Forum Discussion

bitwise's avatar
bitwise
Copper Contributor
Oct 09, 2026

MDEClientAnalyzer fails because dsregcmd.exe is distrusted

I have the problem that the MDEClientAnalyzer script always fails on my Windows 11 Enterprise 25H2 system because it fails to verify the signature of  C:\Windows\System32\dsregcmd.exe   That file ...
eudbaospdhcusnsnsd's avatar
eudbaospdhcusnsnsd
Copper Contributor
Oct 16, 2026

Windows systems with October 2026 CU installed are affected as MS released the new Code Signing PCA 2026 certificate and the script does not have it listed. Same crap with linux utilities.

 

From Issuerinfo.txt:

EnhancedKeyUsageList : {Windows System Component Verification (1.3.6.1.4.1.311.10.3.6), Code Signing (1.3.6.1.5.5.7.3.3)}

DnsNameList : {Microsoft Windows}

SendAsTrustedIssuer : False

EnrollmentPolicyEndPoint : Microsoft.CertificateServices.Commands.EnrollmentEndPointProperty

EnrollmentServerEndPoint : Microsoft.CertificateServices.Commands.EnrollmentEndPointProperty

PolicyId :

Archived : False

Extensions : {System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid, System.Security.Cryptography.Oid...}

FriendlyName :

IssuerName : System.Security.Cryptography.X509Certificates.X500DistinguishedName

NotAfter : 8/5/2027 8:49:20 PM

NotBefore : 8/6/2026 8:49:20 PM

HasPrivateKey : False

PrivateKey :

PublicKey : System.Security.Cryptography.X509Certificates.PublicKey

RawData : {48, 130, 5, 37...}

SerialNumber : 3300000017D4DFD9E3950BE7EF000000000017

SubjectName : System.Security.Cryptography.X509Certificates.X500DistinguishedName

SignatureAlgorithm : System.Security.Cryptography.Oid

Thumbprint : 667BBA1E1F478221AA65DE4F75187A751B03A453

Version : 3

Handle : 2529724754528

Issuer : CN=Microsoft Windows Production PCA 2026 RSA2048-SHA256, O=Microsoft Corporation, C=US

Subject : CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US