Windows Memory Integrity to Auto-Enable on Eligible Devices in October 2026
Microsoft will automatically enable Memory Integrity protection on eligible Windows devices starting October 2026, enhancing kernel-level security and potentially enabling Virtualization-based Security (VBS).
Microsoft is set to significantly bolster Windows security by automatically enabling the Memory Integrity feature on eligible devices through standard quality updates beginning in October 2026. This proactive measure aims to enhance the protection of the Windows kernel by preventing untrusted kernel-mode code and drivers from executing.
Memory Integrity is a core component of Virtualization-based Security (VBS) that acts as a critical defense layer. By ensuring only trusted code can run at the kernel level, it effectively thwarts attackers who attempt to compromise the operating system's core functions, such as those deploying rootkits or other kernel-level malware.
The rollout will be integrated into regular Windows quality updates, meaning that the security posture of managed fleets can be improved across devices with each update cycle, without requiring manual intervention or change requests from administrators. This approach simplifies the deployment of enhanced security measures across large organizations.
For devices where VBS is not already active, the same October 2026 updates will also enable VBS. This dual action ensures that more systems benefit from the enhanced security protections offered by virtualization-based security features, which create isolated environments for critical security processes.
Microsoft has emphasized that existing administrator and user configurations will remain in effect. Devices where Memory Integrity has been previously disabled will not be automatically re-enabled. Users and organizations will retain the ability to review, configure, and manually enable the feature using existing Windows security and management tools if needed.
Before enabling the protection, Windows will perform a readiness evaluation on each device. This assessment considers hardware capabilities, driver compatibility, and potential performance impacts to ensure a smooth transition for eligible systems. While this check aims to identify potential issues, Microsoft acknowledges it may not catch every incompatible kernel driver, advising users of custom or unusual kernel-level software to remain vigilant.
Beyond its direct security benefits, Memory Integrity also underpins Microsoft's hotpatching capabilities, which allow certain updates to be installed without requiring a system reboot. Devices that remain unprotected by Memory Integrity may therefore miss out on these more efficient servicing updates, impacting overall system manageability and uptime.
Organizations with devices that are not automatically enrolled or that encounter issues can still manually enable Memory Integrity and VBS through standard Windows security and management interfaces. This ensures that all users have the option to leverage these advanced security features, regardless of their device's eligibility for the automatic rollout.