If you’re asking, “What Windows security settings should I turn on?”, start with Windows Security > Device security. It shows the protections your PC supports and their status. A practical first check is Core isolation > Memory integrity: switch it on if it is available and Windows does not report a driver problem. This is a plausible interpretation of the setting behind the title, not a claim about a particular person’s PC or experience.
What Device security can—and cannot—tell you
In Windows Security, choose Device security to see hardware-backed protections and status information. Depending on your Windows version and installed hardware, the page can show Core isolation, the security processor (TPM), Secure Boot, and a hardware security capability assessment. Windows 10 and Windows 11 are both covered by Microsoft’s Device Security in the Windows Security App guidance, but labels and available features can differ.
As an Amazon Associate I earn from qualifying purchases.
A “not supported” assessment means at least one listed requirement is unmet; it does not by itself prove the PC is insecure. The assessment refers to components including TPM 2.0, Secure Boot, DEP, UEFI MAT, Core isolation support, and Memory integrity. Use the individual status details to identify what is unavailable rather than treating the overall label as a verdict on every protection.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsHow to check and enable Memory integrity
Memory integrity, also called Hypervisor-protected Code Integrity (HVCI), uses hardware virtualization to isolate checks on kernel code. Microsoft explains that it makes it harder for malicious programs to use low-level drivers to hijack a PC. It is a meaningful built-in protection, but it is not a guarantee against compromise or a substitute for keeping Windows and applications updated.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Open Windows Security.
- Select Device security, then Core isolation details.
- Check Memory integrity. If the control is available and off, switch it on and follow any prompt to restart.
- If Windows reports an incompatible driver, look up the device or software named in the warning and check its manufacturer’s support page for an updated driver. If no compatible driver exists, removing the affected device or app may be an option; do not remove drivers blindly.
Memory integrity requires hardware virtualization to be enabled in UEFI/BIOS. If Windows says it is unavailable, first inspect the message and your PC maker’s documentation. Firmware menus vary by manufacturer, so do not change settings there unless you know what the option does.
Check TPM status before changing anything
The TPM (Trusted Platform Module) is a security processor used by Windows features. Under Device security, open the security processor details to check its status. If the security processor section is missing, Microsoft says the PC may lack TPM hardware or TPM may be disabled in UEFI. Check the computer manufacturer’s support information before assuming you need to buy hardware: the TPM may already be present but disabled, and compatibility for any separate module is motherboard-specific.
Rank #2
- Certified to Microsoft’s highest fingerprint security standards (ESS & SDCP) for robust, hardware-isolated authentication. Supports next-gen Windows features, including Copilot Recall and Windows Hello with ESS support.
- Windows Hello ready for fast, password free fingerprint login to Windows and Microsoft 365 accounts
- On device fingerprint storage keeps biometric data securely within the key. Supports privacy regulations (GDPR, BIPA, CCPA) through on device biometric processing; TAA compliant.
- Reliable wired USB fingerprint authentication with USB C and USB A compatibility for desktop PCs.
- Consistent, all condition 360° fingerprint recognition.
Do not clear the TPM as a routine security upgrade. Clearing it is a troubleshooting or recovery action and can affect access to protected data or credentials. Microsoft advises backing up data before clearing it; follow the instructions for your particular recovery situation.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCheck Secure Boot, but treat firmware changes carefully
Secure Boot helps protect the startup chain by checking that boot software is trusted. Device security can show whether it is enabled. Most modern PCs support Secure Boot, but firmware configuration can make it appear unavailable. If you need to reach firmware settings, Microsoft’s route is Settings > System > Recovery > Advanced startup, then Troubleshoot > Advanced options > UEFI Firmware Settings. The actual options and screens differ by PC maker.
Rank #3
- Protect accounts with USB-C & NFC 2FA security key. Hardware-based authentication blocks phishing, credential theft & unauthorized access across cloud, enterprise & personal platforms.
- FIDO2 Level 2 certified Security Key. Works with Apple ID, Microsoft Azure/Entra ID, AWS, Google, Facebook, Salesforce, DUO & more. Compatible with Chrome, Safari & Edge on all major OS.
- Plug & play USB-C Security Key with NFC tap login. No software, drivers or batteries required. Works with Windows PC, MacBook, iPhone, Android & Chromebook for fast, secure authentication.
- Built with FIPS 140-2 Level 3 secure element for advanced encryption. Trusted by IT teams, healthcare, education & government for secure authentication & identity protection.
- IP68 waterproof, dustproof & crush-resistant design. Supports FIDO2, U2F, OTP, PIV, Mini Driver & smart card login. Durable USB security key for long-term enterprise & daily use.
Some systems need a transition from Legacy/CSM boot mode to UEFI before Secure Boot can be enabled. Because changing boot configuration can prevent a system from starting as expected, consult the manufacturer’s model-specific instructions if you are uncertain; do not toggle firmware options by trial and error. Secure Boot can also conflict with some graphics hardware, Linux configurations, or older Windows versions. If it must be disabled temporarily to resolve a compatibility issue, Microsoft recommends enabling it again afterward.
There is also a time-sensitive certificate change: Microsoft says certificates issued in 2011 begin expiring in June 2026, and that supported Windows versions will receive the Secure Boot certificate update automatically. That statement concerns this certificate update, not a promise that Secure Boot is enabled on every PC. See Microsoft’s Windows 11 and Secure Boot page for details.
Rank #4
- WINDOWS HELLO LOGIN FOR WINDOWS 10/11 — NOT FOR MAC - Only works with Windows Hello on Windows 10/11 PCs and laptops. Plug the USB fingerprint reader into your computer and sign in with one touch. Not compatible with Mac, macOS, Linux, or Chrome OS. Requires Windows Hello PIN setup first for fingerprint enrollment.
- PLUG-AND-PLAY, NO DRIVERS NEEDED - No extra app or driver needed on most genuine Windows 10/11 systems. Insert the USB fingerprint scanner, go to Windows Settings > Accounts > Sign-in options, and set up fingerprint sign-in. Works with desktops, laptops, and shared computers without built-in sensors
- FAST 0.5S 360° CAPACITIVE RECOGNITION - Capacitive fingerprint technology delivers quick authentication in about 0.5 seconds. 360° touch recognition reads your fingerprint from different angles. Compared to optical sensors, capacitive sensors are more accurate and less prone to misreads—ideal for shared PCs.
- MULTI-USER & SMART-ID SECURITY - Supports multiple Windows accounts and up to 10 fingerprints per account. Smart-ID security helps protect saved passwords and encrypted folders with fingerprint access. Compatible with most Windows 10/11 laptops and desktops, including Dell, HP, Lenovo, and ASUS. For USB-C only laptops, a USB-A to USB-C adapter is required (not included). 1-year warranty.
- IMPORTANT NOTES — PLEASE READ BEFORE PURCHASE - Supports Win10/11 32/64-bit original system. Not for streamlined/Lite versions (biometric component removed).Only supports Windows Hello. Does not encrypt USB drives/files. Windows only — not for Mac.Prefer motherboard USB 2.0 port. USB 3.0 hubs/docking stations may cause unstable recognition.
What about Smart App Control?
Smart App Control is another built-in protection, but it is not the same setting as Memory integrity and may not be available to every installation. It checks apps for reputation and can block untrusted or potentially unwanted software. Its availability depends on Windows’ evaluation and installation conditions; consult Microsoft’s App & browser control in the Windows Security App guidance to understand its modes and eligibility. Don’t assume that a missing control means it can be enabled with a simple switch.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Which setting should you check first?
| Setting | Primary role | What it depends on | Practical friction | Where to check |
|---|---|---|---|---|
| Memory integrity | Isolates kernel-code integrity checks | Hardware virtualization enabled in UEFI/BIOS | An incompatible driver may block enabling it | Windows Security > Device security > Core isolation details |
| TPM | Security processor used by Windows security features | TPM hardware or firmware support; it may be disabled in UEFI | Clearing is a recovery action, not a routine upgrade | Windows Security > Device security > security processor details |
| Secure Boot | Checks trusted software in the startup chain | UEFI firmware and compatible boot configuration | Some hardware or operating-system setups may require troubleshooting | Windows Security > Device security; firmware controls are manufacturer-specific |
| Smart App Control | Uses app reputation to block untrusted or potentially unwanted apps | Windows evaluation and installation conditions | May not be available to switch on in an existing installation | Windows Security > App & browser control |
For most people, the sensible order is to inspect status first, then enable an available protection only when Windows and the PC maker’s instructions indicate the hardware supports it. These controls address different parts of security; turning on one does not make a PC fully secure.
Quick Recap
Best Value
- USB-C or tap via NFC for easy authentication on any compatible device. No drivers needed; optional Kensington software available for advanced management features.
- Works across Windows, macOS, iOS, Android, ChromeOS, and supports Passkeys and Apple ID.
- Slim, keychain-ready form for easy carry and on-the-go authentication
- IP68-rated for dependable performance
- FIDO CTAP 2.1 for enhanced security features (e.g. resident credentials, Passkey support) and backwards compatibility with CTAP 2. FIDO2 L2 certified security for phishing resistant protection against identity theft and unauthorized access.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
