Skip to main content

Microsoft is now enforcing its rule banning unsigned Windows 10 kernel mode drivers

windows 10 insider preview 14955 outlook mail calendar narrator upgrade
Bill Roberson/Digital Trends
Microsoft announced last week that starting with Windows 10, version 1607, the operating system will refuse to load any new kernel mode drivers that are not signed by the Windows Hardware Developer Center Dashboard portal, or Dev Portal. To be clear, new installations of this version of Windows 10 will enforce the new driver signing rule, whereas older versions of Windows 10 upgrading to 1607 will not be affected by the change.

Microsoft actually made changes to the driver signing rule with the launch of Windows 10 back in July 2015. The company said from that point on, all new Windows 10 kernel mode drivers must be submitted to and digitally signed by the Dev Portal. If they were not, Windows 10 reportedly wouldn’t load those new kernel drivers.

However, as the company pointed out last week, the new driver signing change wasn’t really enforced up until now due to “technical and ecosystem readiness issues.” Thus, the change remained as a mere policy statement and wasn’t enforced by the Windows Code Integrity component of Windows 10, which validates the integrity of a driver or system file.

For developers, Microsoft described two steps that must take place to push new drivers to Windows 10. First, they must submit the drivers to Microsoft via the Dev Portal. Next, they need to begin the process of getting an Extended Validation (EV) Code Signing Certificate. All drivers submitted to the Dev Portal must have this EV certification no matter what operating system version the developer plans to support with their driver package.

Additionally, developers wanting to get a driver that’s signed for all versions of Windows between Vista and Windows 10 must run the HLK tests for Windows 10, and the HCK tests for Windows 8.1 and earlier. After that, developers can use the Windows 10 HLK to merge the two test logs and submit those results to Microsoft along with the driver in question.

As for existing drivers, developers are not required to have them re-signed for Windows 10 1607 and newer. “To ensure backwards compatibility, drivers which are properly signed by a valid cross-signing certificate issued prior to July 29th, 2015, will continue to pass signing checks on Windows 10, version 1607,” Microsoft states.

So what does all of this mean for the end user? A more secure environment. Thanks to this enforced rule, Windows 10 will prevent users from unknowingly installing malicious driver software that could in turn load up malicious apps or programs, enable remote control to a hacker, and open a doorway to sensitive files and data, like passwords and bank account information.

According to Microsoft, the new driver signing change also reduces the risk of lost or stolen driver signing keys from the publisher. The change even ensures that driver publishers are “strongly authenticated,” thus fortifying the secure foundation of Windows 10 on a whole.

Kevin Parrish
Former Digital Trends Contributor
Kevin started taking PCs apart in the 90s when Quake was on the way and his PC lacked the required components. Since then…
Microsoft seems to be pushing developers away from UWP Windows apps
Surface with Windows 10

Microsoft recently updated guides for developers regarding Universal Windows Platform (UWP) apps. The company is now showing developers how they can migrate their UWP apps to the newer Windows App SDK, hinting at a shift away from the traditional Windows-first app types that have been around in the Microsoft Store in Windows since as late as 2015.

With the new documentation, Microsoft makes it clear why developers might want to use the Windows App SDK over the UWP. There are several benefits including improved compatibility, faster updates, and new elements of design, as well as an ease of consumption coming with the Windows UI 3 and WebView2 libraries. It also complements existing platforms with a common set of APIs and tools.

Read more
Enable these 3 easy Windows settings to drastically improve your PC’s security
microsoft defender ccleaner unwanted application windows

These days, it seems like there's always a ton of security issues in Windows. PrintNightmare, malware, spyware, and viruses are just a few examples.

So, how you do protect yourself? Investing in antivirus software is one obvious answer, but there are also some built-in tools in Windows 10 (and in the upcoming Windows 11) that can help you improve the security of your system. We've gathered up a list of these tools for you below.
Enable Windows Security ransomware protection

Read more
This new Windows 11 setting could improve performance and battery life
Windows 11 updates are moving to once a year.

Yesterday, Microsoft released the Windows 11 26252 build, which brings a flood of innovations that will give users a much-needed power boost. One of those changes is a new power setting that will provide the user more control when their PC is on battery power or not, as Phantom Ocean 3 mentions in a post on X (formerly Twitter), which was noticed by Windows Latest.

In theory, this greater degree of control will allow your system to automate power settings so that you don't forget to manually switch them while plugged in or on battery.

Read more