Pnputil & SignerScore

NTDEV
1

Following the guidance from Microsoft regarding devcon, I’m exploring the feasibility of moving a Display driver to pnputil install. However, when I pnputil.exe /add-driver mydriver.inf /install it, setupapi.app.log reports:

Driver Node:
     utl:                Status         - Selected | Installed
     utl:                Driver INF     - display.inf (C:\WINDOWS\System32\DriverStore\FileRepository\display.inf_amd64_34a28de3c87d810f\display.inf)
     utl:                Class GUID     - {4d36e968-e325-11ce-bfc1-08002be10318}
     utl:                Driver Version - 06/21/2006,10.0.26100.1
     utl:                Configuration  - PCI\CC_0300 [MSBDA]
     utl:                Driver Rank    - 00FB2006
     utl:                Signer Score   - Inbox (0D000003)
     utl:           Driver Node:
     utl:                Status         - Outranked
     utl:                Driver INF     - oem6.inf (C:\WINDOWS\System32\DriverStore\FileRepository\mydriver_km.inf_amd64_8d2381e5c6975193\mydriver_km.inf)
     utl:                Class GUID     - {4d36e968-e325-11ce-bfc1-08002be10318}
     utl:                Driver Version - 11/28/2025,10.18.1.1
     utl:                Configuration  - PCI\REDACTED
     utl:                Driver Rank    - 80FB2001
     utl:                Signer Score   - Unsigned (80000000)

It is my understanding that mydriver is being punished because it’s not signed (it is test signed). Is there a way to disable this for test/debug builds? bcdedit Debug, TestSigning, nointegritychecks appear to have no effect. Is there some other magic spell I should be casting?

This is not a problem on production builds of mydriver (ofcourse).

2

One (perhaps THE) magic spell is to deploy the test signing certificate to the target machine

     utl:           Driver Node:
     utl:                Status         - Selected
     utl:                Driver INF     - oem6.inf (C:\WINDOWS\System32\DriverStore\FileRepository\mydriver.inf_amd64_151e83f3ebdad2fe\mydriver.inf)
     utl:                Class GUID     - {4d36e968-e325-11ce-bfc1-08002be10318}
     utl:                Driver Version - 12/10/2025,10.18.1.1
     utl:                Configuration  - PCI\REDACTED
     utl:                Driver Rank    - 00FB2001
     utl:                Signer Score   - Authenticode (0F000000)
     utl:           Driver Node:
     utl:                Status         - Outranked | Installed
     utl:                Driver INF     - display.inf (C:\WINDOWS\System32\DriverStore\FileRepository\display.inf_amd64_34a28de3c87d810f\display.inf)
     utl:                Class GUID     - {4d36e968-e325-11ce-bfc1-08002be10318}
     utl:                Driver Version - 06/21/2006,10.0.26100.1
     utl:                Configuration  - PCI\CC_0300 [MSBDA]
     utl:                Driver Rank    - 00FB2006
     utl:                Signer Score   - Inbox (0D000003)
     utl:      {Select Drivers - exit(0x00000000} 17:38:42.006
2 Likes
3

every driver needs to be signed, you will get pop up to confirm that you really want to install test signed driver.

target pc needs to be in test mode and driver test signed.

4

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.