Windows Security can show a switch called Memory integrity under Core isolation. It is the kind of setting many users notice only when an old driver refuses to load or a performance-tuning guide tells them to turn it off. Neither situation explains what the feature is actually doing.
Memory integrity is a Windows security feature built on virtualization-based security. Microsoft also refers to it as hypervisor-protected code integrity, or HVCI. Its job is to make it harder for malicious or improperly behaving kernel code to tamper with critical parts of Windows.
What Memory integrity protects
Kernel-mode code runs with far more privilege than a normal desktop application. A bad driver or kernel exploit can therefore do much more damage than a broken browser tab. Memory integrity uses the Windows hypervisor to create an isolated environment that helps enforce code-integrity rules for kernel code.
Microsoft describes Core isolation as separating important Windows processes in memory using virtualization. HVCI then strengthens code integrity so that kernel-mode code has to meet the required signing and memory rules before it can execute in protected contexts.
Why an old driver can block the feature
Drivers were not all written with HVCI requirements in mind. Microsoft publishes specific guidance for driver developers because code that uses incompatible memory behavior can fail when Memory integrity is enabled.
That is why Windows Security may list an incompatible driver instead of simply turning the feature on. The warning does not necessarily mean the hardware itself is defective. It usually means the installed driver does not satisfy the rules required by Memory integrity.
The best first move is to identify the device or software that installed the driver and look for a newer version from the manufacturer. If the device is obsolete and no compatible driver exists, you then have a real decision to make: keep the old hardware or software, or keep the stronger security feature enabled.
Do not delete random driver files
When people see an incompatible .sys file, it is tempting to find it in Windows and delete it manually. That can leave a device, service or application in a half-installed state. Remove or update the associated software through normal supported methods first.
If you do not recognize the driver, use Device Manager, installed-app information and the driver’s properties to identify its publisher. A filename alone is not enough reason to remove a system component.
What if the switch is missing or unavailable?
Do not assume a missing option means Windows is broken. Availability depends on the platform, firmware configuration and supported Windows security features. Virtualization support and compatible drivers are part of the picture, and managed work PCs can also have security settings controlled by an administrator rather than the local user.
Before changing BIOS options, install current Windows updates and check the PC or motherboard maker’s documentation for virtualization and security support. On a machine supplied by an employer or school, do not override security policy just to make a toggle appear.
Does Memory integrity reduce performance?
Any virtualization-backed security feature can add some overhead because additional checks and isolation are doing real work. The size of that cost is not a universal number. It depends on the processor, workload, Windows configuration and software stack.
That is why I would be skeptical of guides that promise a fixed FPS gain from disabling HVCI. A benchmark result from one older CPU, one game or one Windows build is not a rule for every PC. On a modern system, the right question is whether you can measure a meaningful problem in your own workload—not whether a tuning checklist says the setting is “bad for gaming.”
When turning it off can make sense temporarily
There are legitimate troubleshooting cases. Microsoft itself documents situations where an incompatible driver cannot load while Memory integrity is on. If a critical device has no working compatible driver and you understand the security trade-off, temporarily disabling the feature may restore that device while you look for an update or replacement.
That is different from disabling it permanently because a game stuttered once. If you are testing performance, change only one variable, reboot when required, and compare the same repeatable workload. If the difference is negligible, restore the security feature rather than leaving it off for no measurable benefit.
How to check the setting in Windows 11
Open Windows Security → Device security → Core isolation details. There you can see whether Memory integrity is available and enabled. If Windows reports incompatible drivers, note their names before changing anything.
After a driver update, return to the same page and try enabling the feature again. A restart is commonly required because kernel security settings cannot always be changed while the operating system is fully running.
What I would do on a normal home PC
If Memory integrity is enabled and everything works, I would leave it alone. It is an intentional security layer, not bloat that needs to be removed as part of routine PC optimization.
If it is disabled because of an incompatible driver, I would first update Windows, update the affected device from its manufacturer, and decide whether the old software or peripheral is still worth keeping. If the driver belongs to something you no longer use, removing that software cleanly may solve the conflict without sacrificing the security feature.
The setting is a trade-off only when you have evidence
PC tuning advice often turns every Windows feature into an on/off performance contest. Memory integrity deserves a more careful approach because the other side of the trade-off is security.
Understand what is blocking it, fix compatible drivers when possible, and benchmark only if you have a specific performance concern. For a stable modern Windows 11 machine, “leave it enabled unless you have a documented reason not to” is a much safer default than disabling it pre-emptively.
