Core Isolation Memory Integrity Incompatible Drivers: wdcsam64_prewin8.sys

[kiddingguy]

Today I got the message on my Windows 11 machine that the Memory Integrity is 'off' on Core Isolation.

The driver listed is: WDCSAM64_PREWIN8.SYS

 

I found out these are old Western Digital drivers (I do have an external WD HDD) that can be (easily) removed without issues.

Is this wise to do? Or is this some Microsoft 'bug' on these latest updates; I did install Windows 11 optional update (KB5016691) earlier this week.

 

Another option is to uninstall the 'WD SES Device' in Device Manager.

 

What's better? The CMD prompt, or the Device Manager.

 

Or, to just better wait - and ignore - this message until it resolves itself with a future Microsoft Update?

But than... what does this Core Isolation exactly do? And it is OK to have it turned off? The message says: 'Your device may be vunerable'.

[kiddingguy]

I don't have the WD SES Device listed, I do have on Disk Drives the particular WD drive in question...

[Ixion]

I would imagine if you remove the drive (also uninstalling the driver) then turn memory integrity on and reboot then re-attach the drive it will afterwards just use generic drivers for the external USB drive and you won't lose out on anything.

[kiddingguy]

On 31/08/2022 at 08:36, Ixion said:

I would imagine if you remove the drive (also uninstalling the driver) then turn memory integrity on and reboot then re-attach the drive it will afterwards just use generic drivers for the external USB drive and you won't lose out on anything.

Deleted via Device Manager, rebooted. Not plugged in. Message remains.

So a bit tougher as it seems.

[Ixion]

That does sound stubborn, if it's any consolation whatsoever although I started off my Windows 11 journey with Memory integrity turned on, I benchmarked it with and without and decided it wasn't worth the 10% performance penalty in memory bandwidth (both Intel and AMD systems) for questionable improvements in security.

 

Might be worth trying from safe mode, but I don't understand why the driver would still be present if it has been removed properly via device manager!

[Ixion]

https://www.urtech.ca/2021/11/solved-core-isolation-memory-integrity-incompatible-drivers-wdcsam64_prewin8-sys/ better still read this, you're not the first person with the issue and someone clever has solved it via a series of powershell commands

[goretsky Supervisor]

Hello,

This is the fourth report I've seen of this in the past couple of days.  It would appear Microsoft is testing (or has begun) notifications about hardware security features in Windows 11.

Just to check, when you ran the Device Manager (filename: DEVMGMT.MSC), did you select View → Show hidden devices from its main menu bar?

Regards,

Aryeh Goretsky


 

[Christopher Andreason]

getting the exact same messaged this looks similar to this and also have the solution on how to fix this

This device's drivers are not installed. (Code 28)

There are no drivers compatible with this device.

Click Update Driver to search for a driver for this device.

the files required are these
thus unzipped the file named WD_SES_Driver_Setup_x64.zip

and also unpacked the .msi file where these files are located

so to sum it all up it requires you to unzip the .zip file and
then install WD SES Driver Setup (x64).msi

where these files are included

wdcsam.cat
wdcsam.inf
wdcsam.sys
wdcsam64.sys

then this message disappears and you can then use the hard drive again

 

 

URL is https://support.wdc.com/downloads.aspx?p=258&lang=en#WD_softwaremac

[Yonah Member]

For the scenario where the driver is interfering with the operation of memory integrity even after the target device is removed, you should delete the offending entries from the Driver Store. You can from an elevated command window enumerate the drivers with the pnputil command, then use the /enum-drivers parameter to identify the published name of the entries. From the same window, use the /uninstall parameter before specifying the published name of the entry to be deleted (i.e., pnputil /delete-driver oem1.inf).

[erpster3]

On 04/10/2022 at 12:03, Yonah said:

For the scenario where the driver is interfering with the operation of memory integrity even after the target device is removed, you should delete the offending entries from the Driver Store. You can from an elevated command window enumerate the drivers with the pnputil command, then use the /enum-drivers parameter to identify the published name of the entries. From the same window, use the /uninstall parameter before specifying the published name of the entry to be deleted (i.e., pnputil /delete-driver oem1.inf).

or remove them using Driver Store Explorer (RAPR), which is better than using pnputil for some people