> Source: [sk185097](https://support.checkpoint.com/results/sk/sk185097)

# sk185097 - Endpoint Security - AMSI Provider Code Integrity Events When Enabling Memory Integrity via Microsoft Intune

| Property | Value |
|----------|-------|
| Solution ID | sk185097 |
| Date Created | 2026-06-25 |
| Last Modified | 2026-06-26 |
| Technical Level | Advanced |
| Products | Endpoint Security |
| Versions | E89.X |

## Symptoms

- * When Windows Memory Integrity / Hypervisor-protected Code Integrity (HVCI) is enabled through Microsoft Intune on Windows 11 devices, endpoints report that CP_AmsiProvider64.dll does not meet Windows signing level requirements.
* The issue occurs during Intune-based activation on some Windows 11 devices.
* Manual activation of Memory Integrity works successfully on the endpoint.
* Windows Event Viewer shows Microsoft-Windows-CodeIntegrity events:
  * Event ID 3033
  * Event ID 3089
* Event ID 3033 shows that svchost.exe attempted to load the Check Point Antimalware Scan Interface (AMSI) provider dynamic link library (DLL), and Windows blocked the load.
* Event ID 3089 is also observed and confirms that the event is related to signature validation.
* The affected DLL path is: *C:\\Program Files (x86)\\CheckPoint\\Endpoint Security\\EFR\\CP_AmsiProvider64.dll*
* The Authenticode signature of CP_AmsiProvider64.dll is valid and identical on affected and non-affected endpoints.
* Example event details:
  * Microsoft-Windows-CodeIntegrity Event ID: 3033 Process: svchost.exe File: *C:\\Program Files (x86)\\CheckPoint\\Endpoint Security\\EFR\\CP_AmsiProvider64.dll* Result: The file did not meet the Windows signing level
  * Microsoft-Windows-CodeIntegrity Event ID: 3089 Result: Signature validation event related to the same DLL.

## Cause

Check Point Research and Development (R\&D) confirmed that these Code Integrity events are expected Microsoft Windows behavior and are not caused by an Endpoint Security product malfunction.  

When Windows Code Integrity / HVCI / Memory Integrity is enabled, Windows enforces code-signing requirements for modules loaded into protected system processes. DLL files signed by Microsoft are assigned a higher trust level than DLL files signed by third-party vendors.  

*CP_AmsiProvider64.dll* is a legitimate Check Point-signed AMSI provider DLL, but it is not Microsoft-signed. Some protected Windows processes, such as *svchost.exe* , load only DLL files that meet the Microsoft signing level. When these processes attempt to load the Check Point AMSI provider, Windows blocks the load and logs Code Integrity events.  

This load attempt occurs because AMSI registration is global. After an AMSI provider DLL is registered, Windows decides which processes attempt to load it when AMSI inspection is relevant. Windows does not first confirm whether the DLL can load into each protected process.  

As a result, Windows can record Code Integrity events for security vendor AMSI providers. These events do not indicate that Endpoint Security blocks Memory Integrity activation. If Microsoft Intune activation of Memory Integrity fails, the remaining issue is related to Microsoft Intune, Windows operating system handling, or another Microsoft-side condition.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content