If you've ever tried to install an older or niche piece of hardware and been met with a message saying Windows "cannot verify the publisher of this driver software," you've run into Driver Signature Enforcement. It's a security feature most people never need to think about - until the one time they do, usually while troubleshooting a stubborn legacy device. This guide explains what it actually does, why it exists, and how to work around it safely for the rare cases that genuinely need it.

What Driver Signature Enforcement Does

Drivers run with some of the highest privilege levels in Windows - deep access to your hardware and, by extension, your entire system. A malicious or poorly written driver can crash your PC, corrupt data, or serve as an entry point for malware operating below the reach of normal antivirus protection. To reduce this risk, Windows requires that all drivers loaded on 64-bit versions of Windows be digitally signed by a trusted certificate authority, confirming the driver comes from a verified publisher and hasn't been tampered with since it was signed.

When you try to install a driver that isn't properly signed - typically old software abandoned by its manufacturer, drivers for very niche or hobbyist hardware, or in rare cases a corrupted download - Windows blocks the installation outright and shows an error such as:

"Windows cannot verify the digital signature for the drivers required for this device. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source."

Pro tip: This is one of the most effective built-in protections Windows has against a category of malware called rootkits, which specifically try to install malicious drivers to gain persistent, low-level control of a system. Treat any prompt to disable this protection with real caution.

Why You Might Genuinely Need to Bypass It

There are a handful of legitimate reasons this comes up in practice:

  • Legacy hardware - an old scanner, printer, capture card or specialised peripheral whose manufacturer stopped updating drivers years ago and never obtained modern signing certification.
  • Development and testing - software developers building and testing their own unsigned drivers before release.
  • Hobbyist and specialist hardware - some 3D printer controllers, amateur radio interfaces, and other niche devices ship with community-maintained, unsigned drivers.
  • Corrupted signature after a bad download - occasionally a legitimate, properly signed driver's signature is stripped or corrupted during download or by antivirus interference, triggering the same error for a driver that should otherwise be fine.

Safety warning: Before disabling signature enforcement, always try re-downloading the driver from the manufacturer's official site first, ideally with your antivirus's real-time file scanning temporarily excluding just that download folder if it's known to interfere. A "corrupted signature" error is sometimes actually a corrupted download, not a genuinely unsigned driver.

How to Temporarily Disable Driver Signature Enforcement

This is done through Windows' Advanced Startup options and only disables enforcement for that single boot session - it re-enables itself automatically on the next normal restart, which is a deliberate safety measure.

  1. Click Start, then Power, hold Shift and click Restart - this boots into the Advanced Startup Options menu.
  2. Select Troubleshoot > Advanced options > Startup Settings.
  3. Click Restart.
  4. Once the PC restarts into the Startup Settings menu, press 7 or F7 to select Disable driver signature enforcement.
  5. Windows boots normally with enforcement disabled for this session only.
  6. Install your unsigned driver as normal.

Because this only applies for a single boot, you'll need to repeat the process if you restart the PC and the driver stops working - though in practice, most drivers, once installed and loaded once, continue running until the next reboot even without re-enabling the bypass, since the block applies mainly at load time.

It's possible to disable enforcement permanently using an elevated Command Prompt with bcdedit /set nointegritychecks on, but this is strongly discouraged for typical home use.

Safety warning: Permanently disabling Driver Signature Enforcement removes a meaningful layer of protection against malicious drivers for as long as it stays disabled, and can also cause Windows to fail certain integrity checks used by some anti-cheat systems in games and by BitLocker in specific configurations. Only do this if you have an ongoing, specific need - and re-enable it (bcdedit /set nointegritychecks off) the moment you're done, followed by a restart.

Test Signing Mode for Developers

Software developers working with unsigned drivers under active development typically use Test Signing Mode instead, enabled via an elevated Command Prompt with bcdedit /set testsigning on (and disabled again with bcdedit /set testsigning off). This is a distinct, more persistent mode intended specifically for development workflows, and Windows displays a permanent watermark in the bottom-right corner of the desktop while it's active as a visible reminder that the protection is disabled.

Checking Whether a Driver Is Properly Signed

Before assuming you need to bypass anything, verify the signature status directly:

  1. Right-click the downloaded driver's .exe, .inf, or .sys file and select Properties.
  2. Check the Digital Signatures tab - if it's missing entirely, the file is unsigned. If present, you can view details of the signing certificate and its validity.
  3. In Device Manager, right-click an installed device, go to Properties > Driver tab, and check the Digital Signer field - "Not digitally signed" confirms the driver bypassed enforcement to install.

The Bottom Line

Driver Signature Enforcement exists specifically to stop malicious or broken low-level software gaining control of your PC, and for the vast majority of hardware and drivers you'll ever install, you'll never encounter it at all - modern, properly maintained drivers are signed as a matter of course. Reserve bypassing it for confirmed legitimate legacy or niche hardware, use the temporary single-boot method rather than a permanent disable whenever possible, and always source the driver itself from the original manufacturer.

Was this guide helpful? Explore more Driver Updates guides, or browse all Operating System & Software articles.