Microsoft is preparing to strengthen one of Windows 11’s core defenses by turning on memory integrity by default on eligible devices starting in October 2026, according to Neowin’s report on the upcoming change.
Memory integrity (officially called Hypervisor-protected Code Integrity, or HVCI) guards the parts of Windows that run at the highest privilege level. By enabling it out of the box rather than leaving it as an opt-in setting, Microsoft wants to close a door that malware and sophisticated attackers have long tried to kick open.
What memory integrity actually protects
Windows runs its most sensitive code—the kernel and the drivers that talk to your hardware—in a privileged mode that normal applications can’t touch. That privilege is exactly what makes it attractive to attackers: a malicious driver loaded into kernel space can operate almost invisibly, which is why rootkits and certain ransomware families target it.
Memory integrity works by continuously verifying that kernel code and drivers haven’t been tampered with before they execute. It relies on virtualization-based security (VBS), a hardware-dependent feature that needs a TPM and a CPU with virtualization extensions, to create an isolated environment where the integrity checks run. If something doesn’t match what Microsoft expects, the code is blocked from running.
The result is a meaningful barrier against a class of attacks that depend on injecting or replacing kernel-level code. It’s not a new feature—Microsoft has shipped memory integrity since Windows 10—but making it the default on eligible Windows 11 hardware is a shift in how aggressively the company pushes that protection.
What changes in October 2026
According to the report, the change lands in October 2026, when eligible Windows 11 devices will have memory integrity enabled without requiring any action from the user. “Eligible” is the key qualifier here: the feature depends on specific hardware capabilities, so not every machine will qualify automatically.
Importantly, Microsoft is not forcing the change on organizations against their will. The rollout will respect existing IT policies, meaning that if an admin has deliberately configured memory integrity to be off (or set to a specific mode) through Group Policy or Intune, that preference stands. This is standard practice for enterprise-managed features and gives IT teams control over their fleets.
Why Microsoft is pushing this now
The security landscape has shifted heavily toward kernel and driver-level attacks over the past few years. Attackers increasingly target drivers—sometimes legitimate ones that ship vulnerabilities—to gain the privileges they need to persist on a system and evade detection. By hardening the kernel by default, Microsoft is responding to that trend preemptively rather than reactively.
This also fits a broader pattern. Microsoft has been steadily expanding virtualization-based security across its products, and enabling memory integrity by default aligns with its ongoing effort to raise the baseline security posture of Windows without requiring users to hunt through settings.
What this means for you
For most consumers, the practical effect is simple: stronger default protection with nothing to install or configure. Your device will be better defended against kernel-level malware out of the box, assuming it meets the hardware requirements.
There can be a catch, though. Memory integrity can occasionally conflict with older or less-common drivers—think specialized peripherals, older gaming hardware, or niche enterprise software—because it blocks code it can’t verify. Historically, this has led to a small number of devices being unable to run certain drivers once the feature is on. If you’ve ever seen Windows warn that a driver isn’t compatible, this is the same family of issue.
For IT administrators, the message is that you retain control. Existing Group Policy and Intune settings will be honored, so you can keep memory integrity disabled on machines where it causes problems, or enable it where it helps. No forced migration, no surprise lockouts for managed devices.
How to check or manage it
If you want to see whether memory integrity is active on your machine, you can find it in the Windows Security app under the Device security section, then the Core isolation details. There you can toggle memory integrity on or off if your device supports it.
For admins managing a fleet, the setting remains governed by the same policies and registry keys used today, so your existing management workflows don’t change. The October update simply makes the default state “on” for eligible hardware rather than “off,” while still allowing organizations to override it.
What to do
Nothing is required of you for the change to take effect on eligible devices—it will arrive as part of Microsoft’s normal update cadence. If you rely on older hardware or specialized drivers, it’s worth checking the Windows Security settings after October to confirm everything still works, and reaching out to your IT team if you notice a device or peripheral behaving oddly.
Source: Neowin
Over to you: Will you rely on Windows to enable memory integrity automatically, or do you prefer to keep control of kernel-level security settings yourself?
