On Windows 10/11 when memory integrity cannot be switched on due to incompatible drivers, you can use pnputil.exe to remove the affected OEM drivers
Open Windows Security
Select Device Security
Select the Core isolation details
Set the slider to ON to enable core isolation
If any incompatible (old) drivers are on the system, you will get this:
Select ‘Review incompatible drivers’
Driver example: apg8201zx64.sys (ACS smart card reader driver) – expand the driver to display the oem##.inf
Open an elevated command prompt & run
pnputil.exe /delete-driver oem##.inf
Once successfully removed press the ‘Scan Again’ button in the Windows Security app
If no more incompatible drivers are found you will be able to use core isolation (after a restart)
Reboot the device & verify the setting is now on
Troubleshooting tips:
In case you run in to an exception causing your device to bluescreen after turning on this option, you can reboot into safe mode & run this command to turn it off again:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f
