Core Isolation Memory Integrity compatibility boundary after Windows 11 24H2 configuration transition

Confirmed facts: Memory Integrity driver block criteria in Windows 11 24H2

• The driver must be signed by a Microsoft‑trusted authority.
• The driver must not contain executable and writable memory pages simultaneously unless the Control Flow Guard (CFG) flag is set.
• The driver must pass the Windows Hardware Quality Labs (WHQL) HVCI compatibility test, which validates proper page‑level isolation.
• The PE header’s code section cannot be marked both executable and writable; such a marking violates HVCI memory‑access policy.

These rules were introduced in Windows 10 21H2 and are enforced more strictly in 24H2, so a driver that previously loaded may now be blocked silently.

Likely explanation for the tighter enforcement in 24H2

Windows 11 24H2 aligns the HVCI policy with the latest Secured‑core requirements, expanding the CFG requirement to more driver binaries and increasing the scrutiny of memory‑page attributes. This reduces the attack surface for kernel‑mode exploits that rely on writable‑executable sections.

Steps to isolate the test environment from production Entra ID and conditional access

1. Create a dedicated Entra ID sandbox tenant that has no federation or B2B links to the production tenant.
2. Configure a Conditional Access policy in the sandbox that excludes the test user groups or uses a separate identity provider (e.g., a local AD DS) to ensure no production policies apply.
3. Join test devices to the sandbox tenant via Azure AD Join or register them for Windows Hello for Business cloud trust; this creates an independent device identity.
4. Use a local administrator account for all testing activities and avoid signing in with any production credentials.
5. If a production tenant must be used, create a security group that is excluded from all production Conditional Access policies and apply a test‑only policy to that group.

Previewing the Memory Integrity driver block list before upgrading

Windows 11 24H2 does not provide a pre‑upgrade UI to list which drivers will be blocked. The block list is generated at boot based on each driver’s signature and memory‑access characteristics.

To see which drivers are currently blocked, open Event Viewer → Windows Logs → System and look for Event ID 1903 (or 1902) with source "CodeIntegrity". The event message includes the driver file name that caused the block.

You can also query the current HVCI state with PowerShell:

Get-CimInstance -Namespace root\Microsoft\Windows\DeviceGuard -ClassName Win32_DeviceGuard

This command shows whether Memory Integrity is enabled but does not enumerate blocked drivers.

Missing diagnostic detail needed: Please provide the exact name of the driver that fails to load under Memory Integrity, as this will determine whether a WHQL‑signed update, a signing change, or a policy exception is required.