Applies to: Windows 11
Summary
Integrity Protection enables a recommended set of Windows security protections to help keep your device in a trusted, secure state.
These protections work together to help protect the integrity of Windows, including hardware-backed security, protections during startup, virtualization-based security, and protections that help prevent untrusted or vulnerable code from compromising the system.
Your device meets Integrity Protection only when all required protections are active. If one or more protections need attention, Windows shows you what needs to be addressed and, when possible, helps you turn on the appropriate protection.
Check Integrity Protection
To review your device's Integrity Protection state:
- Open Settings.
- Go to Security.
- Select Integrity protection.
From here, you can see the security protections evaluated and whether any action is needed.
If your device meets Integrity Protection
No action is required. The required security protections are active.
If your device needs attention
One or more security protections required by Integrity protection aren't active.
Windows can help you enable supported protections. All changes require you to restart your device before they take effect. Other protections, such as certain hardware or firmware security features, might require additional steps.
Follow the guidance shown next to the protection that needs attention.
If your device is pending restart
One or more security protections require a restart to take effect. Save your work and restart your device to finish applying the change.
Security protections checked by Windows Integrity Protection
Windows checks several important protections that work together to keep your device secure. Microsoft highly recommends keeping all these protections turned on. If you don't understand every protection, that's okay. Windows will tell you if something needs attention and help you fix it when possible.
| Protection | What it does |
|---|---|
| Security processor | The security processor, such as TPM 2.0, is a secure place inside your device that protects sensitive information. It also helps Windows confirm that your device started safely and hasn't been tampered with. |
| Secure Boot | Secure Boot checks software before Windows starts and allows only trusted software to run. This helps stop harmful software from loading before Windows has a chance to protect your device. |
| Virtualization-based security | Virtualization-based security creates a protected area inside your device for important security tasks. Think of it as a locked room that helps keep sensitive information safe, even if harmful software gets into another part of Windows. |
| Memory integrity | Memory integrity checks important drivers and other system software before allowing them to run. This helps prevent harmful or untrusted code from gaining powerful access to Windows. |
| Test signing protection | Test signing is intended for developers who are testing unfinished drivers. Keeping test-signing mode turned off helps prevent development or untrusted drivers from running on your device. |
| Kernel debugger protection | The kernel debugger is a powerful tool intended for development and troubleshooting. Keeping it turned off during normal use helps prevent someone from using it to change protected parts of Windows. |
| Vulnerable driver protection | Drivers help Windows communicate with your device's hardware. Vulnerable driver protection blocks drivers that have known security problems, helping prevent attackers from using them to gain control of your device. |
Common tasks
Turn on recommended security protections
If Windows can enable a protection for you, an option to apply the recommended change appears on the Windows Integrity Protection page in Settings.
Some changes might require administrator permission or a restart.
After all required protections are active, your device meets Windows Integrity Protection.
Restart to finish applying security changes
The security protections can't become fully active until Windows restarts.
If Pending restart appears, save your work and restart the device to finish applying the security change.
Turn on Secure Boot or other firmware security features
Some security protections are controlled by your device's UEFI and can't be changed directly by Windows.
If a protection requires a firmware change, follow the Learn more guidance shown in Windows. The exact steps can vary depending on your device manufacturer and model.
Frequently asked questions
What if a security protection can't be enabled?
A security protection might not be available or might require additional action because of your device's hardware, firmware, configuration, or software.
Windows provides guidance when additional steps are available. If your device is managed by your organization, some settings might also be controlled by your IT administrator.
What happens if I turn off one of these protections?
Integrity Protection represents the current security state of your device.
If a security protection required by Windows Integrity Protection is turned off or no longer meets the requirement, the device no longer meets the security baseline. Windows can show which protection needs attention so that you can restore the recommended security state.
For devices managed by an organization
Your organization might manage some of these security protections through device-management policies. Settings controlled by your organization might not be available for you to change.
Contact your IT administrator if Windows indicates that a required security protection is managed by your organization or you can't make the recommended change.