17

I'm trying to use the RBC9 SpaceNavigator TEST x64 build drivers for my SpaceNavigator 3d joystick so that it can work as a normal joystick in games like Quake.

Unfortunately, I get the error "This version of windows requires all drivers to have a valid digital signature" and in the "Device status" in device manager, I get "Windows cannot verify the digital signature for the drivers required for this device. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. (Code 52)".

Is there a way to work around this issue?

4 Answers 4

11

This forum topic has multiple solutions, although the only one that has been confirmed to work by at least one person and has upvotes is this:

Open a command prompt as an admin and type

bcdedit -set loadoptions DDISABLE_INTEGRITY_CHECKS
bcdedit -set TESTSIGNING ON

See security risk warning.

If it doesn't work for whatever reason you can just remove loadoptions with bcedit and switch testsigning off.

bcdedit /deletevalue loadoptions
bcdedit -set TESTSIGNING OFF

If this breaks something for whatever reason sorry, good-luck.

EDIT: Other sources seem to also provide this as a solution, such as this (albeit for Windows Vista) and this

2
  • 4
    It's not DISABLE_INTEGRITY_CHECKS but rather DDISABLE_INTEGRITY_CHECKS Mar 27, 2010 at 9:22
  • This also works in Windows 8 Release Preview. Jul 3, 2012 at 23:47
5

There are roughly three levels of security for kernel mode drivers:

  • Signed
  • Test signed / Self signed
  • Unsigned

Signed drivers will install normally, provided the certificate is valid etc.

Test signed drivers will require those bcdedit commands, since Windows normally does not normally accept self signed drivers. Kernel driver developers would typically run their Windows computer in test mode. The idea is that they can "self sign" their drivers. Test mode allows their self signed driver to be loaded. After testing is complete, the driver will still have to be signed.

Unsigned drivers will not be loaded. Not even in test mode, because they have to be at least test signed!

So that's when it is necessary to press the F8 key at boot time and choose Disable Driver Signature Enforcement. It is a last resort option.

Also note that the F8 setting is for that Windows session only and won't persist after a reboot. Kind of like the Windows 'safe mode' option.

From here, where can you go?

Either you accept having to press F8 each time or figure out how to self-sign your driver so you can at least load it in test mode.

Some further reading:

Installing an Unsigned Driver during Development and Test

Test Signing

1
  • Can you provide written documentation that explains why that is? I already know the reason, but it would improve your answer, if you provide proof of your statement (in the answer itself of course)
    – Ramhound
    Mar 2, 2016 at 17:42
1

The best way to avoid "Windows cannot verify the digital signature" error message is to disable digital signature enforcement for current Windows session. Here's a detail explanation for each Windows version: http://freewisdoms.com/windows-cannot-verify-the-digital-signature-code-52-driver-fix/

Be aware that this solution isn't permanent, so you'll have to do it on each Windows startup. The permanent solution including CMD commands (mentioned above), may sometimes work but most of the time it doesn't. Microsoft is taking efforts to make this signature check very hard to disable because they gain a lot of money from driver vendors...

1
  • 2
    Consider adding some quoted reference to this answer supporting what you state in case the link ever dies so the answer content is still available that is currently only available via that link per your suggestion. Aug 20, 2017 at 17:04
0

Stumbled upon this thread. After reading through another thread (on Overflow), it seems there is conclusive documentation on this. See- https://stackoverflow.com/questions/52778961/windows-10-error-code-52-in-device-manager-with-correct-signature-in-cross-sign

"Note: Starting with Windows 10, version 1607, Windows will not load any new kernel mode drivers which are not signed by the Dev Portal.

[...]

Cross-signed drivers are still permitted if any of the following are true:

The PC was upgraded from an earlier release of Windows to Windows 10, version 1607.

Secure Boot is off in the BIOS.

Drivers was signed with an end-entity certificate issued prior to July 29th 2015 that chains to a supported cross-signed CA."

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .