>

Check Memory Integrity (HVCI) Status with PowerShell

Verify that Windows Core Isolation's memory integrity protection is switched on and running, not just configured.

WindowshardwaresecuritypowershellLow risk
Run (Get-CimInstance -Namespace root\Microsoft\Windows\DeviceGuard -ClassName Win32_DeviceGuard).SecurityServicesRunning — a 2 in the output means HVCI is running.

01Command

Command
$ (Get-CimInstance -Namespace root\Microsoft\Windows\DeviceGuard -ClassName Win32_DeviceGuard).SecurityServicesRunning

02What it does

Memory integrity uses virtualization-based security to stop attackers from injecting code into the Windows kernel. The Windows Security app shows a toggle, but the WMI query reveals what is actually running: SecurityServicesRunning containing 2 means HVCI is active, and VirtualizationBasedSecurityStatus 2 means VBS itself is up. A blank or 0 result usually means the CPU or a driver does not support it, or the toggle was never turned on.

03Risk

RiskLow risk
!Warning: Older drivers (particularly some GPU and anti-cheat drivers) fail to load when memory integrity is on — the toggle is in Windows Security > Device security > Core isolation.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • Manage Windows Defender Credential Guard
    Microsoft Learn · vendor-doc · 2026-09-17
    Evidence: Documents the Win32_DeviceGuard WMI class: SecurityServicesRunning lists running virtualization-based security services, where a value of 2 indicates HVCI is active.

Last verified: 2026-09-18 · Category: Security & Privacy

06Related solutions

Read Deep Hardware Details with Get-ComputerInfo
WindowshardwarepowershellDiagnostics

PowerShell cmdlet that exposes BIOS, firmware, RAM and OS properties as a filterable object.

Low risk ✓ 2026-09-17
Verify Code Signatures with Get-AuthenticodeSignature
Windowssignaturesecuritypowershell

Read the Authenticode signature status and signer of any executable or script in PowerShell.

Low risk ✓ 2026-09-17
Fix 'scripts is disabled on this system' with Set-ExecutionPolicy
WindowsTerminaldevelopersecurity

Understand PowerShell's execution policy scopes and set the one that lets you run your own local scripts without gutting the security model.

Medium risk ✓ 2026-09-17