Microsoft to Automatically Enable Memory Integrity on Windows Devices to Block Kernel Attacks

Microsoft will start automatically enabling Memory Integrity protection on eligible Windows devices through quality updates beginning in October 2026.

This change aims to strengthen defenses against kernel-level attacks by ensuring that only trusted kernel-mode code and drivers can run on supported systems.

Memory Integrity is a security feature built on Virtualization-based Security (VBS), a Windows capability that uses hardware virtualization to isolate sensitive operating system functions from the rest of the environment.

Microsoft states that this rollout will help organizations establish a stronger baseline against sophisticated threats without requiring extensive administrator configuration.

Focus on Kernel Attacks

The Windows kernel is one of the most privileged components of the operating system. Attackers gaining kernel-level execution can bypass security controls, manipulate processes, disable endpoint protections, steal credentials, or maintain deep persistence on compromised devices.

Threat actors often attempt to reach the kernel by exploiting vulnerable drivers, abusing legitimate but flawed third-party drivers, or using kernel exploits to elevate their privileges.

This tactic, often associated with bring-your-own-vulnerable-driver attacks, allows malware to execute with the same privileges as the operating system itself.

Memory Integrity, also known as Hypervisor-Protected Code Integrity (HVCI), mitigates this risk by validating kernel-mode code before it is allowed to execute. This protection helps prevent malicious, unsigned, altered, or untrusted drivers from loading into kernel memory.

By enabling this feature by default, Microsoft aims to reduce the number of Windows endpoints where kernel protections remain disabled due to deployment complexity, compatibility concerns, or inconsistent administrative configurations.

Starting in October 2026, Windows quality updates will assess devices and enable Memory Integrity where the system meets Microsoft’s eligibility requirements. If VBS is not already active, these updates may also enable it as part of the process.

Microsoft will evaluate device readiness before implementing this change. The assessment will consider hardware support, driver and software compatibility, and performance factors. This staged eligibility model is designed to avoid enabling the feature on devices that may experience stability or usability issues.

The company emphasized that the rollout will not override existing security decisions. Devices where administrators or users have previously disabled Memory Integrity will not be automatically changed.

Existing organizational policies and management configurations will remain in effect. This distinction is crucial for enterprises that rely on legacy hardware, specialized peripherals, older drivers, or applications that may not yet be compatible with VBS-based protections.

Administrators will still be able to manage Memory Integrity using established Windows security settings, Group Policy, mobile device management platforms, and other enterprise tools.

Microsoft frames the update as part of its “secure by design” and “secure by default” strategy. Instead of requiring organizations to manually identify and enable every available hardening feature, the company is moving more protection into the default Windows configuration for compatible hardware.

This protection also supports broader Windows security capabilities. Microsoft noted that VBS-backed security forms a foundation for newer features, including hotpatch updates, which can apply certain security updates while minimizing the need for system restarts.

For defenders, wider deployment of Memory Integrity could make it more difficult for malware operators and ransomware groups to achieve kernel-level compromises. It may also reduce the effectiveness of malicious driver-loading techniques that continue to arise in sophisticated intrusion campaigns.

Organizations should review hardware readiness, incompatible drivers, and existing VBS policies before the October rollout. Security teams should also verify that endpoint management tools accurately report Memory Integrity status across their Windows fleet.

Microsoft’s automatic enablement plan signifies a continued shift towards hardware-assisted Windows security, where protections against highly privileged attacks are enabled by default rather than remaining optional hardening measures.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.