Check If HVCI Is Enforced Using Regedit

Hypervisor-Protected Code Integrity (HVCI), commonly referred to as Memory Integrity, is a critical Windows Virtualization-Based Security (VBS) feature that runs kernel mode code integrity checks inside a secure environment. This article provides a concise step-by-step guide on how to verify whether HVCI is enforced on your Windows system using the Windows Registry Editor (Regedit).

Step 1: Open the Registry Editor

1. Press the Windows Key + R to open the Run dialog box.
2. Type regedit and press Enter.
3. If prompted by User Account Control (UAC), click Yes to grant administrative permissions.

Step 2: Navigate to the HVCI Registry Key

In the Registry Editor address bar, paste the following path and press Enter:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity

Alternatively, manually expand the tree on the left sidebar: - HKEY_LOCAL_MACHINE - SYSTEM - CurrentControlSet - Control - DeviceGuard - Scenarios - HypervisorEnforcedCodeIntegrity

Step 3: Check the Enforcement Values

In the right pane of the HypervisorEnforcedCodeIntegrity key, inspect the following DWORD (32-bit) values:

• Enabled
  • Value 1: HVCI is currently enforced/enabled.
  • Value 0 (or key missing): HVCI is disabled.
• Locked
  • Value 1: HVCI is locked with UEFI protection, meaning it cannot be disabled simply by changing registry keys or group policies without modifying UEFI settings.
  • Value 0: HVCI is not locked via UEFI.

Step 4: Verify Base Virtualization-Based Security (VBS)

HVCI requires Virtualization-Based Security to function. To verify the overall VBS configuration:

1. Navigate to:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard

2. Locate the EnableVirtualizationBasedSecurity DWORD.

   • Value 1: VBS is enabled, allowing HVCI to run.
   • Value 0: VBS is disabled.