Advice Request Win10 Core Isolation switch stuck

[RejZoR]

I've installed the Win10 Spring Update as it became available and I've noticed one bizarre issue with the new Core Isolation feature which can be found under:
Right click on Security Center icon -> View security dashboard -> Device Security -> Core Isolation

If you switch this from OFF to ON, it asks you to confirm and restart, you get second confirmation and after that, the Core Isolation switch becomes grayed out and it says some controls are controlled by administrator.

Anyone has any idea how to get the control of the button back again without using the damn Refresh function?

 

[Deleted member 65228]

Unless there's documented workarounds by Microsoft themselves your best bet is doing the Refresh and trying again because any undocumented and partially-approved technique from a community which may or may not work properly or is likely not even tested properly can do more damage than good is not worth the trouble.

I know it sucks but it just isn't worth it.

 

[RejZoR]

Question is, why does it flip out into this "the setting is controlled by administrator" when I'm the bloody administrator?

 

[Av Gurus]

On my PC don't work.
When I turn ON it ask for restart but after restart is turned off.



I don't have Secure Boot is this needed for that or something else?
Here are my PC specs:
CPU: - Ryzen 5 1600
GPU: - Gigabyte RX 560 OC 4G
RAM: - G.Skill TridentZ ( 2x8 ) 16GB DDR4 3200MHz
MBO: - ASRock AB350 Gaming ITX
SSD: - Crucial MX300 275GB M.2

 

[frogboy]

This not looking good at all, this the 3rd case here at MT in two days. Who knows how many more will be affected by this during the update.

 

[Deleted member 178]

Same issue here.

Once ON, it can't be turned OFF.

I guess the "administrator" may be the super-admin account.

 

[mekelek]

it's microsoft, you guys are beta testing esentially.

 

[Av Gurus]

I'm not sure what kind a requirements Microsoft need for that looking from this site:

Virtualization-based Security (VBS)

 

[RejZoR]

Ok, I've figured it out and created a tool to control the Core Isolation feature externally. You can grab it here:

Windows 10 Core Isolation Control 1.0 released!

 

[shmu26]

I'm not sure what kind a requirements Microsoft need for that looking from this site:

Virtualization-based Security (VBS)

I also was unable to enable it.
With
Windows 10 Core Isolation Control 1.0
will we be able to enable it??

 

[RejZoR]

Hard to say since I never had that problem. You may give it a try and then check the Windows Defender page to see if it's actually on. This feature relies on virtualization which may not be available on your system for whatever reason.

 

[shmu26]

Hard to say since I never had that problem. You may give it a try and then check the Windows Defender page to see if it's actually on. This feature relies on virtualization which may not be available on your system for whatever reason.

Thanks. I have virtualization on, but there might be some other element of my system that doesn't support this feature. I tried a couple weeks ago, and then rolled back to fall creators. I think I will wait a little until I try again.

 

[shmu26]

Hard to say since I never had that problem. You may give it a try and then check the Windows Defender page to see if it's actually on. This feature relies on virtualization which may not be available on your system for whatever reason.

So I forced core isolation to turn on using this tool, and it worked. After reboot, it stayed on -- and I got an error message from Zemana that it was unable to start up. I did not get this message before. Apparently, Zemana driver is not compatible with core isolation.
I was using Zemana only for on-demand scanning -- not for real-time protection -- but it still caused an issue.
Anyways, thanks for the great tool!

 

[ZeroDay]

So I forced core isolation to turn on using this tool, and it worked. After reboot, it stayed on -- and I got an error message from Zemana that it was unable to start up. I did not get this message before. Apparently, Zemana driver is not compatible with core isolation.
I was using Zemana only for on-demand scanning -- not for real-time protection -- but it still caused an issue.
Anyways, thanks for the great tool!

A lot of security product are giving that warning with core isolation enabled KIS and CF are two other examples I've seen mentioned as having the same error message when core isolation is enabled.

 

[Sunshine-boy]

Virtualization-based Security (VBS)

There are some useful tools that can help you to find what features your CPU support.
for Intel:
Download Intel® Processor Identification Utility - Windows* Version
For AMD:
http://download.amd.com/techdownloads/AMD-VwithRVI_Hyper-V_CompatibilityUtility.zip
another one:
Download Device Guard and Credential Guard hardware readiness tool from Official Microsoft Download Center

 

[shmu26]

There are some useful tools that can help you to find what features your CPU support.
for Intel:
Download Intel® Processor Identification Utility - Windows* Version
For AMD:
http://download.amd.com/techdownloads/AMD-VwithRVI_Hyper-V_CompatibilityUtility.zip
another one:
Download Device Guard and Credential Guard hardware readiness tool from Official Microsoft Download Center

Yeah, I was pleased to see that my hardware is sufficient to support the feature.
The thing hanging me up was Zemana. I forgot it was even on my system, because I hardly ever use it. Who knows what other issues were because of Zemana

 

[Flak]

Typically the greyed out options with the message that it's controlled by your adminstrator is because part of the control is now falling under group policy. Why they don't just say that, who knows, it's been that way since at least Windows 7.

 

[RejZoR]

Typically the greyed out options with the message that it's controlled by your adminstrator is because part of the control is now falling under group policy. Why they don't just say that, who knows, it's been that way since at least Windows 7.

Yeah, but the funny part is, it's not that way until you enable it. Once you do, it spergs out. It's especially funny on Home editions where you don't have Policy Manager at all. Besides, why the hell would it lock itself out after enabling it. It's stupid and someone at MS didn't do his job.

Btw, Logitech gaming Software also isn't compatible with it. It works, but Windows Security Center will warn that some driver is misbehaving.

 

[shmu26]

Yeah, but the funny part is, it's not that way until you enable it. Once you do, it spergs out. It's especially funny on Home editions where you don't have Policy Manager at all. Besides, why the hell would it lock itself out after enabling it. It's stupid and someone at MS didn't do his job.

Btw, Logitech gaming Software also isn't compatible with it. It works, but Windows Security Center will warn that some driver is misbehaving.

I have Logitech MX master wireless mouse, and fortunately, no issues and no warnings. It is not a gaming mouse.

 

[LahiruRajinda]

Simple registry hack can fix this issue:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity\Enabled
1=True
0=False