i cant turn on the HVCI thing even tho i turned on everything it need and no incomp drives

Question

i cant turn on the HVCI thing even tho i turned on everything it need and no incomp drives

Nguyen The Anh 35

Hi, i'm encountering issues enabling Hypervisor-protected Code Integrity (HVCI) as required by Valorant. My previous attempt caused a major system failure, and even after a clean Windows reinstall and enabling related BIOS/UEFI settings, HVCI still won't stay enabled after restarts.

Background: I received a notice from Valorant stating that I must enable HVCI to continue playing. On Monday, I attempted to enable HVCI for the first time. This completely broke my PC (it became BSOD 0xc000021a) and cant even go to safe mode forcing me to perform a reset install of Windows on the affected drive.

Steps I've Taken Post-Reinstall:

Reset my system and entered the BIOS/UEFI settings.

Enabled the following features:

UEFI mode Secure Boot

TPM 2.0

IOMMU

Attempted to enable HVCI again via Windows settings (Core Isolation > Memory Integrity).

Current Problem: When I toggle HVCI on, Windows prompts me to restart the PC.

During the restart: The first boot attempt hangs at the loading dots/circle (it stops spinning and freezes). The system automatically retries, and it successfully boots on the second attempt. However, once booted, HVCI is not actually enabled—it's reverted back to the "off" state, as if the change never took effect.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Francisco Montilla 30,710 Independent Advisor

Hello,

You are very close. The fix is to reset the hypervisor and VBS configuration, enable the required Windows features, then turn HVCI on from the registry so it sticks across the reboot.

Open Start, type cmd, right click Command Prompt, choose Run as administrator.

First, reset the boot configuration for the hypervisor and clear any flags that can block Code Integrity:

bcdedit /set {current} hypervisorlaunchtype auto
bcdedit /deletevalue {current} testsigning
bcdedit /deletevalue {current} nointegritychecks
bcdedit /deletevalue {current} hypervisordebug

Without closing the elevated window, make sure the Windows virtualization components that VBS depends on are enabled:

dism /online /enable-feature /featurename:HypervisorPlatform /all /norestart
dism /online /enable-feature /featurename:VirtualMachinePlatform /all /norestart

Now enable VBS and Hypervisor-Enforced Code Integrity directly in the system configuration:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 1 /f

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 1 /f

Restart the PC once. Let the first boot complete even if it seems slower than usual.

Before trying Valorant, press Start and type msinfo32, open System Information, then check the right pane for Virtualization-based security. It should show Running. Also check Device Guard properties there.

Alternatively, open Windows Security > Device security > Core isolation details and confirm Memory integrity is On and stays On.

If it still reverts, the most likely cause is an early-boot driver that is not flagged in the Core isolation UI. In that case, the next step would be to collect the latest entries from Event Viewer > Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational right after the failed attempt and we will read which driver blocked HVCI at boot.

Nguyen The Anh 35 Reputation points

2025-10-23T12:48:17.8033333+00:00

Hi, thank you so much for spending time for me for the help,

i currently running into some probs after doing the cmd prompts you gave me

it looks like that 3 of this cmds doesnt delete anything coz cmd say it doesnt there : bcdedit /deletevalue {current} testsigning

bcdedit /deletevalue {current} nointegritychecks

bcdedit /deletevalue {current} hypervisordebug

and i was created a restore point before that coz i afraid it gonna stuck again and yes it does, i restarted 2 times and both went into window diagnostic mode and cant boot in properly and i gotta restore the restore point that i made before doing the cmd prompts.

does u mean the "first boot" is this? so i can do it again right now.

Once again, tysm for spending time looking a solution for me, i appriciated it so much!
Nguyen The Anh 35 Reputation points

2025-10-23T12:54:31.47+00:00

after solutions log file.xml and heres the log file u required idk if it the correct one
Nguyen The Anh 35 Reputation points

2025-10-23T13:25:49.1733333+00:00

the second boot with no restore and use pc startup fixer.xml and heres the second boot and it still wont turned on
Francisco Montilla 30,710 Reputation points Independent Advisor

2025-10-23T20:10:04.7566667+00:00
Those three BCDEdit deletevalue lines just mean there were no such flags set, so it is normal that nothing was deleted. And yes, by "first boot" I meant the very first reboot after you toggle Memory Integrity on. In your case it hangs, then the second boot succeeds and Windows silently rolls the change back. Your logs explain why: Code Integrity keeps saying the per-page hashes for core system files like fcon.dll and aepic.dll are missing, so HVCI cannot stay enabled and Windows retreats to a safe state. I can see those exact errors tied to WerFaultSecure.exe in both logs you sent.

There is also evidence that at times the system disabled driver enforcement for a boot session, which is consistent with Startup Repair and the rollbacks you saw.

Do this in Windows, signed in with an admin account. If you prefer, you can do the same from Windows Recovery Command Prompt with the drive letters adjusted, but try inside Windows first.

Open Start, type Command Prompt, right click it and choose Run as administrator. Run these two servicing repairs in this order. They can take a while and might look stuck. Let them finish.

DISM /Online /Cleanup-Image /RestoreHealth sfc /scannow

In the same admin window, stop the Cryptographic service so we can refresh catalog folders, then rebuild the Code Integrity cache. Enter the following, line by line.

net stop cryptsvc ren %windir%\System32\catroot2 catroot2.old del /a /f %windir%\System32\CodeIntegrity\bootcat.cache net start cryptsvc

Restart the PC normally. After the restart, open Windows Security, go to Device security > Core isolation > Memory integrity, turn it On, then restart once. Let the first reboot take its time and do not interrupt it. After Windows comes back, check that Memory integrity shows On.

If anything in the sequence above throws an error, tell me the exact line and message and I will adjust it.
Nguyen The Anh 35 Reputation points

2025-10-24T02:33:36.9666667+00:00

third time.xml

hi, once again ty for spending ur time helping me, i really really appriciated it.

and once again with my problem rn is, after i do the cmd promps thing, restarted normally - turn on hcvi - restart as windows told and to my surprise it give me bsod code hswultpep.sys "system thread exception not handled"

P/S: idk if it helps but i installed new bios update yesterday and do i need to update to win 11 to get this along with better? once again, thank you for spending your time.
Francisco Montilla 30,710 Reputation points Independent Advisor

2025-10-24T09:03:39.98+00:00
You did great. The catroot2 and bootcat.cache messages are harmless. They only mean the folder was already rebuilt and the cache was not present to delete. Your new log shows the VBS policy is loading cleanly now, so that part is fixed.

The crash you hit next is different: hswultpep.sys.

That is the Intel Power Engine Plug-in driver. It is not playing nice with HVCI on your system, so Windows blue screens as soon as Memory integrity tries to initialize. I can see the Code Integrity policy activating repeatedly right before your crash, without the old per-page hash errors.

Do this. Do not turn on Memory integrity yet. Open Device Manager. In the View menu choose Show hidden devices. Expand System devices. If you see Intel Power Engine Plug-in or Intel Dynamic Platform and Thermal Framework - Power Engine Plug-in, right click it, choose Uninstall device, check Delete the driver software for this device, then confirm. If you do not see it, continue.

Open Command Prompt as administrator and remove or disable the driver package so it cannot load:

pnputil /enum-drivers | findstr /i hswultpep

Note the Published Name that matches this driver, usually something like oem##.inf. Then remove it:

pnputil /delete-driver oem##.inf /uninstall /force

If pnputil does not find it, just disable the service so it never starts:

sc stop hswultpep sc config hswultpep start= disabled

It is ok if the stop command says the service is not running.

Now restart the PC. After you are back at the desktop, turn on Memory integrity in Windows Security, then restart once when prompted. Let the first boot take its time.

About BIOS: The BIOS update you did is fine and not the cause here. You do not need Windows 11 for HVCI. Windows 10 can run HVCI if drivers are compliant. Upgrading will not fix a bad driver.

If any command above errors, just paste the exact output and I will adjust the next line for you. Also, If this completes and Memory integrity still flips off or you see a different driver name on the blue screen, tell me the exact name and we will take the next single step.
Nguyen The Anh 35 Reputation points

2025-10-24T12:46:55.8266667+00:00

Pray, good sir, vouchsafe me leave to proffer thee the profoundest thanks that e'er did swell a grateful heart. At length it hath prevailed - O joyful day! after five weary suns of toil unceasing, wherein I assayed each stratagem, implored eight sundry realms of counsel, and besought the aid of multitudes untold. By Jove, I could imprint upon thy cheek a kiss of purest fervor e'en this instant! My soul doth overflow with gratitude unbounded; a thousand mercies be upon thee, noble friend.
Angello M 0 Reputation points

2025-11-20T23:17:04.2366667+00:00

Hello, I would like to know if you could help me, please. I am having the same problem and have been trying to fix it as well. I have been following the steps you gave, but I got to a point where it is no longer the specific problem you helped with, which was the drivers, or so I think. Could you please help me based on my event log after restarting twice?
Angello M 0 Reputation points

2025-11-20T23:18:26.45+00:00

This is my event log so you can get an idea of what is happening. It doesn't seem to be far off from the previous problem, but there are certain changes that I would need help with, please.

Registro despues de reiniciar.txt
Bastu 5 Reputation points

2026-02-04T02:36:45.7133333+00:00

welp this did not help for me sadly just says virtualization based security, enabled but not running
Pat Cheong 0 Reputation points

2026-07-14T02:27:00.5866667+00:00

Ran all cmds above and Memory Integrity was turned ON afterwards...great tip!!! Thank you kindly!
mohammed alblooshi mohammed ahmed 0 Reputation points

2026-08-21T22:57:39.4466667+00:00

hello mr francis im encountering this same issue exactly in 2026 ive tried everything did a cloud reinstall for windows fully cleaned my drive updated my bios and chipest nothing is wrong and i see u helped this gentelmen if u can would u mind please helping me ive been facing this issue for about 1 week now and im close to being hopeless