that handles your sign-in.

You don't have to understand every line. A green check, or a switch that is on, is what you want to see.

The chip, the start-up and old drivers

Two more sections on the Device security page will look familiar. You met both in the course on how a computer starts up.

Security processor is the page for your TPM, the small security chip that guards keys. Click Security processor details. You'll see the maker, a specification version (Windows 11 needs 2.0), and a status. "Your security processor is working properly" is what you want. There is also a Clear TPM option. Don't use it unless a trusted technician asks. Clearing the TPM can lock you out of encrypted data, such as a BitLocker drive, without the recovery key.

Secure boot shows whether the start-up check is on. Remember, it makes sure only trusted, signed start-up code loads before Windows. That stops rootkits, malware that hides by starting before Windows does. If the page says Secure Boot is off, you turn it back on in the UEFI firmware settings, not in Windows.

Now, back to Memory integrity. Sometimes the switch won't turn on. Windows says there are incompatible drivers and lists them by file name.

This usually means an old driver, often for a device you bought years ago. It was written before Memory integrity existed and doesn't follow its rules. Windows won't let it run inside the locked room, so it can't turn the guard on without breaking that device.

What to do:

• Look up the driver's file name, and check the maker's website for a newer driver.
• If you no longer use that device or app, uninstall it.
• Then try the switch again.

Don't download driver updater apps from ads to fix this. Many are junk or worse. Go to the device maker directly, or use Windows Update.