Skip to main content

Microsoft is now enforcing its rule banning unsigned Windows 10 kernel mode drivers

Microsoft announced last week that starting with Windows 10, version 1607, the operating system will refuse to load any new kernel mode drivers that are not signed by the Windows Hardware Developer Center Dashboard portal, or Dev Portal. To be clear, new installations of this version of Windows 10 will enforce the new driver signing rule, whereas older versions of Windows 10 upgrading to 1607 will not be affected by the change.

Microsoft actually made changes to the driver signing rule with the launch of Windows 10 back in July 2015. The company said from that point on, all new Windows 10 kernel mode drivers must be submitted to and digitally signed by the Dev Portal. If they were not, Windows 10 reportedly wouldn’t load those new kernel drivers.

Recommended Videos

However, as the company pointed out last week, the new driver signing change wasn’t really enforced up until now due to “technical and ecosystem readiness issues.” Thus, the change remained as a mere policy statement and wasn’t enforced by the Windows Code Integrity component of Windows 10, which validates the integrity of a driver or system file.

For developers, Microsoft described two steps that must take place to push new drivers to Windows 10. First, they must submit the drivers to Microsoft via the Dev Portal. Next, they need to begin the process of getting an Extended Validation (EV) Code Signing Certificate. All drivers submitted to the Dev Portal must have this EV certification no matter what operating system version the developer plans to support with their driver package.

Additionally, developers wanting to get a driver that’s signed for all versions of Windows between Vista and Windows 10 must run the HLK tests for Windows 10, and the HCK tests for Windows 8.1 and earlier. After that, developers can use the Windows 10 HLK to merge the two test logs and submit those results to Microsoft along with the driver in question.

As for existing drivers, developers are not required to have them re-signed for Windows 10 1607 and newer. “To ensure backwards compatibility, drivers which are properly signed by a valid cross-signing certificate issued prior to July 29th, 2015, will continue to pass signing checks on Windows 10, version 1607,” Microsoft states.

So what does all of this mean for the end user? A more secure environment. Thanks to this enforced rule, Windows 10 will prevent users from unknowingly installing malicious driver software that could in turn load up malicious apps or programs, enable remote control to a hacker, and open a doorway to sensitive files and data, like passwords and bank account information.

According to Microsoft, the new driver signing change also reduces the risk of lost or stolen driver signing keys from the publisher. The change even ensures that driver publishers are “strongly authenticated,” thus fortifying the secure foundation of Windows 10 on a whole.

Kevin Parrish
Kevin started taking PCs apart in the 90s when Quake was on the way and his PC lacked the required components. Since then…
Update Windows now — Microsoft just fixed several dangerous exploits
Person sitting and using an HP computer with Windows 11.

Microsoft has just released a new patch, and this time around, the update comes with fixes for several dangerous and actively abused vulnerabilities and exploits in Windows.

A total of 68 vulnerabilities were addressed in the patch, many of them critical. Here's what was fixed and how to make sure your Windows device is up to date.

Read more
After 10 years of headaches, I’m finally a believer in Windows on ARM
The Microsoft Surface 3 with its blue keyboard.

Almost two years in, Apple is on the verge of completing its transition to ARM. It might surprise you to know, then, that Microsoft started its own journey to ARM chips long before Apple.

But Windows' support for ARM has been far less smooth. There aren't many more Windows devices with ARM chips than there were five years ago -- and I can attest to having personally used every failed attempt along the way.

Read more
Microsoft adds message on unsupported PCs running Windows 11
Windows 11 device sitting on a stool.

With the right tweaks, it has always been possible to run Windows 11 on devices that do not meet minimum specs, but Microsoft is now taking this practice more seriously. Just a month after banner messages first appeared for select Windows Insiders running the operating system on unsupported PCs, Microsoft is now pushing bigger warning messages out to Windows Insiders regarding this matter.

Reportedly, the latest Windows Insider Beta and Release Preview builds of Windows 11 add a watermark to the desktop reading: System requirements not met, go to settings to learn more. This latest Microsoft move has been confirmed by multiple Twitter users, one of which shared the screenshot below. Microsoft didn't confirm the rollout of the messaging in any changelogs, but Digital Trends did notice it on one of our unsupported systems.

Read more