Windows 11 will not show incompatible drivers

Hi Harry,

BING found many links to the HVCIscan module.
I found a Sophos article
Microsoft Patch Tuesday: 74 CVEs plus 2 “Exploit Detected” advisories – Sophos News

It basically said it's an incomplete EXE that shouldn't have been certified by Microsoft. But the author said no other details from Microsoft on WHAT vulnerabilities exist. I'm thinking it was "marked" as vulnerable for the stated reasons.

I can't see it as creating genuine immediate or ongoing vulnerabilities unless
a) is stayed running in memory after use and after reboot

or
b) the Microsoft.com download was hacked

or

c) some malware was already stealth-installed and just waiting for me to execute that obscure tool.

Seeing as it only ran for 2 minutes in a command window, then stopped, it was never installed, therefore, I can't think of a way it would cause ongoing problems. I'm far from a security expert.

THANK you for getting into the weeds.

Be careful, those instructions pointing to hvciscan_amd64

https://answers.microsoft.com/en-us/windows/forum/all/check-incompatible-device-system-drivers-for-hvci/d5bd48a6-0953-4dae-85dc-334bddd24e5a do not discuss the vulnerability associated with this tool and Microsoft's intention to deprecate this tool as I mentioned in a post 10 mins ago.

HST222 left a long list of security problems from using that HypervisorEnforcedCodeIntegrity hack.

https://answers.microsoft.com/en-us/windows/forum/windows_11-hardware/windows-11-will-not-show-incompatible-drivers/b059f22e-95b7-410f-a922-59313ff75c6a?messageId=6a908dc7-49c9-4a49-bc9b-acd379a6af98&page=11 

read HST222's post here.

You might need to manually go to page 11 and HST222 "Replied on September 10, 2024"

then decide if you REALLY want to do that HypervisorEnforcedCodeIntegrity hack.

See elsewhere in this thread why the registry hack is not a good idea.

All, sorry for the delay. I spoke with a Dell escalation manager (Samiran Dey) last week and he pointed out in an email reply:

[quote] "In addition, issues pertaining to Windows Defender and its functions are out of scope for Dell since we did not design the software, and we can only offer best effort support when it comes to third party software issues."

[quote] "As per our conversation, you can forward your solution to enabling Core Isolation/Memory Integrity to us and it will be passed on as feedback to the concerned teams. Unfortunately, the outcome and action of the feedback will remain internal and restricted to Dell. I would advise you to forward your solution to enabling Core Isolation/Memory Integrity to Microsoft as it is a Windows Security feature designed by them. You can call Microsoft Support at ****. You can click on the link below to contact Microsoft Chat Support: https://support.microsoft.com/en-us/contactus

[quote] "Please accept my sincere apologies for any inconvenience caused to you because of the product and during your interactions with us. Your feedback remains a crucial tool in helping us improve our products and service and we strive to offer you a better product and service experience in the future. For any future technical assistance on your Dell Computer, you can call Technical Support 24/7 at 1-800-624-9896as they remain your primary point of contact for technical assistance. Feel free to get back to me if you need further assistance or have any questions."

Regards, Samiran Dey

*******************************************
Back to me: I have not had a chance to give them the solution but someone here (HelpDesk_Anon) discovered it -- the hvciscan_amd64 tool.

There is documented risk about this tool having a vulnerability that I have not explored but I am assuming it would have to be modified or a library component it calls would have to be modified. In my research when I first worked on this, I noted somewhere Microsoft had intended to deprecate this tool because of that vulnerability. But they still provide it for downloading. How long remains to be seen. I did not publish this here because I felt Dell and Microsoft should work together to fix and assess the risks because both at fault: Microsoft does not show the driver names where you expect to see them and Dell should have removed those drivers or updated the certificates for them so the memory integrity feature could be turned on. Instead they will endlessly blame each other.

A few months ago I did some things. I used a decompiler to look at the utility and the library it loads and I decided, for me, it was worth the risk to run it as needed (vs Microsoft making it an integral part of the tool set it installs in Windows 11). However, it would not be fair to people to assess the risk when that task belongs to Dell and Microsoft collaborating which we all know is never going to happen. I emailed Scott Hanselman weeks ago and never heard back.
|
HelpDesk_Anon be careful -- you are all excited and good for you but you must always put on your security hat and research deeply and you will stumble into that published vulnerability. And you will be puzzled why one can still download it when Microsoft said it will be deprecated. Again, another reason why I was reluctant to publish it here. I took the correct approach and continue to argue that this is something Dell and Microsoft should work together to fix - NOT HAPPENING but I do pass the torch for someone here to complain to Microsoft and/or Dell and good luck! **** As **** Forrest Gump said. "I'm tired, I think I'll go home now"

Repeat: where Dell is at fault is that they never properly uninstall every component of the Dell Support Assist software in addition to it failing the certificate check as pointed out by hvciscan_amd64. That's on Dell to properly uninstall software or make sure certificates are up to date. But it's easier for them to say it's Microsoft's fault.

They can read this post as I do not have time to email them the proof -- and there is no guarantee they will publish it or anything. We all deserve much more than that. So let me repeat: (1) they do not properly uninstall all components related to support assist (2) the remaining components fail checks such as certificate checks, etc. that prevent you from turning on Memory Integrity.

This is classical Microsoft and Dell doing they he-said she-said -- each one blaming the other. I told Dell repeatedly just take any Windows 10 system from a few years ago and migrate it to 11 and try to turn on the feature and put your nose to the grindstone and fix the issue and discuss with Microsoft what they think. I did not tell them about hvciscan_amd64.exe and would not until they assured me they would work together with MSFT and they said they'd investigate the issue and then closed it when I was very busy. When Samiran Dey spoke to me, I understood Dell's position but was dismayed how if i published my notes to their engineering team it would fall into the eternal abyss -- see above response from Samiran. So I am discussing it here.

They understandably can only do so much before suggesting a complete system Microsoft fresh installation which, if you do not bring in Support Assist will be fine. But no one wants to do that when there is a simpler fix: uninstall the Dell stuff properly or update the certificate properly during the migration to Windows 11, I told them months ago how many people are suffering from this and I was right that it should be escalated to someone who can take the bull by the horns and fix it once and for all - as I did. I wanted to see how little or greatly they cared about everyone here and the Dell Support forum. I got my answer. And this is not my problem anymore. BTW, the registry hack is 1000% unwise and I published why so those of you who are enamored with it -- don't use it.
|
The hvciscan_amd64 has risk and you must decide if you want to take that risk. I did. Once you see which drivers are causing the problem in Windows 11 you can find it with Device Manager and 100% uninstall it if you 100% determine it is not necessary and certainly anything related to dell support assist for me is not necessary IMO. That's it-- end of story. You can look for the hvciscan_amd64 from a safe Microsoft location and decide if you wish to use it.

Blessings,

Harry