Surface Pro's Core Isolation Memory Integrity

Hi theresa fendrick,

I understand how this can be confusing, when you’re the admin but cannot turn Memory integrity off for your exam software. Besides what the Q&A Assist has suggested, here’s a few things you can consider:

1 - Confirm the device is not enrolled in work/school management

• Open Settings > Accounts > Access work or school
• Remove any organizational accounts listed there.

2 - Check if the Surface is in Secured‑core mode

• Open Windows Security > Device security > Security processor details
• If TPM and virtualization-based security are fully enabled, your device is Secured‑core enforced.

3 - Force disable virtualization from BIOS/UEFI

• Shut down the Surface Pro completely and enter UEFI:
  • Press and hold Volume Up > Press Power
  • Release Power when the Surface logo appears
  • Keep holding Volume Up until UEFI opens
• Go to Advanced (or Security) > Disable virtualization:
  • Turn Virtualization Technology to OFF
  • Turn Virtualization Technology for I/O (VT‑d / IOMMU) to OFF
• Save & exit UEFI > Boot into Windows > check Core isolation again.

4 - Other options

• Use a different Windows device where Memory integrity is not enforced
• Check with Examplify for:
  • Updated compatibility with Memory integrity enabled
  • Approved device list (many exam vendors explicitly exclude Secured‑core PCs)
• If the Surface was pre‑configured by a school, only that institution can change the policy

Some Surface Pro devices are Secured‑core PCs, with Core Isolation / Memory Integrity enforced at the platform level, not just by Windows account permissions. In this state, the toggle might be locked by system policy, not user permissions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

On a Surface (or any Windows 10/11 device), Memory integrity (Core isolation) can be locked by organization policy even if the local account is an administrator. In that case, Windows Security will show that the setting is managed by the administrator and it cannot be changed from the UI.

From the available information, the only supported ways to use software that is blocked by Memory integrity are:

1. Update the blocked driver or software so it is compatible with Memory integrity:
   • Check Windows Update for newer drivers.
   • Check the device or software manufacturer’s site for an updated, compatible driver.
   • This is the recommended approach when a driver “can’t load on this device” due to Memory integrity.
2. Turn off Memory integrity in Windows Security (only if not blocked by policy):
   • Open the Core isolation page directly: Core isolation.
   • Or go to:
     • Windows 11: Start > Settings > Privacy & security > Windows Security > Device Security > under Core isolation, select Core isolation details.
     • Windows 10: Start > Settings > Update & Security > Windows Security > Device Security > under Core isolation, select Core isolation details.
   • Turn Memory integrity to Off and restart the device.
   Notes and warnings from the documentation:
   • Turning off Memory integrity on a Secured-core PC takes the device out of a Secured-core state.
   • If Memory integrity was enabled by an IT administrator (for example, via organization policy or provisioning), it may not be possible to disable it from the Windows Security UI; in that case, only the managing organization/IT admin can change the policy.

If Windows Security reports that the setting is managed by the administrator and the toggle is unavailable, and there is no access to the managing organization’s policies, there is no supported end-user method in this context to override that management and disable Memory integrity. In that situation, the only compliant option is to work with the organization/IT that manages the device or use another device where Memory integrity is not enforced by policy for the exam software.

References:

• Device Security in the Windows Security App
• A driver can't load on this device
• Updating to Windows 10, version 2004 on devices with Hypervisor-protected code integrity (HVCI) enabled
• Memory integrity and VBS enablement