Memory Integrity Won't Turn On
I previously posted this on the Windows 11 Microsoft community but after following their advice I activated Windows Insider and downloaded 22H2 as the Microsoft online literature stated it was one of the requirements for Memory Integrity to activate automatically. But it didn't activate automatically. I've cut and paste my post from the other community below: Hi there. I'm using a Medion Akoya Notebook and Windows Security is flagging that Memory Integrity is not turned on and my device maybe vulnerable. I noticed this flag before and went into Windows Security and flicked the tab to 'On'. The system showed it was running a scan for incompatible drivers, didn't seem to find any and then put up a notifcation saying something like 'To enable changes a restart is required'. I hit 'Restart' and my laptop automatically restarted itself. When it finished starting up Memory Integrity appeared to be on as there was no flag on Windows Security. Now maybe a week or so later it appears Memory Integrity has somehow been turned back off again. When I run through the same procedure, as above, after I press 'Restart' my laptop begins the restart process but then hangs on the Medion logo before Windows 11 starts. I don't understand why it keeps going off? I have not altered any settings that I can think of that would have effected this. Could someone help me understand what's happening, why's it happening and how I could get Memory Integrity to stay on. From my System Information I have the following: Processor: Intel(R) Core(TM) i7-1065G7 CPU @ 1.3GHz , 1498 Mhz, 4 Core(s), 8 Logical Processor(s) It has 8GB RAM and well over 64GB of SSD space remaining. Would be glad of any help getting this turned on as I like to have things properly secured where I can. Thanks. **I followed a guide that showed me how to 'Refresh/Reinstall' Windows Defender and Switch the HVEC to 'Enabled' in the Registry. This didn't work. After the required restart my laptop is still hanging on the Medion logo before Windows starts up and I am having to press and hold power to turn off and on again to restart windows, but Memory Integrity remains off** **I read somewhere that Hardware Virtualization needed to be On in the UEFI/Bios. When I tried to open the UEFI (Holding F10 on a Medion Akoya E15407) I first tried entering UEFI, but after selecting English as the language I then got an error message along the lines of "No image, contact customer service". Eventually after repeating and choosing the option below UEFI it entered what looked like a Bios screen and after side scrolling I noticed a line for Intel Virtualization which was marked as 'Enabled'.** Can anyone please offer advice on how I can get Memory Integrity enabled? I like to have things as secure as possible. Many thanks
Turn on Memory Integrity via Intune
Hi, I want to turn on Memory Integrity via Intune. I used the following script to turn on Memory Integrity, but it didn't. Also, there are no errors or failure statuses on the Intune Scripts Status page. Could someone please suggest This is the script I used: # Registry key path $registryPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" # Desired value for Memory Integrity (1 for enabled with UEFI lock) $desiredValue = 1 # Initialize exit code $exitCode = 0 # 0 indicates success by convention try { # Check if the key exists if (Test-Path -Path $registryPath) { $currentValue = Get-ItemProperty -Path $registryPath | Select-Object -ExpandProperty "Enabled" # Check if the value is already set to the desired value if ($currentValue -eq $desiredValue) { Write-Host "Memory Integrity is already enabled with UEFI lock. No changes made." } else { # If the key exists but the value is not as desired, set it to the desired value Set-ItemProperty -Path $registryPath -Name "Enabled" -Value $desiredValue Write-Host "Memory Integrity enabled with UEFI lock successfully." } } else { # If the key does not exist, create it and set it to the desired value New-Item -Path $registryPath -Force Set-ItemProperty -Path $registryPath -Name "Enabled" -Value $desiredValue Write-Host "Memory Integrity enabled with UEFI lock successfully." } } catch { Write-Host "An error occurred: $_" $exitCode = 1 # 1 indicates failure } # Exit with the specified exit code exit $exitCode Output of the regedit: Enabled : 1 PSPath : Microsoft.PowerShell.Core\Registry::\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity PSParentPath : Microsoft.PowerShell.Core\Registry::\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios PSChildName : HypervisorEnforcedCodeIntegrity PSProvider : Microsoft.PowerShell.Core\RegistryTurn on Mandatory ASLR in Windows Security
I've been using it for quite a while now, it caused no problems or errors with any legitimate programs, games, anti cheat systems etc other than with some "custom" made portable programs. it's Off by default, when you turn it on, you will have to restart your device. Address space layout randomization Address space layout randomization (ASLR) is a computer security technique involved in preventing exploitation of memory corruption vulnerabilities. In order to prevent an attacker from reliably jumping to, for example, a particular exploited function in memory, ASLR randomly arranges the address space positions of key data areas of a process, including the base of the executable and the positions of the stack, heap and libraries. The Linux PaX project first coined the term "ASLR", and published the first design and implementation of ASLR in July 2001 as a patch for the Linux kernel. It is seen as a complete implementation, providing also a patch for kernel stack randomization since October 2002.[1] The first mainstream operating system to support ASLR by default was the OpenBSD version 3.4 in 2003,[2][3] followed by Linux in 2005. https://en.wikipedia.org/wiki/Address_space_layout_randomization https://blogs.technet.microsoft.com/srd/2017/11/21/clarifying-the-behavior-of-mandatory-aslr/ Other options that are tuned off by default and you should enable to make your Windows device more secure With the increasing number of threats in cyber security and new ransomwares, If you are only relying on Windows 10's built in security and not using any 3rd party AV such as Kaspersky, you must enable these features to keep yourself secure. Hope everyone stay safe!
