IOMMU and VBS for FACEIT on Windows 11
FACEIT requires IOMMU and VBS to stop DMA cheats. Where VT-d and AMD IOMMU live, how to enable memory integrity, and what to do when a driver blocks it.
IOMMU and VBS are the least understood of FACEIT's requirements, because the acronyms hide a defense against cheats most players have never seen. These are DMA cheats: a separate card plugged into the PCIe slot of a second computer that reads game memory directly, bypassing the CPU and every software check. An anti-cheat cannot see it in principle — it runs inside the system, and the card goes around it.
IOMMU is a hardware filter that decides which memory an external device is allowed to touch at all. With it in place, a DMA card hits a wall. That is why FACEIT made it mandatory: first for players above 3000 elo, then in waves for everybody.
What has to be on
The requirement has three parts, and they are enabled in different places:
| What | Where | What it is called |
|---|---|---|
| Virtualization | UEFI | Intel VT-x / AMD SVM Mode |
| IOMMU | UEFI | Intel VT-d / AMD IOMMU |
| VBS and memory integrity | Windows | Core isolation |
Step 1. Enable virtualization and IOMMU in UEFI
Get into the firmware: Settings → System → Recovery → Restart now → Troubleshoot → Advanced options → UEFI Firmware Settings.
On Intel you need two entries under Advanced → CPU Configuration:
Intel Virtualization Technology→ EnabledVT-d(sometimesIntel VT for Directed I/O) → Enabled
On AMD:
SVM ModeunderAdvanced→CPU Configuration→ EnabledIOMMUunderAdvanced→AMD CBS→NBIO Common Options→ Enabled
On AMD, IOMMU is often left at Auto. Auto is not "on": on some boards it stays off in that mode, and FACEIT will not see it. Set an explicit Enabled.
Save the settings and boot into Windows.
Step 2. Turn on core isolation
- Open Windows Security (the shield icon in the tray, or via search).
- Go to Device security → "Core isolation details".
- Set Memory integrity to On.
- Reboot — it does not apply without one.
Step 3. Verify
Win + R → msinfo32. You want two lines near the bottom of the list:
- Virtualization-based security: Running
- Virtualization-based security Services Running: Hypervisor enforced Code Integrity
If the first line says "Not enabled", step 1 did not take effect: virtualization or IOMMU is still off in UEFI.
"Memory integrity" won't turn on: blame a driver
This is the most common problem, and Windows tells you the answer itself. The toggle refuses to move, and the system reports "Resolve any driver incompatibilities" while naming the file.
What to do:
- Write down the driver name from the message.
- Work out which program it belongs to — usually the name gives it away.
- Remove or update that program.
The usual culprits: old RGB and fan utilities (early MSI Afterburner, iCUE, Aura), virtual drive drivers like Daemon Tools, overclocking and monitoring tools (RivaTuner, older CPU-Z builds), and leftovers from long-uninstalled games with their own anti-cheats.
If the file name tells you nothing, find it in C:\Windows\System32\drivers and open its properties — the Details tab names the vendor.
Your virtual machines will stop working
An honest warning: VBS claims hardware virtualization for itself. After you enable it, VirtualBox and VMware Workstation either stop running 64-bit guests or slow down drastically. WSL2 and Hyper-V, by contrast, work fine — they are built on the same hypervisor.
You will have to choose: FACEIT or VirtualBox on this machine.
Does it cost performance?
Memory integrity does cost some — usually a few percent, more noticeably on older CPUs. That is the price of blocking DMA cheats, and there is no way around it: FACEIT checks the state, not the presence of a setting.
The remaining requirements are covered in the general map of FACEIT AC errors.
What you lose by enabling VBS
An honest conversation: core isolation is not a free feature. It takes a share of performance, and how much depends on the system.
On modern hardware the in-game difference is usually single-digit percent and invisible to the eye. On older processors lacking hardware support for the required instructions the loss is more noticeable, and that is where the scary forum stories come from. Before chasing numbers from someone else's benchmark, measure your own system before and after: the result differs for everyone.
The second thing you lose is third-party virtual machines. After VBS is enabled, VirtualBox and VMware Workstation either stop running guests or become several times slower: Hyper-V claims hardware virtualization for itself. There is no workaround where both run at full speed — that is an architectural limitation, not a bug.
How to tell which driver is in the way
If Memory Integrity refuses to turn on, Windows almost always names the culprit: an incompatible driver. Read that message carefully — it gives the driver file name rather than the program name, and the file name usually identifies the source easily.
Most often it is old printer and scanner drivers, RGB lighting and overclocking software, virtual drive tools, and antivirus products from earlier generations. The order of action: update the program the driver belongs to; if no update exists, uninstall it and check again. There is no need for dubious "driver removal" tools from the internet — a normal uninstall usually settles it.
Do I have to enable both settings? Yes, they cover different things: IOMMU restricts direct device access to memory, while core isolation protects Windows itself. The anti-cheat checks both, and enabling one does not lift the requirement for the other.
How much will games slow down? On modern hardware, usually by single-digit percent. Only a before-and-after measurement on your own system gives the real number — other people's benchmarks are a poor guide here, because the loss depends on the CPU generation.
Can I get my virtual machines back? Only by turning VBS off again, which breaks the anti-cheat requirement. There is no way around it: Hyper-V takes hardware virtualization for itself and there is nothing to share.
Core isolation is on, so why does the anti-cheat still complain? Most likely the other half of the requirement is missing: IOMMU is enabled in UEFI rather than in Windows, and the client checks its state separately. Also confirm the machine fully rebooted after the firmware changes instead of resuming from fast startup.