Core isolation, HVCI and LSA protection: on or off

Verified 2026-10-292 min read

What each protection actually defends against, the real performance cost, and how to tell whether a driver is blocking it.

Tested onPro (26H2) / Server · Build 26300.9457 / 26100.33650 · x64

Build: 26300.9457 / 26100.33650
Edition: Pro (26H2) / Server
Architecture: x64
Support: Documentation (E1)
Evidence: E1Official documentation
Verified: 2026-10-29
Page type: Concept

The short answer

Three protections, often bundled in one settings page:

Feature	Defends against	Typical cost
HVCI / memory integrity	malicious or buggy kernel drivers executing arbitrary code	0–5% CPU in games, more in virtualisation-heavy workloads
Kernel DMA protection	devices reading memory directly (Thunderbolt attacks)	none measurable
LSA protection (RunAsPPL)	credential theft (Mimikatz-style) from LSASS	none measurable

For a desktop that is not a hypervisor host, leave all three on. The performance worry is mostly folklore from 2018-era drivers.

Check the current state

# memory integrity / HVCI
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
  Select-Object VirtualizationBasedSecurityStatus,SecurityServicesRunning,SecurityServicesConfigured

# LSA protection
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' | Select-Object RunAsPPL
# DMA protection
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
  Select-Object AvailableSecurityProperties

Reading it:

VirtualizationBasedSecurityStatus = 2 → VBS running.
SecurityServicesRunning containing 2 → HVCI running.
RunAsPPL = 1 → LSA protection enabled (2 = enabled with UEFI lock).

When HVCI is off because of a driver

That is the common case: a vendor driver is incompatible, so Windows shows “Memory integrity is off — a driver is incompatible”.

Settings → Privacy & security → Windows Security → Device security → Core isolation → Memory integrity lists the offending driver by name.

# drivers whose code integrity cannot be verified
Get-WinEvent -LogName 'Microsoft-Windows-CodeIntegrity/Operational' -MaxEvents 30 -ErrorAction SilentlyContinue |
  Select-Object TimeCreated,Id,Message | Format-List

The fix is a driver update — not disabling the protection permanently. If the driver is for hardware you no longer use, remove it.

The 2018 benchmark is not your machine

Old measurements showed 5–15% FPS losses with HVCI, on drivers from that era. Current drivers are HVCI-compatible by certification, and the measured difference on modern hardware is within run-to-run noise for most games.

If you want to know for your machine: measure the same scene three times with it on, three times with it off, and compare medians — not a single run, and not someone else’s chart.

LSA protection

RunAsPPL runs LSASS as a protected process so that user-mode tools cannot read its memory. It is a credential theft mitigation, not a malware scanner.

Enabled by default on Windows 11 for clean installs.
Some legacy security agents and debuggers refuse to work with it — that is the trade.
RunAsPPL = 1 (registry) vs 2 (UEFI lock, cannot be turned off without firmware change).

What these do not do

They do not stop ransomware (that is Controlled Folder Access and backups).
They do not stop phishing or a user running a bad installer with admin rights.
They do not replace updates.

Lab boundary

E1. Protection behaviour is documented by Microsoft. The lab VMs run with vTPM and VBS available, but no performance measurement was made for this page.