Unable to enable "Memory Integrity" on Win11

hi

test this:

go to File Explorer ==> Windows ==> System32

in the "search" box in the top right, copy/paste ==> csrbcx64.sys and click the arrow to start the search

if the file csrbcx64.sys is found, right-click on it ==> open file location

PS: I read this in a thread from July 2021 ==> click here

Open File Explorer, then go to C:\Windows\System32

In the search box, type this and press Enter:

csrbcx64.sys

When you find this driver, right-click on it and select "Open file location".

Then, right-click on csrbcx64.sys and select Rename and name this file csrbcx64.sys.old

Then, restart your PC and test if you can enable core isolation

Cannot rename, system file..??

I found this: but still don't know how to resolve

‎"Why do incompatible drivers prevent the use of memory integrity?‎

‎security‎ ‎Windows 10‎

‎Enabling the memory integrity setting would prevent the loading of these incompatible drivers. Since blocking these drivers can cause undesirable or unexpected behavior, the memory integrity setting is disabled to allow these drivers to load.‎

‎If you wish to restore the memory integrity setting, you can try resolving a driver compatibility issue by checking if an updated and compatible driver is available through Windows Update or from the driver manufacturer. Microsoft does not recommend removing drivers to try to restore this setting.‎"

@+

Well done @billmaxime StatutContributeur

I successfully renamed the file to .old and activated kernel protection without any issues.

Do you now recommend leaving my file as .old or changing it back to .sys?

Hello,

It's still surprising to have so many Bluetooth devices, making identification difficult.

CSR.plc most often corresponds to a chip manufacturer for USB Bluetooth dongles.

The question is not to remove it before knowing if it serves any purpose.

We can probably get some insights by editing (opening with Notepad) the corresponding oem inf file; the file in question does not directly launch the driver, but helps install it with the sys name that appears.

We can therefore start in services.msc to look for the service that launches the corresponding driver, set it to stopped and manual or disabled rather than automatic, and see if any Bluetooth device would stop working under these conditions before trying to uninstall the driver in question and the software that is probably associated with it.

Hello,

The following PowerShell script lists the drivers:

$hostname = $ENV:COMPUTERNAME # Get Third Party drivers used, that are not provided by Microsoft and presumably included in the OS $drivers = Get-WmiObject Win32_PNPSignedDriver | where {$_.DriverProviderName -ne "Microsoft"} # Initialize the list of detected driver packages as an array $DriverFolders = @() foreach ($d in $drivers) { # We initialize the list of driver files for each driver $DriverFiles = @() # For each driver instance from WMI class Win32_PNPSignedDriver, we compose the related WMI object name from the other WMI driver class, Win32_PNPSignedDriverCIMDataFile $ModifiedDeviceID = $d.DeviceID -replace "\\", "\\" $Antecedent = "\\" + $hostname + "\ROOT\cimv2:Win32_PNPSignedDriver.DeviceID=""$ModifiedDeviceID"""; # Get all related driver files for each driver listed in WMI class Win32_PNPSignedDriver $DriverFiles += Get-WmiObject Win32_PNPSignedDriverCIMDataFile | where {$_.Antecedent -eq $Antecedent} $DriverName = $d.DeviceName $DriverID = $d.DeviceID Write-Host "####Driver files for driver with name: $DriverName" -ForegroundColor Green Write-Host "and with DriverID: $DriverID" -ForegroundColor Green foreach ($i in $DriverFiles) { # We eliminate double backslashes from the file paths; $path = $i.Dependent.Split("=")[1] -replace '\\\\', '\' $path2 = $path.Substring(1,$path.Length-2) $InfItem = Get-Item -Path $path2 $Version = $InfItem.VersionInfo.FileVersion Write-Output "File: $path2" Write-Output "Version: $Version" } } 

Best regards

Thank you for your help

@brucine StatutMembre

I opened services.msc but I can't find "csrbcx64.sys"

@hypothetix StatutMembre

I ran the script, which gives me a long list of responses. I copied the response into a Word file so I could do a ctrl-F. I didn't find " csrbcx64.sys " but I found this:

"05F988593351}_VID&0002054C_PID&0CD3\8&147A401A&0&38184C59E89D_C00000000
####Driver files for driver with name: CSR GAIA™"

Could this help?

Hello,

Just a quick addition to brucine's post.
To speed things up, we can use the command-line version autorunsc
for example in administrator mode:
autorunsc64.exe -a s -c >> services.csv

https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns

Hi

You still have the same device alert in "Other Devices"

I think it's the one causing the problem

Talk to you later

---

Thank you for the help

@brucine StatutMembre and @hypothetix StatutMembre

I used Autoruns, disabled the file in question, restarted, but the problem persists:

@billmaxime StatutContributeur, here is a screenshot of the device manager. We can clearly see a "CSR". Well done. The reading of these "devices" means absolutely nothing to me. Should I delete them?

hi

I don't know what you have plugged into the PC?

@+

---

@brucine StatutMembre

Thank you

Can’t I just delete these drivers?

And what if I delete all my Bluetooth devices in the Bluetooth pairing settings?

@brucine StatutMembre

To remove the drivers, I assume I go through the device manager by right-clicking => uninstall but do I need to do another operation to delete the sys and oem.inf files?

This might allow me to possibly bypass the Windows Defender update and, with a bit of luck, I no longer have the Bluetooth device that caused the problem :)

Well,

thank you

I think I’m going to give up.

Through "Settings-Devices-Bluetooth Devices," I deleted some Bluetooth devices, but they reappeared every time I restarted. So I removed, via the "Bluetooth Device Manager," those I no longer use.

It didn't change anything.

I don't feel capable of "directly deleting the concerned sys files via Autoruns or their location typically at C:\Windows\System32\drivers, but you need to know the name of the driver and/or its manufacturer."

In fact, my main problem is that I don't have the exact name of the problematic driver. On other forums, some people have had the same issue but were able to identify the driver as shown in the following image:

I don’t have the details:

:/

Indeed, once the driver is identified, the method is as follows: t.ly/H8Nz

(for some reason that I don't understand, I can't make my link clickable: t.ly/H8Nz)

Thank you

Following the reading of this forum (t.ly/_Ga4), where the same problem is exposed, I suppose it is "'a device directly related to the installed hardware" but I am not certain of that

What do you advise me to do? How risky is it to leave the computer like this ("memory integrity disabled)?

Well,

I'm going to leave it like that then and wait for an update to fix the issue...

Thank you very much for your time and the explanations. I hope this post will be helpful to others.

Hello

Did you connect a headset (via Bluetooth) to the PC?

The printer, if it has Wi-Fi, can also cause this kind of issue (for peripherals with errors)

For SMS/MMS, it's the phone

See you

@billmaxime StatutContributeur

thank you

I just removed all my Bluetooth devices (including my headset) via the Bluetooth control panel and... still the same problem

hi

and... still the same problem

this one ==> Can't activate "memory integrity"?

in the device manager, you no longer have a "Other devices" section

and you no longer have any devices with alerts, the issue lies elsewhere for activating memory integrity

see you

Hello,

Yes, the problem remains: "this one ==> Unable to activate 'memory integrity'?"

            and you no longer have any devices alerting, the issue comes from elsewhere for memory integrity activation

Yes, indeed... and I have no idea where from...

hi

in the device manager, click on View ==> Show hidden devices, and post a screenshot

I see you have a lot of Bluetooth hardware in the DM (Sony headset/soundbar/phone)

in search, type msinfo32 and click open

give the info that I have highlighted (click on the image)

@+

---

Thank you for the help

Here is the screenshot:

and here is the requested information: