Blog Post

Windows IT Pro Blog
6 MIN READ

Advancing Windows driver security: Removing trust for the cross-signed driver program

Peter_Waxman's avatar
Peter_Waxman
Icon for Microsoft rankMicrosoft
Mar 26, 2026
How our new approach strengthens customer protection while preserving app compatibility Today, we’re excited to announce a significant step forward in our ongoing commitment to Windows security and...
Updated Mar 25, 2026
Version 1.0
security
windows 11
amsel's avatar
amsel
Occasional Reader
Mar 27, 2026

Wie wäre es mal die Alten Treiber einfach mal neu zuerstellen so das sie weiterhin unter Windows11 laufen. Für meine Soundkarte ( Sound Blaster X-Fi Titanium Fatal1ty Champion Series) gibts leider keinen neuen Treiber mehr vom Hersteller.

Warum sollen wir jetzt Müll Produzieren wenn die Hartdware noch sehr gut funktionier. 

Macht lieber mal die alten Treiber neu das Windows nicht mehr meckert.

 

mfg amsel

  • rpodric's avatar
    rpodric
    Bronze Contributor
    Mar 27, 2026

    Did you check that driver to prove that it actually meets the above criteria?  Just being older isn't enough. Even if it fails (see below), Creative Labs Sound Blaster is very likely on the exception list owing to it being a major OEM.

    Once in audit mode, I think you'll be to tell by looking here in Event Viewer: Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational.

    In advance of that, this is the best (unofficial) information that I have:

    Since the standard Windows properties menu often hides legacy certificates, the most accurate way to check a specific driver is to use signtool (in the Windows SDK or in Delphier/SignTool on GitHub) to check how Windows actually validates its trust.

    Open Command Prompt and run this exact command:
    signtool verify /v /a C:\Windows\System32\drivers\YOUR_DRIVER.sys

    (Note: The /a flag is critical because it forces Windows to check its hidden modern catalog databases, rather than just looking at the .sys file itself).

    How to read the results:

    • It's Safe: If the output says "Successfully verified" and mentions it is signed by the Microsoft Windows Hardware Compatibility Publisher (WHCP) or "signed in catalog". This means Microsoft fully vetted the driver.
    • It's At Risk: If the output says "Unable to verify this file using a catalog" and ends with a SignTool Error (such as an untrusted root).
      • The Exception (The Allowlist): If the driver belongs to a major, essential hardware manufacturer (like Intel, AMD, or NVIDIA), it is likely safe because Microsoft hardcoded them into an "allowlist" so PCs won't crash.
      • The Rule: If the failing driver belongs to a smaller third-party utility company (like a disk partitioner, VPN, or virtual drive), it is not on the allowlist and will almost certainly be blocked when the audit mode ends.
    • amsel's avatar
      amsel
      Occasional Reader
      Mar 27, 2026

      Danke schön bis auf einen Treiber bekomm ich alle Neu Signiert.

      Verifying: C:\Windows\System32\drivers\kinectcamera.sys

      File is signed in catalog: C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem70.CAT

      Hash of file (sha1): 27F3B32714C0E56020B135FE11B840EC43ABC5BD

       

      Signing Certificate Chain:

      Issued to: Microsoft Root Certificate Authority

      Issued by: Microsoft Root Certificate Authority

      Expires: Mon May 10 00:28:13 2021

      SHA1 hash: CDD4EEAE6000AC7F40C3802C171E30148030C072

       

      Issued to: Microsoft Windows Hardware Compatibility PCA

      Issued by: Microsoft Root Certificate Authority

      Expires: Thu Jun 04 22:15:46 2020

      SHA1 hash: 8D42419D8B21E5CF9C3204D0060B19312B96EB78

       

      Issued to: Microsoft Windows Hardware Compatibility Publisher

      Issued by: Microsoft Windows Hardware Compatibility PCA

      Expires: Thu Sep 19 00:20:55 2013

      SHA1 hash: D94345C032D23404231DD3902F22AB1C2100341E

       

      The signature is timestamped: Fri Aug 31 00:09:23 2012

      Timestamp Verified by:

      Issued to: Microsoft Root Authority

      Issued by: Microsoft Root Authority

      Expires: Thu Dec 31 08:00:00 2020

      SHA1 hash: A43489159A520F0D93D032CCAF37E7FE20A8B419

       

      Issued to: Microsoft Timestamping PCA

      Issued by: Microsoft Root Authority

      Expires: Sun Sep 15 08:00:00 2019

      SHA1 hash: 3EA99A60058275E0ED83B892A909449F8C33B245

       

      Issued to: Microsoft Time-Stamp Service

      Issued by: Microsoft Timestamping PCA

      Expires: Tue Apr 09 22:53:57 2013

      SHA1 hash: F8EDFD8E91AB10DF648C67847D5676F28A922A5A

       

      SignTool Error: This catalog is not valid for the current OS version. You may

      use the /o option to verify against a different OS version.

      File is signed in catalog: C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem76.CAT

      Hash of file (sha1): 27F3B32714C0E56020B135FE11B840EC43ABC5BD

       

      Signing Certificate Chain:

      Issued to: Microsoft Root Certificate Authority

      Issued by: Microsoft Root Certificate Authority

      Expires: Mon May 10 00:28:13 2021

      SHA1 hash: CDD4EEAE6000AC7F40C3802C171E30148030C072

       

      Issued to: Microsoft Windows Hardware Compatibility PCA

      Issued by: Microsoft Root Certificate Authority

      Expires: Thu Jun 04 22:15:46 2020

      SHA1 hash: 8D42419D8B21E5CF9C3204D0060B19312B96EB78

       

      Issued to: Microsoft Windows Hardware Compatibility Publisher

      Issued by: Microsoft Windows Hardware Compatibility PCA

      Expires: Thu Sep 19 00:20:55 2013

      SHA1 hash: D94345C032D23404231DD3902F22AB1C2100341E

       

      The signature is timestamped: Fri Aug 31 00:09:23 2012

      Timestamp Verified by:

      Issued to: Microsoft Root Authority

      Issued by: Microsoft Root Authority

      Expires: Thu Dec 31 08:00:00 2020

      SHA1 hash: A43489159A520F0D93D032CCAF37E7FE20A8B419

       

      Issued to: Microsoft Timestamping PCA

      Issued by: Microsoft Root Authority

      Expires: Sun Sep 15 08:00:00 2019

      SHA1 hash: 3EA99A60058275E0ED83B892A909449F8C33B245

       

      Issued to: Microsoft Time-Stamp Service

      Issued by: Microsoft Timestamping PCA

      Expires: Tue Apr 09 22:53:57 2013

      SHA1 hash: F8EDFD8E91AB10DF648C67847D5676F28A922A5A

       

      SignTool Error: This catalog is not valid for the current OS version. You may

      use the /o option to verify against a different OS version.

      File is signed in catalog: C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem77.CAT

      Hash of file (sha1): 27F3B32714C0E56020B135FE11B840EC43ABC5BD

       

      Signing Certificate Chain:

      Issued to: Microsoft Root Certificate Authority

      Issued by: Microsoft Root Certificate Authority

      Expires: Mon May 10 00:28:13 2021

      SHA1 hash: CDD4EEAE6000AC7F40C3802C171E30148030C072

       

      Issued to: Microsoft Windows Hardware Compatibility PCA

      Issued by: Microsoft Root Certificate Authority

      Expires: Thu Jun 04 22:15:46 2020

      SHA1 hash: 8D42419D8B21E5CF9C3204D0060B19312B96EB78

       

      Issued to: Microsoft Windows Hardware Compatibility Publisher

      Issued by: Microsoft Windows Hardware Compatibility PCA

      Expires: Thu Sep 19 00:20:55 2013

      SHA1 hash: D94345C032D23404231DD3902F22AB1C2100341E

       

      The signature is timestamped: Fri Aug 31 00:09:23 2012

      Timestamp Verified by:

      Issued to: Microsoft Root Authority

      Issued by: Microsoft Root Authority

      Expires: Thu Dec 31 08:00:00 2020

      SHA1 hash: A43489159A520F0D93D032CCAF37E7FE20A8B419

       

      Issued to: Microsoft Timestamping PCA

      Issued by: Microsoft Root Authority

      Expires: Sun Sep 15 08:00:00 2019

      SHA1 hash: 3EA99A60058275E0ED83B892A909449F8C33B245

       

      Issued to: Microsoft Time-Stamp Service

      Issued by: Microsoft Timestamping PCA

      Expires: Tue Apr 09 22:53:57 2013

      SHA1 hash: F8EDFD8E91AB10DF648C67847D5676F28A922A5A

       

      SignTool Error: This catalog is not valid for the current OS version. You may

      use the /o option to verify against a different OS version.

      File is signed in catalog: C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem78.CAT

      Hash of file (sha1): 27F3B32714C0E56020B135FE11B840EC43ABC5BD

       

      Signing Certificate Chain:

      Issued to: Microsoft Root Certificate Authority

      Issued by: Microsoft Root Certificate Authority

      Expires: Mon May 10 00:28:13 2021

      SHA1 hash: CDD4EEAE6000AC7F40C3802C171E30148030C072

       

      Issued to: Microsoft Windows Hardware Compatibility PCA

      Issued by: Microsoft Root Certificate Authority

      Expires: Thu Jun 04 22:15:46 2020

      SHA1 hash: 8D42419D8B21E5CF9C3204D0060B19312B96EB78

       

      Issued to: Microsoft Windows Hardware Compatibility Publisher

      Issued by: Microsoft Windows Hardware Compatibility PCA

      Expires: Thu Sep 19 00:20:55 2013

      SHA1 hash: D94345C032D23404231DD3902F22AB1C2100341E

       

      The signature is timestamped: Fri Aug 31 00:09:23 2012

      Timestamp Verified by:

      Issued to: Microsoft Root Authority

      Issued by: Microsoft Root Authority

      Expires: Thu Dec 31 08:00:00 2020

      SHA1 hash: A43489159A520F0D93D032CCAF37E7FE20A8B419

       

      Issued to: Microsoft Timestamping PCA

      Issued by: Microsoft Root Authority

      Expires: Sun Sep 15 08:00:00 2019

      SHA1 hash: 3EA99A60058275E0ED83B892A909449F8C33B245

       

      Issued to: Microsoft Time-Stamp Service

      Issued by: Microsoft Timestamping PCA

      Expires: Tue Apr 09 22:53:57 2013

      SHA1 hash: F8EDFD8E91AB10DF648C67847D5676F28A922A5A

       

      SignTool Error: This catalog is not valid for the current OS version. You may

      use the /o option to verify against a different OS version.

      File is signed in catalog: C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem43.CAT

      Hash of file (sha1): 27F3B32714C0E56020B135FE11B840EC43ABC5BD

       

      Signing Certificate Chain:

      Issued to: Microsoft Root Certificate Authority

      Issued by: Microsoft Root Certificate Authority

      Expires: Mon May 10 00:28:13 2021

      SHA1 hash: CDD4EEAE6000AC7F40C3802C171E30148030C072

       

      Issued to: Microsoft Windows Hardware Compatibility PCA

      Issued by: Microsoft Root Certificate Authority

      Expires: Thu Jun 04 22:15:46 2020

      SHA1 hash: 8D42419D8B21E5CF9C3204D0060B19312B96EB78

       

      Issued to: Microsoft Windows Hardware Compatibility Publisher

      Issued by: Microsoft Windows Hardware Compatibility PCA

      Expires: Thu Sep 19 00:20:55 2013

      SHA1 hash: D94345C032D23404231DD3902F22AB1C2100341E

       

      The signature is timestamped: Fri Aug 31 00:09:23 2012

      Timestamp Verified by:

      Issued to: Microsoft Root Authority

      Issued by: Microsoft Root Authority

      Expires: Thu Dec 31 08:00:00 2020

      SHA1 hash: A43489159A520F0D93D032CCAF37E7FE20A8B419

       

      Issued to: Microsoft Timestamping PCA

      Issued by: Microsoft Root Authority

      Expires: Sun Sep 15 08:00:00 2019

      SHA1 hash: 3EA99A60058275E0ED83B892A909449F8C33B245

       

      Issued to: Microsoft Time-Stamp Service

      Issued by: Microsoft Timestamping PCA

      Expires: Tue Apr 09 22:53:57 2013

      SHA1 hash: F8EDFD8E91AB10DF648C67847D5676F28A922A5A

       

      SignTool Error: This catalog is not valid for the current OS version. You may

      use the /o option to verify against a different OS version.

      SignTool Error: File not valid: C:\Windows\System32\drivers\kinectcamera.sys

       

      Number of files successfully Verified: 0

      Number of warnings: 0

      Number of errors: 1

      Dieser Treiber läst sich leider nicht neu Signieren warum auch immer. Vieleicht habt ihr ja noch einen neueren davon da.

       

      mfg amsel

      • rpodric's avatar
        rpodric
        Bronze Contributor
        Mar 27, 2026

        kinectcamera.sys is an example of one that has a CAT and a certificate chain that is all Microsoft. It should be fine.