Memory integrity, a Windows 11 protection against certain attacks targeting the kernel, can be enabled automatically on compatible PCs. But the update does not enforce it on every machine: the Windows version, hardware virtualisation, installed drivers and the choices of the user or administrator all matter. Here’s how to check its status and understand what a possible block means.
An extra barrier for the heart of Windows
A driver links Windows to a component such as a webcam, keyboard or graphics card. Because they operate at a privileged level of the system, this software can also provide an avenue for attack if it is vulnerable or compromised.
Memory integrity, also known as HVCI (Hypervisor-Protected Code Integrity), checks code intended to run in the Windows kernel. To isolate these checks, it relies on hardware virtualisation: part of the system runs in a separate environment, making it harder for malware to alter the verification mechanisms.
The feature is intended in particular to limit certain risks associated with low-level drivers and rootkits, malware that seeks to hide deep within the system. However, it is neither protection against every attack nor a replacement for antivirus software. It is one of Windows’ protections, alongside other mechanisms that do not all operate in the same place.
A gradual rollout, not a guarantee for every PC
Microsoft says that update KB5127936, published on 28 October 2026 as a preview for Windows 11 25H2 and 26H2, extends the activation of memory integrity to eligible devices. The rollout is gradual, so the feature may not appear at the same time on all the PCs concerned. The release notes also specify that Windows respects the user’s or IT administrator’s previous choices.
Eligibility depends in particular on the hardware and software configuration. Hardware virtualisation must be enabled in the UEFI or BIOS, and drivers must be compatible. An old or incompatible driver can prevent activation, without that meaning it is malicious: legitimate software may simply not meet the requirements of this protection.
The option may also be absent or appear differently depending on the Windows version and hardware. On a work or school computer, an administrator may also manage the settings. There is therefore no single status that should be expected on every machine, even after an update.
Check the status in Windows Security
To check the feature, open the Windows Security app, then select Device security. Under Core isolation details, look for Memory integrity. The toggle shows whether it is enabled. Microsoft notes that the features shown on this page vary according to the Windows version and installed components.
If it is active, the toggle indicates that the protection is enabled. If it is inactive, a message may say that an incompatible driver is responsible. The first useful step is then to look for a newer version through Windows Update or from the PC or device manufacturer. If the computer is managed by an organisation, it is best to ask its IT department for advice before making any changes.
Do not delete a driver at random: this could prevent a device or application from working properly. Microsoft says that if no compatible driver is available, it may be necessary to remove the device or application that depends on that driver, but this decision should be made only after precisely identifying the component concerned. If no clear explanation is given, the manufacturer is the right point of contact.
What this protection does not replace
Memory integrity acts on code that seeks to run in the kernel; on its own, it does not block every form of malware, phishing or data theft. It therefore does not remove the need to keep Windows and other software up to date, or to maintain backups. In Luxembourg, POST also recommends keeping the system and protection tools up to date, and being wary of unexpected links or attachments.
Checking memory integrity is therefore above all a practical check: is the feature present and active on this PC? If it is not, an incompatible driver is something to investigate, not proof of an infection. Microsoft’s rollout adds a layer of protection on eligible PCs where the feature is enabled, but hardware, drivers and management settings determine what is actually available day to day.
References
- 28 October 2026 – Preview KB5127936 (OS builds 26300.9818 and 26200.9818)
- Device security in the Windows Security app
- POST Luxembourg — Security
- Windows 11 enables extra protection on some PCs: how can you tell if it is working on yours?
Photograph: Valentine Tanasovich — Pexels — Pexels licence.
