She disabled in Windows Security → Device Security → Core Isolation. Then she ran the VMware cleaner tool to remove orphaned driver files, reinstalled the software, and rebooted.
Windows Defender’s “Memory Integrity” (part of Core Isolation) prevents drivers from modifying kernel memory in unauthorized ways. Some older versions of vmdrv.sys trigger this protection. When that happens, Windows silently blocks the driver. The user sees only “cannot load”—no explanation of the security block.
Priya had installed and uninstalled three different hypervisors over the past two years (VirtualBox, Hyper-V, and VMware). Sometimes, uninstallers leave registry keys or half-deleted drivers behind. vmdrv.sys from an old version might still be present, but incompatible with the new software. Windows would try to load it, fail the version check, and throw the error. vmdrv.sys cannot load
But why would it fail to load?
She stared at the screen. Her virtual machine refused to start. Her project deadline was in six hours. And she had no idea what vmdrv.sys was, or why it suddenly mattered. She disabled in Windows Security → Device Security
Drivers like vmdrv.sys are marked as "boot-start," meaning they load very early—before the user even logs in. If the driver file is on an encrypted drive or a network location that isn’t available at boot time, Windows gives up immediately. Priya had recently moved her VM files to an external SSD; the driver path in the registry still pointed to the old location.
Modern versions of Windows require that every system driver be digitally signed by Microsoft. If an update or a corrupted file broke the signature on vmdrv.sys , Windows would refuse to load it. This is like a bouncer checking an ID—if the photo is scratched off, you don’t get in. Some older versions of vmdrv
Frustrated but methodical, Priya worked through the possibilities. She opened (Windows’ built-in logbook) and filtered for “System” errors. There it was: Event ID 7000, “The vmdrv service failed to start due to the following error: The driver has been blocked from loading.”