Microsoft has confirmed that Windows 11 Memory Integrity will start switching itself on from October 2026. The announcement went up on the Windows IT Pro Blog on 1 September. Microsoft’s wording is that quality updates will start enabling it on more eligible Windows devices. Ordinary monthly updates will do the flipping, with no separate download to install. On some machines the same update will also turn on Virtualization-based Security (VBS) underneath it.
Memory Integrity is the setting that sits under Core isolation in the Windows Security app. Microsoft also calls it Hypervisor-protected Code Integrity, or HVCI. It runs kernel code checks inside an isolated virtual environment, so only trusted kernel-mode drivers are allowed to load. That makes it much harder for a malicious or vulnerable driver to take over the system.
What Microsoft is actually changing in Windows 11
Until now this was mostly opt-in on existing PCs. Microsoft’s documentation says the automatic switch-on applied to clean installs, not to machines upgraded from an older Windows version. Many Windows 11 PCs in India came up the upgrade route, so they were never auto-enabled.
From October, quality updates close that gap. Microsoft says Windows evaluates each device first, and lists hardware capabilities, compatibility and performance considerations as the readiness signals. The rollout is gradual, and Microsoft says it may not reach all eligible devices at the same time. Windows Latest expects it to begin with the 13 October Patch Tuesday, though Microsoft’s own post only says October 2026.
Security works best when protection is built in, not bolted on.
— Peter Waxman, Microsoft, writing on the Windows IT Pro Blog
One thing is genuinely reassuring here. Microsoft states that existing administrator and user decisions stay in effect, and that devices where Memory Integrity has already been disabled will not be changed automatically by this rollout. If you switched it off deliberately, that choice survives.
Which PCs Microsoft says are eligible
Microsoft’s blog points to its Memory integrity enablement documentation for requirements. That page lists the following minimums:
- Processor: Intel 8th generation or later, AMD Zen 2 or newer, or Qualcomm Snapdragon 8180 or newer
- RAM: minimum 8GB, on x64 processors
- Storage: an SSD of at least 64GB
- Firmware: virtualization enabled in the BIOS or UEFI
- Drivers: Memory Integrity-compatible drivers must already be installed
Treat that as the bar Microsoft points to rather than a guarantee. The same page notes its auto-enablement rules cover clean installs only, so it describes the older mechanism, not this October rollout. Neither the blog nor the documentation it links gives a separate eligibility list for the update-driven rollout.
How to check Memory Integrity on your PC
- Open the Windows Security app.
- Go to Device security, then Core isolation details.
- Read the Memory integrity toggle. It shows On or Off, and you can change it there.
- For a second opinion, run
msinfo32.exefrom an elevated PowerShell session and look under System Summary for Virtualization-based Security.
If the toggle refuses to turn on, an incompatible driver is usually the reason. Microsoft’s support page tells you to ask the device manufacturer for an updated driver, or to remove the device or app that uses it. To see what got blocked, open Event Viewer and browse to Applications and Service Logs\Microsoft\Windows\CodeIntegrity\Operational. Compatibility events generally carry Event ID 3087.
The part Microsoft’s post does not dwell on
This is a real security improvement, and it is fair to say so plainly. But the tradeoff is in Microsoft’s own documentation, not in the announcement. Memory Integrity blocks drivers, and an old scanner, a budget printer, a USB audio interface or a game’s anti-cheat layer can be exactly what gets blocked.
Microsoft even ships a recovery procedure for the worst case. If a machine becomes unstable or fails to boot after Memory Integrity is turned on, the documented fix is to disable any policies enabling VBS, boot into the Windows Recovery Environment, run reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f and restart. If Memory Integrity was turned on with UEFI lock, you also have to disable Secure Boot first. That is a documented path back, but it is not something an average home user will manage alone.
The announcement also describes no prompt or notification before the change lands. And Microsoft’s listing of performance considerations among its readiness signals concedes there is a performance dimension, without putting a number on it.
The practical advice is simple. Check the toggle now. If it is already on, nothing changes for you. If it is off and you depend on an unusual piece of hardware, turn it on yourself before October and find out on your own schedule rather than after a Patch Tuesday reboot. For context on what else is heading to PCs this autumn, see our piece on Windows 11 26H2 reaching the Release Preview channel.
Sources: Microsoft Windows IT Pro Blog, Microsoft Learn, Windows Latest
