Windows 11 turns on memory integrity by default from October 13

Microsoft will switch on Windows 11's memory integrity protection by default, starting with the Patch Tuesday update on October 13, 2026. Windows Latest reports that the change reaches eligible PCs automatically, in stages. Anyone who ships a kernel driver, or who runs virtualization tools, is the most likely to notice something stop working.

Memory integrity is a security feature that guards the core of Windows. Until now, most people had to turn it on themselves.

What memory integrity actually does

Memory integrity checks kernel-mode code before it is allowed to run. Kernel mode is the most privileged level in Windows. Code running there can read and write any memory on the machine, so a single bad driver can own the whole system.

Microsoft's documentation describes the feature as part of virtualization-based security, or VBS. VBS uses the processor's own virtualization hardware to carve out a small, separate environment. Windows then runs the code-integrity check inside that isolated space. Malware sitting in the normal operating system cannot reach in and tamper with the check.

The result is a short allowlist. Only trusted, properly signed drivers load. Everything else is refused.

The feature itself is not new, and it travels under several names. "Memory integrity is sometimes referred to as hypervisor-protected code integrity (HVCI) or hypervisor enforced code integrity, and was originally released as part of Device Guard," Microsoft's documentation says. What changes in October is the default, not the technology.

Windows Latest ties the timing to a shift in how kernel bugs are found. Its report says AI-assisted vulnerability research has sped up the discovery of kernel-level exploits.

Which PCs get it switched on

Not every machine qualifies. Windows checks the hardware first, and Windows Latest lists what it looks for.

Requirement	What a device needs
Processor	Intel 8th generation or newer, AMD Zen 2 or newer, or Qualcomm Snapdragon 8180 or newer
Memory	At least 8 GB of RAM on x64 systems
Storage	At least a 64 GB SSD
Firmware	Virtualization enabled in the firmware settings
Drivers	Compatible drivers already installed

Microsoft's own documentation adds a performance note underneath that list. Processors from Intel's Kabylake generation onward include a feature called Mode-Based Execution Control. AMD's Zen 2 chips and later carry an equivalent, named Guest Mode Execute Trap. On those chips memory integrity runs at its best. Older processors fall back to an emulation mode called Restricted User Mode, and Microsoft says that path carries a larger performance impact.

Windows Latest also reports that Microsoft will run readiness assessments on a device before enabling anything.

There is one documented gap in the cloud. Microsoft's documentation says Azure virtual machines do not support memory integrity when Secure Boot with DMA is selected. In that configuration VBS reports itself as enabled, but it is not actually running.

How to keep it off, if you have to

The rollout is an opt-out, not a forced override.

Windows Latest reports that Windows respects a deliberate existing choice. If memory integrity is already off through Group Policy, through Intune, or through a registry change, the update leaves it off. The automatic switch only flips machines that never made a decision either way.

Microsoft's documentation lists every place the setting lives: the Windows Security app, Intune and CSP, Group Policy, the registry, and App Control for Business. Since Windows 11 22H2, the Windows Security app has displayed a warning when memory integrity is turned off.

What this means for developers

Test your driver against memory integrity now, not on October 14. Microsoft's documentation is blunt about the failure mode. Incompatible applications and drivers can malfunction, and they can cause blue-screen boot failures. A driver that loads cleanly today may simply refuse to load once the check is active.

The test is small. Turn the feature on manually on a spare machine, reboot, and watch what loads. If a driver you depend on is third-party and unmaintained, find out this month whether a signed replacement exists at all.

Virtualization tooling deserves a separate pass. Memory integrity claims the processor's virtualization hardware for its isolated environment. If your build or test setup also runs a hypervisor or a device emulator, test that exact combination rather than assuming it survives. Check the version your team installs, and check the version your CI runners use.

Support teams should prepare for a pattern, not a single incident. The rollout is staged, so two identical laptops can sit in different states for weeks. Ask whether memory integrity is on before spending an hour reproducing a bug report. Adding that one line to your existing diagnostic script will pay for itself.

One documentation decision is worth making deliberately. If your product's install guide currently tells users to disable memory integrity, that instruction is about to age badly. Rewrite it now, or accept that your own users will be the ones filing blue-screen reports in October.