Does ESET disable Memory Integrity in Windows 11

[TStowy65 0]

Something is disabling this on all our computers, and I believe it is one of our endpoint protection products.  Curious if it is ESET and why.

[itman 1,659]

My previous testing in regards to HVMI is it's sensitive to BIOS memory timing settings. Specifically, memory clock setting increase from default supported by motherboard. This will disable HVMI every time.

I suspect your issue might be related to Eset's introduction of Intel Threat Detection Technology support: https://support.eset.com/en/kb8336-intel-threat-detection-technology-tdt-supported-processors?ref=esf .

[itman 1,659]

You might also want to read this article: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-vulnerable-driver-blocklist-sync-issue/ in regards to the relationship between HVMI and Microsoft's internal driver block list.

Quote

Disabling the driver blocklist

Microsoft also says that starting with the Windows 11 2022 update (version 22H2), the blocklist is enabled by default on all devices.

"Blocking drivers can cause devices or software to malfunction. In rare cases, it leads to a stop error," Microsoft warned on Tuesday. "There is no guarantee that the blocklist will block every driver that has weaknesses."

For Windows 10 and Windows 11 21H2, you can disable the driver blocklist by turning off 'Memory Integrity' in the 'Core Isolation' settings, or if using Windows Defender Application Control (WDAC), disabling it in your configuration.

Edited November 1, 2022 by itman