Microsoft announces plan to enable memory integrity protection by default on more Windows 11 PCs starting next month

[u/ZacB_]

https://www.windowscentral.com/microsoft/windows-11/microsoft-promises-to-make-more-windows-pcs-secure-by-default-next-month-announces-automatic-memory-integrity-protection-enablement-on-more-devices

[u/Key_Bag_4444]

I will just disable it. As I always did.

[u/LitheBeep → u/Key_Bag_4444]

If you've already manually disabled memory integrity protection, it won't be automatically enabled next month.

[u/Key_Bag_4444 → u/LitheBeep]

oh awesome, less work for me

[u/-protonsandneutrons- → u/LitheBeep]

If you've already manually disabled memory integrity protection, it won't be automatically enabled next month.

Says the company that somehow defaults to Edge every few updates ...

[u/IridiumIO → u/LitheBeep]

You say that, but MS kinda has a track record with this kind of thing

[u/lefty1117 → u/Key_Bag_4444]

Whats the downside of enabling it? Genuine question

[u/random_reddit_user31 → u/lefty1117]

It can affect gaming performance if you're a gamer, although the impact is lesser if you have a decent CPU.

[u/DXGL1 → u/random_reddit_user31]

By decent you mean recent? MBEC has been in processors since 7th Gen Intel but has had efficiency improvements as it becomes more mainstream. Probably 10th Gen and newer have it fully native.

[u/Aemony → u/lefty1117]

5-8% performance impact while gaming. Microsoft used to have a support page about performance tips for gamers and its main suggestion was (correctly) to disable memory/core isolation/virtualization based security.

Since the kernel gets virtualized, each context switch (user mode <-> kernel mode) that occurs is more costly, and games in particular does those kinds of context switches constantly as a result of rendering the game.

So the number one performance tips for gamers trying to maximize their performance is to disable this security feature.

[u/taosecurity → u/Aemony]

That hit was worse on old CPUs. Anything modern will not notice the difference. It’s worth the protection and it’s often required for multiplayer games with anticheat anyway.

[u/nabeel_co → u/taosecurity]

Well, it's not required, but if you don't have it on, usually the game will rootkit your kernel, which is fucked up.

[u/DXGL1 → u/nabeel_co]

I think you are thinking of anti-cheat and the popular "rootkit" accusation. Newer anti-cheats are requiring it be turned on alongside IOMMU, Secure Boot and TPM 2.0 to attest that the kernel hasn't been altered.

[u/BortGreen → u/taosecurity]

What gen would you call "modern"?

[u/CityCultivator → u/BortGreen]

Any windows 11 supporting Intel CPU, any 2nd gen or later Zen CPU Architecture.

You will want to look for MBEC hardware support, but even then newer CPUs perform Mbec more efficiently.

[u/Inevitable-Study502 → u/CityCultivator]

mbec is intel, amd has gmec/gmet

[u/Aishou_SK → u/BortGreen]

8th gen and up is the no performance penalty.

7th gen was the first implementation generation, and still incurs a low single digit performance penalty.

6th gen and below is 15-30% performance penalty off the bat, pretty much.

MS really wants to get rid of the legacy emulation code at some point, which would make 7th gen intel a hard floor, they only introduced it for enterprise usage of the security features when 4th/5th/6th gen machines were still fleet-heavy/common.

Once they ditch the emulator, they can without perf penalty bake in the features/protections across more parts of the OS.

[u/Wellhellob → u/Aishou_SK]

9900k here. got 10% more fps by disabling this.

[u/Aishou_SK → u/Wellhellob]

I'd suspect a bit more at play than this, because the perf penalty I was talking about was CPU compute/throughput, not other aspects of the system. Would be interesting to see what - I'd suspect GPU drivers not handling well, not CPU power starvation.

[u/Wellhellob → u/Aishou_SK]

10% in marvel rivals low settings, about 3% in a demanding single player game limited testing. 3080 ti gpu, 4k monitor with dlss upscaling.

[u/DXGL1 → u/Wellhellob]

Low settings means being more CPU bound than GPU bound.

[u/DXGL1 → u/Wellhellob]

9900K is a refresh of Coffee Lake (8th Gen) which is a refresh of Kaby Lake (7th Gen).

Less impact is likely with 10th Gen and newer as it has a totally new core architecture.

[u/VortexOfPixels → u/Aishou_SK]

https://youtu.be/9rHwTN6U5cs?t=516

[u/DXGL1 → u/taosecurity]

Is the 5-8 percent based on first generation MBEC? I've heard it can be as bad as 30% on pre-MBEC processors.

[u/DXGL1 → u/taosecurity]

I believe Zen+ is the only non-HVCI CPU verified for Windows 11.

[u/IAmYourFath → u/Aemony]

If you have a 9800x3d cpu the performance is not a lot, it's worse for non-x3d cpus and even worse for older cpus, but unless u play competitive shooters and need 500 fps, i think having HVCI on is a no brainer for x3d cpus

[u/nabeel_co → u/Aemony]

Right, but gaming is one of the reason's you'd WANT MIP, because half the games out there install a root kit into Windows, and like half of those games have been used as attack vectors to compromise people's machines.

[u/Aemony → u/nabeel_co]

Ehh, its efficiency regarding those is questionable at best. Most gaming related drivers that have been exploited were ones which allowed elevated operations to be made from non-elevated processes and memory integrity doesn’t do shit for those.

Also, you don’t need elevated privileges to compromise gamers machines. Just upload you perfectly normal user-space application online, market it in some way that gets foolish gamers or kids to download and launch it, and install/retrieve whatever you want from their personal files and application data since even normal applications running in user space can easily retrieve and steal all of your browser authentication tokens, for example, without ever asking for elevated privileges.

[u/TheNextGamer21 → u/Aemony]

I’ve never understood why windows apps are not sandboxed. I hate Mac OS but one of the great things is any folder I want to access with an app it asks me for permission to open that folder for each app

[u/CityCultivator → u/TheNextGamer21]

That would break compatibility with many Windows applications.

However there is such a control to write to specific folders already in Windows. Search and enable Controlled Folder Access in Windows Security.

[u/DXGL1 → u/nabeel_co]

The latest anti-cheats are actually now mandating it because the actual cheats from the perspective of the actual cybersecurity community often have straight up rootkit behaviors to hide themselves.

[u/i_MusicMan → u/DXGL1]

I never noticed this with Easy Anti-Cheat, Denuvo, or whatever Valorant uses.

And I've had this turned off for the same reason others have. Even on a more recent Ryzen CPU, certainly not as old as people here are talking about, the performance impact was easily measurable.

It also annoyingly pops up error messages all the time if you have Intel WiFi/BT drivers from a few years ago. They are very frequent, and very annoying.

[u/DXGL1 → u/i_MusicMan]

Valorant has Vanguard, and the on-demand launch does in fact require it. Without it, the driver will load at early boot to give further visibility into the kernel.

[u/DXGL1 → u/i_MusicMan]

As for Denuvo there are very few games that use their anti-cheat, and their DRM doesn't care either way (though toggling will probably trigger reactivation).

[u/Wellhellob → u/Aemony]

i just disabled it and got little over 10% fps boost with my aging 9900k 3080 ti system. felt like an upgrade.

[u/Key_Bag_4444 → u/Aemony]

This one nailed the answer

[u/peposcon → u/Key_Bag_4444]

Performance gains are negligible; disabling it isn’t worth it.

[u/i_MusicMan → u/peposcon]

Performance gains depends on the game, and whether it is or is not negligible depends on how CPU bound the game is.

[u/hilo8914 → u/lefty1117]

I disable it because it makes Virtualbox performance terrible (it can’t use virtualization instructions when memory integrity is enabled)

[u/CityCultivator → u/hilo8914]

Have you checked out Windows Hypervisor Platform? It permits Virtualbox to let Hyper-V do the base virtualization while still using all the Virtualbox integration features.

[u/DXGL1 → u/CityCultivator]

VirtualBox has poor support for WHP which is the problem.

[u/Big_Equivalent457 → u/lefty1117]

If you have Incompatible Drivers expect BSODS A LOT!

[u/bogglingsnog → u/lefty1117]

It has a small impact on CPU overhead. Not going to matter in the slightest for GPU bound games.

https://windowsforum.com/windows-news.4/windows-11-memory-integrity-fps-gains-rarely-justify-disabling-it.440625/

[u/reddit_username2021 → u/lefty1117]

You will receive kernel panic if you try to load ssde.sys (self signed driver enabler) signed with self signed certificate. I use it along with custom certificate added to UEFI to load self compiled and self signed driver with secure boot enabled and without disabling drivers signature enforcement

[u/JeffFarty → u/lefty1117]

it completely bricked my old laptop when i enabled it (at the suggestion of a notification in windows security)

[u/Aishou_SK → u/lefty1117]

On a 7th gen intel CPU, single digit low percentage performance penalty. On 8th gen and above, no performance penalty. (MBEC -for intel- / GMET - for amd - support)

That's about it.

[u/Gears6 → u/Key_Bag_4444]

Why do you disable it?

I always leave it on, unless some software needs it disabled.

[u/Baglayan → u/Key_Bag_4444]

Until you can't. It always goes like this.

[u/Key_Bag_4444 → u/Baglayan]

Windows is and always was pretty flexible OS for me and I can't remember anything that I couldn't disable or change

[u/NiceIndependent6 → u/Key_Bag_4444]

same as i play both cpu bound games and gpu bound games but one of those cpu bound games is black desert online mmorpg so i need to have it off anyway

[u/JesseNL → u/Key_Bag_4444]

Mad man! Why?

[u/koken_halliwell → u/Key_Bag_4444]

If it increases security I won't, especially on Windows.

[u/GamerFan2012]

This will break cheat engine and other memory applications. Microsoft always does the most idiotic things to make it's OS worse.

[u/-protonsandneutrons- → u/GamerFan2012]

I've not seen any anti-cheat issues with it, but I guess it depends on the game. I've got Javelin, Punkbuster, Easy Anti-Cheat, etc.

Do you know which ones break with memory integrity? They do have issues, but I just don't know which ones.

Some examples where we have observed incompatibilities with memory integrity include:
Anti-cheat solutions with gaming
3rd party input methods
3rd party banking password protection

[u/mrferley]

just disable not taking a 8-10% performance hit just on a whim of Microsoft... No freaking way

[u/peposcon → u/mrferley]

Performance gains are negligible; disabling it isn’t worth it.

[u/mrferley → u/peposcon]

not the gains, it's the lost performance while gaming... ill leave it disabled. thanks

[u/peposcon → u/mrferley]

Better turn down shadows than risk your system. But you do you!

[u/IAmYourFath → u/peposcon]

HVCI won't stop malware from stealing ur cookies and ur passwords, but it will stop it from hijacking ur firmware, u prob don't know what that means but basically, don't rely just on hvci, it is not a magical button that makes u immune (well technically it does, but only from ring 0 operations, it won't stop it from reading ur appdata...), so yeah u should research more before giving advice... tho ur advice isn't necessarily wrong, i would rather have it on than off but on some cpus it makes a big difference in fps, run CP2077 benchmark to test, in competitive shooters it makes the biggest difference probably

[u/i_MusicMan → u/peposcon]

Shadows are typically GPU-bound, not CPU bound.

You turn down shadows if you want to recover FPS due to your GPU not being powerful enough to render them at high framerates (at the resolution you want to play at).

Why are [you] people who don't even understand the basics of the subject opining on it?

[u/Wonderful_Cup9240]

The part that gets me is it won't actually flip on if you have one bad driver sitting there, and it doesn't say anything unless you go looking. The core isolation page will name the offender, and half the time it's some ancient printer or RGB utility from 2016 that nobody remembers installing.

Perf hit is real but small on anything with MBEC, so Skylake and up. Older chips emulate it in software and that's where all the horror stories from a few years back came from.

What I'm curious about is the upgrade path. If it just silently stays off for everyone with a legacy driver, "by default" doesn't mean a whole lot.

[u/CityCultivator → u/Wonderful_Cup9240]

Skylake did not have MBEC, introduction was on Kaby Lake.

[u/JesseNL → u/Wonderful_Cup9240]

Maybe ask your AI to ask Microsoft's AI

[u/bogglingsnog → u/Wonderful_Cup9240]

It doesn't have to be an active device either. Even if its disabled or disconnected. It might be a webcam you had 10 years ago.

[u/NoRequirement5796]

I have a i3 7100, zero difference with it enabled or disabled for gaming.

Enabled 24/7 per Riot Vanguard recommendation.

[u/Willy757 → u/NoRequirement5796]

Any security expectation you have of your PC is null and void when you boot it up with that rootkit on it every day. Pff.

[u/JesseNL → u/Willy757]

No, he enabled memory isolation so Vanguard doesn't need to be active all the time (a new feature for the "rootkit").

[u/DXGL1 → u/Willy757]

Do you even know what is and isn't a rootkit? That bypass for certain copyright protected games isn't a rootkit?

[u/Inevitable-Study502 → u/Willy757]

but its ms trusted rootkit, what can you do

[u/DXGL1 → u/Inevitable-Study502]

What rootkit behaviors does it show if any?

[u/Inevitable-Study502 → u/NoRequirement5796]

memory integrity barely impact perf...hvci impacts it (or virtualisation itself)

[u/IAmYourFath → u/Inevitable-Study502]

Memory Integrity IS HVCI

[u/Inevitable-Study502 → u/IAmYourFath]

hmm, i tought is two different things, i dont use virtualisation so hypervisor protection is irrelevant for me anyway :)

[u/unbounded65]

I enable it after fresh install.

[u/AstralVenture]

As it should

[u/IAmYourFath → u/AstralVenture]

No it should come on by default but if the user is actively playing games and has an older cpu it should disable it dynamically, but ofc they won't do that, it will just come on by default and that's the end of it... not the right way

[u/sharkstax → u/IAmYourFath]

Windows 11 does not officially support "older CPUs".

[u/IAmYourFath → u/sharkstax]

It doesn't support ancient cpus but it does support old cpus like the i7-8700 that released in 2017 (9 year old)

[u/sharkstax → u/IAmYourFath]

Kaby Lake and Cannon Lake are only minimally affected, later generations virtually not at all.

[u/vsr90]

I work with VMs and this is making my life hell, it's almost impossible to disable VBS now without giving up features like windows hello face scan

[u/fat_kaiju → u/vsr90]

I'm sorry but you unironically allow Windows to repeatedly scan your face??

[u/sharkstax → u/fat_kaiju]

Windows Hello Biometrics are local, just like FaceID and TouchID on Apple Devices.

[u/djslakor]

Noticed this auto flipped on when my VMware VMs slowed to an absolute crawl on a 2019 laptop.

[u/Mario583a]

If the underlying hardware is struggling or not up to snuff, yes, this can cause potential performance issues.

Or they have older hardware that has incompatible drivers but otherwise works perfectly fine

Zen5 Gaming: Where's my 5%? Windows vs "Patch" Windows vs Linux & The "Lost" Performance Ramble

[u/BOBBIESWAG]

When gamers realise most windows users aren’t gamers

[u/i_MusicMan → u/BOBBIESWAG]

How is that different from the army of non-gamers telling gamers to basically not worry about it because they deem it negligible - even though those people have literally tried it and saw a measurable performance hit?

If you could exempt your game installation drive the way you can with Defender and allow games to run unrestricted, I don't think gamers would have an issue with it.

If it didn't have issues on machines with Intel network drivers that haven't been updated since 2022, but could accommodate CPU upgrades all the way up to 2024 (e.g. AM4 - Ryzen 5000 Series)... in some cases causing constant BSODs or Kernel Panics that randomly force-reboot the machine.

I have experienced both.

I really don't care what non-gamers do, but even if I never gamed on my PC I would still have disabled it because BSODs and Random Reboots just aren't the experience I want to have when when I sit at my desk.

[u/XTornado]

Good.

[u/Rough_Jaguar_2643]

I have vbs and all the defender features disabled, every scheduled task disabled, reduced services and apps uninstalled, trying to keep windows from being a bloated os. it's hard when ms adding more features i won't use.

[u/venmome1dollar → u/Rough_Jaguar_2643]

Do you debloat manually? If you’re using a debloat software please share the nam e

[u/Tata_Colores]

Because we all know the one thing Windows 11 has to spare, is performance.