4

I am sick of trying to disable "only signed driver" installation on Windows 10.

I tried running as admin:

bcdedit /set testsigning on
bcdedit /set nointegritychecks off

But to no avail.
Only rebooting and using "Startup options" and then "Disable driver signature enforcement" worked. But this is one time. How can I do this permanently?

This is extremely ridiculous - I wanted to install USBasp driver (for programming AVR microcontrollers) and I couldn't...

P.S I have "Secure boot" disabled in BIOS.

Improve this question
4
  • Please see How to force Windows 7 to disable driver signature enforcement?
    – xavier_fakerat
    Oct 8, 2017 at 12:05
  • 1
    bcdedit /set onetimeadvancedoptions on will reboot directly into startup options without any additional steps. Then you can selection option 7 there. Maybe it helps a little.
    – masterxilo
    Nov 23, 2017 at 21:37
  • @masterxilo I use a Bluetooth keyboard. So every single time I want to use an unsigned driver, I need to physically get an old USB keyboard out of the cabinet, just so I can hit this one button.
    – Wowfunhappy
    May 28, 2018 at 22:00
  • 1
    In order to load kernel-mode module, signature is mandatory. TESTSIGNING skips PKI checks, NOINTEGRITYCHECKS skips, well, integrity (hashsums) checks, but the driver must ultimately be signed nonetheless in order to be normally(?) usable. If your driver doesn't have signed *.cat file, or missing signature on main executable (manual load driver), it won't load.
    – weaknespase
    Jan 24, 2020 at 15:00

2 Answers 2

Reset to default
0

I think you meant to run :

bcdedit /set testsigning off
bcdedit /set nointegritychecks on

Note the "nointegritychecks on".

In any case, the first one should have been enough and the second is not needed. Secure Boot should also be disabled in the BIOS.

More info in the article The TESTSIGNING Boot Configuration Option.

Improve this answer
5
  • 1
    Yep, I just made a typo. Of course I run "nointegritychecks on". But that doesn't work. After "testsigning on" I had a watermark on the bottom-right corner of my desktop, but I still wasn't able to install the driver. I don't see anything new in the article linked.
    – zupazt3
    Oct 8, 2017 at 16:09
  • Are you sure that the driver fits your Windows version? Maybe a problem of 32 vs. 64 bits.
    – harrymc
    Oct 8, 2017 at 17:02
  • 1
    I am sure because I have installed the driver successfully by booting with a "Disable driver signature enforcement" option. I'm even using right now this device (USBasp). But for future I want to be able to install what I want and not only signed drivers.
    – zupazt3
    Oct 8, 2017 at 17:19
  • Weird. This goes against my experience in Windows 7 and every article I have read on the subject. Perhaps in Windows 10 dear Microsoft has decided to disable this option as a security measure. After all, it is a rather huge security risk.
    – harrymc
    Oct 8, 2017 at 18:52
  • @zupazt3 I have exactly the same problem. There's a certain driver that I cannot install, even in test-mode and with nointegritychecks on. I can only install it by manually going to the "Startup Settings" during boot and selecting "7) Disable Driver signature enforcement"
    – masterxilo
    Nov 23, 2017 at 21:28
-1

In all cases, you need to run:

bcdedit /set testsigning off
bcdedit /set nointegritychecks on

In some cases, this will be enough to install the driver.

In some cases, however, you will also need to do the following immediately before installing the driver:

1) Restart machine while holding down Shift key → Troubleshoot → Advanced Options → Startup Settings → Restart

2) When the Startup Settings screen appears, select "Disable Driver Signature Enforcement"

Monitor EDID overrides are an example of a type of driver that always needs the second method. I suspect, but am not sure, that the first method by itself works for drivers that have "test" signatures, whereas the second is needed for drivers that have no signature whatsoever.

Note that in my experience, performing the second method but not the first will in all cases allow the drivers to install, but cause them to cease functioning after the next reboot. Thus, the bcdedit commands are needed in all cases.

I really, really hope Microsoft reconsiders this policy in the future. This type of policy is something I expect on iOS, not my self-built PC. Even Apple's own macOS gives users the ability to permanently allow unsigned kernel extensions.

Given admin and bootloader access, I should always be able to run unsigned code on my own machine. A mechanism that needs to be re-enabled after every boot, and which cannot be performed at all with a Bluetooth keyboard, should not be acceptable in a desktop OS with wide-ranging hardware targets.

Improve this answer
1
  • 1
    I disagree. It's a sensible mechanism to prevent malicious rootkits. However, there should be a way for consumers to sign their own drivers without paying hundreds of dollars.
    – TJJ
    Mar 15, 2019 at 12:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .