How to Enable HVCI in Windows Registry

Hypervisor-Protected Code Integrity (HVCI), commonly referred to as Memory Integrity, is a virtualization-based security (VBS) feature in Windows that prevents malicious code from running in the security-sensitive Windows kernel. This guide identifies the exact Windows Registry key responsible for controlling the system-wide enablement of HVCI, details the required values, and provides straightforward configuration steps.

The HVCI Registry Location

The system-wide configuration for HVCI is controlled by the following registry key path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity

Inside this key, the specific DWORD (32-bit) Value that controls the feature is:

• Value Name: Enabled
• Value Type: REG_DWORD

Configuration Values

To change the state of HVCI, modify the Enabled DWORD value using the following data:

• 1 = Enabled (Turns HVCI / Memory Integrity on)
• 0 = Disabled (Turns HVCI / Memory Integrity off)

Step-by-Step Instructions

1. Press Windows Key + R, type regedit, and press Enter to open the Registry Editor.
2. Navigate to:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios
3. If the HypervisorEnforcedCodeIntegrity key does not exist under Scenarios, right-click Scenarios, select New > Key, and name it HypervisorEnforcedCodeIntegrity.
4. Select the HypervisorEnforcedCodeIntegrity key. In the right pane, locate the Enabled value. If it does not exist, right-click in the empty space, select New > DWORD (32-bit) Value, and name it Enabled.
5. Double-click Enabled, set the Value data to 1 (to enable) or 0 (to disable), and click OK.
6. Restart your computer for the changes to take effect.

Note: For HVCI to function properly when enabled, your system hardware must support CPU virtualization (Intel VT-x or AMD-V) and Second Level Address Translation (SLAT), and virtualization must be enabled in your system’s UEFI/BIOS settings.