Hardening Windows Endpoints: Enforcing Hypervisor-Protected Code Integrity with Intune
In modern enterprise environments, protecting the Windows kernel is a critical part of endpoint security.
Attackers often attempt to abuse vulnerable or malicious drivers to gain privileged access, bypass security controls, or execute code at the kernel level. Because kernel mode has deep access to the operating system, any compromise at this layer can create a serious security risk.
Hypervisor-Protected Code Integrity, also known as Hypervisor-Enforced Code Integrity (HVCI), helps reduce this risk by using virtualization-based security to protect kernel-mode code integrity.
When this setting is enabled, Windows uses the hypervisor to protect the Code Integrity validation path and enforce kernel-mode memory protections. This helps ensure that only trusted and properly signed code can run in kernel mode.
By deploying this configuration with Microsoft Intune, organizations can centrally enforce this protection across managed Windows devices and strengthen their endpoint hardening strategy.
Why This Policy Matters
Kernel-level protection is essential because malicious or vulnerable drivers can become an entry point for attackers.
Without this protection:
Malicious or vulnerable drivers may increase endpoint risk
Kernel-mode code integrity may be less protected
Attackers may attempt to bypass security controls at a low level
Sensitive security processes may be more exposed
By enabling Hypervisor-Protected Code Integrity:
Kernel-mode code integrity is protected through virtualization-based security
Kernel memory protections are enforced
Only trusted and signed code is allowed to run in kernel mode
The endpoint becomes more resilient against advanced attack techniques
This configuration supports modern endpoint hardening, Zero Trust architecture, and defense-in-depth security principles.
Windows CSP Overview
The policy responsible for this configuration is exposed through the Windows Policy Configuration Service Provider (CSP) framework.
The CSP path is:
./Device/Vendor/MSFT/Policy/Config/VirtualizationBasedTechnology/HypervisorEnforcedCodeIntegrity
This setting controls Hypervisor-Protected Code Integrity and supports the following behavior:
0 — Turns off Hypervisor-Protected Code Integrity remotely if configured previously without UEFI Lock
1 — Turns on Hypervisor-Protected Code Integrity with UEFI lock
2 — Turns on Hypervisor-Protected Code Integrity without UEFI lock
This policy applies at the device scope and is supported on Windows 11, version 21H2 and later, for Pro, Enterprise, Education, and IoT Enterprise editions.
Description Framework Properties
This policy is implemented through the Windows CSP framework, allowing Microsoft Intune to configure the setting directly at the operating system level.
Key configuration properties include:
Format: int
Access Type: Add, Delete, Get, Replace
Default Value: 0
These properties allow administrators to centrally deploy, update, retrieve, or remove the configuration from managed Windows devices.
Allowed Values
The HypervisorEnforcedCodeIntegrity setting supports three configuration values.
0 — Disabled Turns off Hypervisor-Protected Code Integrity remotely if it was previously configured without UEFI Lock.
1 — Enabled with UEFI lock Turns on Hypervisor-Protected Code Integrity with UEFI lock.
2 — Enabled without lock Turns on Hypervisor-Protected Code Integrity without UEFI lock.
For most Intune-managed environments, Enabled without lock can be useful during testing and phased deployment because it provides more flexibility for remote management and rollback.
Organizations should validate driver compatibility before broad deployment, especially on older devices or systems running legacy drivers.
Group Policy Mapping
For organizations operating in hybrid environments, this CSP setting maps to a corresponding Group Policy configuration.
Name: VirtualizationBasedSecurity
Friendly Name: Turn On Virtualization Based Security
Element Name: Virtualization Based Protection of Code Integrity
Location: Computer Configuration
Path: System > Device Guard
Registry Key Name: SOFTWARE\Policies\Microsoft\Windows\DeviceGuard
ADMX File Name: DeviceGuard.admx
This mapping helps administrators understand how the same security control can be represented across traditional Group Policy and modern cloud-based management through Microsoft Intune.
Security Considerations
Before enabling this policy, administrators should validate hardware, firmware, and driver compatibility.
Important requirements and considerations include:
64-bit Windows
Secure Boot enabled
UEFI firmware configuration
Hardware-assisted virtualization support
Compatible and properly signed drivers
Pilot deployment before broad rollout
A phased deployment approach is recommended to reduce operational risk and identify potential driver compatibility issues before enforcing the setting across production devices.
How to Configure Hypervisor-Enforced Code Integrity (HVCI) Using Intune (Settings Catalog)
You can enforce this policy centrally using the Intune Settings Catalog, ensuring that Hypervisor-Protected Code Integrity (HVCI) is enabled across all managed Windows devices.
By enforcing this configuration through Microsoft Intune, organizations can strengthen endpoint security by ensuring that only trusted and signed code is allowed to run in kernel mode, reducing the risk of malicious or vulnerable drivers.
To begin, sign in to the Microsoft Intune admin center and follow the steps below, as illustrated in the screenshot.
Create the Configuration Profile
In the Microsoft Intune admin center:
Navigate to Devices
Select Windows
Click Configuration
Select + Create policy
In the Create a profile pane:
Platform: Windows 10 and later
Profile type: Settings catalog
Click Create to continue.
At this stage, you have created the foundation of a Settings Catalog policy. In the next steps, you will search for and configure the setting that enables Hypervisor-Enforced Code Integrity (HVCI) as part of Virtualization-Based Security.
This configuration ensures that Windows enforces kernel-mode code integrity using virtualization, protecting the Code Integrity validation process and helping prevent unauthorized or malicious code from executing at the kernel level.
Define Basic Profile Details
After clicking Create, the next step is to define the basic details of the configuration profile. This stage is essential for long-term management, clarity, and governance within Microsoft Intune, especially in environments with multiple endpoint hardening policies and security baselines.
Providing a clear Name and a concise but meaningful Description ensures that the purpose of the policy is immediately understood by administrators and security teams in the future.
As shown in the screenshot, configure the fields as follows.
Policy Name and Description
Name: WIN – Endpoint Hardening – HVCI Protection
Description: Enforces Hypervisor-Protected Code Integrity (HVCI) to protect the Windows kernel from unsigned or malicious code by leveraging virtualization-based security.
The Platform field is already pre-selected as Windows, so no changes are required.
Once the name and description are defined, click Next to proceed to the configuration settings.
Configure the Setting Using the Settings Picker
With the profile basics defined, the next step is to configure the policy using the Settings picker, where you select the exact Windows security setting to enforce.
Click Add settings to open the Settings picker panel.
By default, this setting is not configured, which means Windows will follow its existing behavior and will not explicitly enforce Hypervisor-Enforced Code Integrity (HVCI) through Intune unless you enable it.
As shown in the screenshot, use the search field at the top of the Settings picker and type:
Hypervisor Enforced Code Integrity
Then click Search to filter the results.
From the returned results:
Select the category Virtualization Based Technology
Choose the setting: Hypervisor Enforced Code Integrity
Once selected, the setting is added to the configuration profile.
Back on the configuration page, change the value from its default state to:
Enabled with UEFI lock (as shown in field number 6)
When enabled, Windows enforces Hypervisor-Protected Code Integrity (HVCI) using virtualization-based security.
This ensures that:
Only trusted and signed code can run in kernel mode
The Code Integrity validation process is protected by the hypervisor
Kernel memory protections are enforced
This significantly reduces the risk of malicious drivers and kernel-level attacks, strengthening the overall endpoint security posture.
This configuration aligns with modern endpoint hardening practices and supports Zero Trust security principles, ensuring that critical operating system components are protected using hardware-based isolation.
Configure Scope Tags (Optional)
Scope tags are used to control who can view and manage this policy within the Microsoft Intune admin center. They are particularly useful in environments with delegated administration, multiple IT teams, or regional management models.
As shown in the screenshot, the Default scope tag is selected. This is the standard and recommended configuration for most environments, as it ensures the policy is visible to all administrators who have access to Intune.
Optionally, custom scope tags can be assigned if you need to:
Restrict policy visibility to specific IT roles or teams
Enforce administrative separation of duties
Support delegated or region-based Intune management
If no additional scope tags are required, keep the Default selection and click Next to continue.
Assignments – Restrict Anonymous Access Policy
After configuring the policy settings, the next step is to assign the policy to the appropriate target group. Assignments define which devices will receive and enforce this configuration, ensuring the policy is applied in a controlled and intentional manner.
In the Assignments tab, click Add groups under Included groups and search for the group you want to target. This approach allows you to deploy the policy gradually, starting with test devices before expanding to production.
As shown in the screenshot, the policy is assigned to the following group:
GRP – MS365Education – Test Computers
Once the group is selected, verify the following:
The group appears under Included groups
The group status is Active
No assignment filters are applied (unless explicitly required)
At this stage, no Excluded groups are configured, which is appropriate for controlled test deployments.
After confirming the assignment, click Next to proceed to the Review + Create step.
Review + Create – Final Validation
The Review + Create step is the final checkpoint before deploying the policy. This is where you validate that all configurations are correct and aligned with your intended endpoint hardening and kernel-level protection objective.
Pay special attention to the following items.
Policy name and description
Confirm that the policy clearly reflects its purpose: strengthening endpoint security by enforcing Hypervisor-Protected Code Integrity (HVCI), ensuring that only trusted and signed code is allowed to run in kernel mode, while protecting the Code Integrity process using virtualization-based security.
Configuration settings: Verify that Hypervisor Enforced Code Integrity is set to Enabled with UEFI lock Under: Virtualization Based Technology
Scope tags: Ensure the correct scope tag is assigned. In this example, the Default scope tag is used.
Assignments: Confirm the policy is assigned to the intended group: GRP – MS365Education – Test Computers
Also verify that no unintended exclusions are configured.
This final review step helps prevent misconfigurations, unintended deployments, or scope issues, especially in environments with multiple security baselines, delegated administration, and layered endpoint security policies.
Once everything has been validated, click Create to finalize and deploy the policy to the assigned devices.
Monitor Policy Deployment Status
After creating and assigning the WIN – Endpoint Hardening – HVCI Protection configuration profile, the next step is to verify its deployment status.
This validation confirms that the policy has been successfully applied and that Windows is enforcing Hypervisor-Protected Code Integrity (HVCI) on the targeted devices.
Although Microsoft Intune can take up to 8 hours to automatically deliver configuration profiles, deployment often occurs much faster. If needed, you can accelerate the process by:
Triggering a manual device sync from the Company Portal
Initiating a sync directly from the Microsoft Intune admin center
Monitoring deployment ensures that the HVCI policy is active and operating as intended.
How to Verify Policy Deployment Status
To review the deployment results:
In the Microsoft Intune admin center, navigate to Devices ➝ Configuration profiles
Use the search bar to locate the profile: WIN – Endpoint Hardening – HVCI Protection
Select the policy to open the Overview page
Review Deployment Metrics
Intune provides clear indicators to evaluate the policy deployment status:
Succeeded – Devices have successfully applied the policy
In progress – Devices are still processing the configuration
Error – The policy failed to apply and requires investigation
Not applicable – The device does not support the configuration
When devices report Succeeded, it confirms that Windows is enforcing Hypervisor-Enforced Code Integrity (HVCI), ensuring that kernel-mode code integrity is protected using virtualization-based security.
This means:
Only trusted and signed code is allowed to run in kernel mode
The Code Integrity validation process is protected by the hypervisor
Kernel memory protections are actively enforced
This verification step confirms that the endpoint hardening control is successfully deployed and protecting managed Windows devices against kernel-level threats.
Client-Side Verification via Event Viewer
After the device has synced with Intune, you can perform a client-side verification to confirm that the WIN – Endpoint Hardening – HVCI Protection policy was successfully applied.
This validation ensures that Hypervisor-Protected Code Integrity (HVCI) is actively enforced at the operating system level.
Windows records Intune policy processing events locally, allowing administrators to confirm policy enforcement without relying only on the Intune portal.
How to Verify
Open Event Viewer on the target device
Navigate to: Applications and Services Logs ➝ Microsoft ➝ Windows ➝ DeviceManagement-Enterprise-Diagnostics-Provider ➝ Admin
Select Filter Current Log
Look for Event ID 813 or Event ID 814, which indicate successful processing of Intune configuration policies
Open the event details and confirm that the Hypervisor Enforced Code Integrity setting was applied
Pro Tip
Match the event timestamp with the device’s most recent Intune sync.
Event IDs 813 and 814 are reliable indicators that the configuration policy was processed by the Windows MDM engine.
For deeper validation, you can also review:
Applications and Services Logs ➝ Microsoft ➝ Windows ➝ CodeIntegrity ➝ Operational
Here, you can confirm that:
HVCI is actively enforcing code integrity
Kernel-mode code validation is being protected
Any blocked or non-compliant drivers are logged
If the policy is correctly applied, Windows will enforce Hypervisor-Protected Code Integrity (HVCI), ensuring that:
Only trusted and signed code is allowed in kernel mode
The Code Integrity validation path is protected by the hypervisor
Kernel memory protections are actively enforced
Why This Matters for Endpoint Security
Kernel-level protection is one of the most critical layers in modern endpoint security.
Without proper enforcement, attackers may attempt to load malicious or vulnerable drivers to gain elevated privileges and bypass traditional defenses.
By enabling HVCI through Microsoft Intune and validating the configuration locally, organizations ensure that:
Kernel-mode execution is restricted to trusted code
Attack surface related to drivers is significantly reduced
Security controls are protected using virtualization-based isolation
Endpoints are more resilient against advanced threats
This configuration provides strong protection without disrupting standard user workflows when properly validated and deployed.
Key Takeaway
Effective endpoint security starts at the core of the operating system.
By enforcing Hypervisor-Protected Code Integrity (HVCI) through Microsoft Intune, organizations ensure that critical kernel-level protections are consistently applied across all managed devices.
Combined with centralized deployment and proper client-side validation, this policy helps transform endpoint security into a more resilient, controlled, and trustworthy environment.
And in modern security architecture, protecting the kernel is not optional it is essential.
More Information
For additional technical details, refer to the official Microsoft documentation below:
https://learn.microsoft.com/en-us/mem/intune/configuration/settings-catalog
https://learn.microsoft.com/en-us/mem/intune/configuration/device-profiles
https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-monitor
https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-troubleshoot
Thank you!
🖥️ Ricardo Barbosa
🎖️ Microsoft MVP | 📘 Microsoft Certified Trainer (MCT)
☁️ Intune & Cloud Architect |💼 Technology Director at Altelix.com