# Core isolation, HVCI and LSA protection: on or off

> What each protection actually defends against, the real performance cost, and how to tell whether a driver is blocking it.

**Tested on**

- Build: 26300.9457 / 26100.33650
- Edition: Pro (26H2) / Server
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-29

## The short answer

Three protections, often bundled in one settings page:

| Feature | Defends against | Typical cost |
|---|---|---|
| **HVCI / memory integrity** | malicious or buggy kernel drivers executing arbitrary code | 0–5% CPU in games, more in virtualisation-heavy workloads |
| **Kernel DMA protection** | devices reading memory directly (Thunderbolt attacks) | none measurable |
| **LSA protection (RunAsPPL)** | credential theft (Mimikatz-style) from LSASS | none measurable |

For a desktop that is not a hypervisor host, leave all three on. The performance worry is mostly folklore from 2018-era drivers.

## Check the current state

```powershell
# memory integrity / HVCI
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
  Select-Object VirtualizationBasedSecurityStatus,SecurityServicesRunning,SecurityServicesConfigured

# LSA protection
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' | Select-Object RunAsPPL
# DMA protection
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
  Select-Object AvailableSecurityProperties
```

Reading it:

- `VirtualizationBasedSecurityStatus = 2` → VBS running.
- `SecurityServicesRunning` containing **2** → HVCI running.
- `RunAsPPL = 1` → LSA protection enabled (2 = enabled with UEFI lock).

## When HVCI is off because of a driver

That is the common case: a vendor driver is incompatible, so Windows shows "Memory integrity is off — a driver is incompatible".

**Settings → Privacy & security → Windows Security → Device security → Core isolation → Memory integrity** lists the offending driver by name.

```powershell
# drivers whose code integrity cannot be verified
Get-WinEvent -LogName 'Microsoft-Windows-CodeIntegrity/Operational' -MaxEvents 30 -ErrorAction SilentlyContinue |
  Select-Object TimeCreated,Id,Message | Format-List
```

The fix is a driver update — not disabling the protection permanently. If the driver is for hardware you no longer use, remove it.

> **Caution: VMs and nested virtualisation change the answer**
>
> A Windows VM that runs Hyper-V/WSL2 inside it, or a host doing heavy nested virtualisation, is the one place HVCI cost is real. On a normal desktop it is noise; do not disable it on a laptop that leaves the house.

## The 2018 benchmark is not your machine

Old measurements showed 5–15% FPS losses with HVCI, on drivers from that era. Current drivers are HVCI-compatible by certification, and the measured difference on modern hardware is within run-to-run noise for most games.

If you want to know for your machine: measure the same scene three times with it on, three times with it off, and compare medians — not a single run, and not someone else's chart.

## LSA protection

`RunAsPPL` runs LSASS as a protected process so that user-mode tools cannot read its memory. It is a **credential theft** mitigation, not a malware scanner.

- Enabled by default on Windows 11 for clean installs.
- Some legacy security agents and debuggers refuse to work with it — that is the trade.
- `RunAsPPL = 1` (registry) vs `2` (UEFI lock, cannot be turned off without firmware change).

## What these do not do

- They do not stop ransomware (that is Controlled Folder Access and backups).
- They do not stop phishing or a user running a bad installer with admin rights.
- They do not replace updates.

## Related

- [Controlled folder access](https://winbook.fyi/en/windows/hardening/controlled-folder-access/)
- [SmartScreen](https://winbook.fyi/en/windows/hardening/smartscreen/)
- [Memory integrity and anti-cheat](https://winbook.fyi/en/windows/gaming/memory-integrity/)

## Lab boundary

E1. Protection behaviour is documented by Microsoft. The lab VMs run with vTPM and VBS available, but no performance measurement was made for this page.

## Sources

- [Microsoft Learn — Enable virtualization-based protection of code integrity](https://learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity)
- [Microsoft Learn — Configure additional LSA protection](https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection)
- [Microsoft Learn — Identity protection](https://learn.microsoft.com/en-us/windows/security/identity-protection/)

---

Source: https://winbook.fyi/en/windows/hardening/core-isolation/