PowerShell: Check HVCI (Memory Integrity) Status
Need to check whether HVCI (Hypervisor-protected Code Integrity, also known as Memory Integrity) is running - a security feature that prevents malicious or unverified code from running in kernel mode? This one-liner checks it directly.
Prerequisites:
- Privileges: None
- Module: Built-in, no import needed
Quick Command:
(Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning -contains 2Example Output:
True📦
Want all of them at once?
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
Get every free one-liner from this blog in a single downloadable bundle organized by category, each with full comment-based help. No more copy-pasting one at a time.
How It Works:
- SecurityServicesRunning is an array that can contain multiple values at once - 1 means Credential Guard is running, while 2 specifically means HVCI/Memory Integrity is running.
- -contains 2 checks whether that array includes the value 2, returning a clean True/False instead of a raw array you'd have to interpret manually.
- HVCI uses virtualization-based security to isolate the Windows kernel's code integrity checks, making it much harder for malware to load malicious drivers or run unverified code at the kernel level.