Softpedia
 

NEWS CATEGORIES:



NEWS ARCHIVE >>
SOFTPEDIA REVIEWS >>
MEET THE EDITORS >>
TRENDING TODAY
Home > News > Microsoft > Tweak Mode

April 30th, 2007, 11:03 GMT · By

Disable Driver Signing in x64 Windows Vista

SHARE:

Adjust text size:

Windows Vista
Enlarge picture
With Windows Vista, Microsoft has introduced a new kernel security component for the 64-bit editions of the operating system. Windows mandatory Kernel Mode and Driver Signing implies
that all modules or drivers designed to run at kernel level have to feature digital signatures. Microsoft's initiative is designed to increase the security of 64-bit Vista platforms by attesting that the kernel level software is provided by a legitimate publisher.

Back in February, just after the release of Windows Vista, Russian-based security developer Kaspersky revealed that there are a number of documented methods that will result in disabling signature checking in x64 Windows Vista. Kaspersky was of course revealing this aspect as a warning that such methods could be associated with malicious purposes.

We anticipate a multitude of methods designed to get around kernel mode protection by loading unsigned components. Exploiting documented methods of disabling protection, developing exploits similar to the one mentioned above, gaining kernel level privileges without using a driver and finally, using a signed driver from a legitimate product with malicious intent. (...) This function protects the operating system against malicious code, but it is not as effective as the developers claim, informed Alisa Shevchenko, Virus analyst, Kaspersky Lab at that time.

Still, there are legitimate reasons for disabling driver signing in 64-bit editions of Windows Vista. And in this sense I am referring to freeware applications that will not run on x64 Vista simply because of the restrictions related to driver signing.

However, the solutions presented by Kaspersky to disable Mandatory Kernel Mode and Driver Signing fail to deliver streamlined usage. And there is a simpler war. All you have to do is type cmd in the Search Box included in the Vista Start menu. Next, press Ctrl + Shift + Enter to open a command prompt window with elevated privileges. Now enter bcdedit /set loadoptions DDISABLE_INTEGRITY_CHECKS in order to disable Driver Signing and reboot.


134,903 hits · 13 comments
Link to this article · Print article · Send to friend

MUST-READ RELATED ARTICLES:


Upgrade Paths from Windows XP to Windows Vista

Feed 4 GB of RAM to 32-bit Windows Vista

Burn Downloaded Windows Vista to Disk

Complete PC Restore Will Be Enhanced with Windows Vista Service Pack 1

Update Available for Windows Vista Media Center

READER COMMENTS:


Comment #1 by: nathan scarritt on 28 Dec 2007, 23:39 UTC reply to this comment

An easier way is to just type "bcdedit /set loadoptions DDISABLE_INTEGRITY_CHECKS" into vista's search box, and hit enter. It will open up a cmd window and enter it in itself, then close the command window... making it an easy 1 step operation

Comment #1.1 by: alex on 30 Dec 2010, 15:37 GMT

This doesn't work.
Microsoft has fixed it


Comment #2 by: John on 18 Nov 2008, 07:51 UTC reply to this comment

I agree there is an actual need to use this. I understand the implied reasoning for not allowing un-certified drivers but there are legitimate drivers and applications that I have used for years and know to be completely safe that just because it is freeware and the authors have not gone through the trouble to have the drivers signed, it simply wont work or install. Also if smart you will use other means of security and not do stuff that would intentionally harm your machine. I am happy that there is a fix for this but as I work on other peoples machines, I wish it weren't so easy to do because some people should leave it as is so my job wont be as hard lol. Thanks for the info though this is a lifesaver!


Comment #3 by: allan on 26 Nov 2008, 11:23 UTC reply to this comment

So erm, bcdedit /set loadoptions ENABLE_INTEGRITY_CHECKS turns it back on ??


Comment #4 by: tim on 13 Dec 2008, 19:07 UTC reply to this comment

To turn it back on use: bcdedit -deletevalue loadoptions

Also, I am told that it is best to run the command prompt as an administrator or it may not work. So, try START >> PROGRAMS >> ASSESSORIES >> Right click the COMMAND PROMPT icon and choose "Run as Administrator". You can paste the text into it there.

Having said all this, it would appear that this may be plugged by Microsft as my Vista Home Premium 64-Bit w/SP1 and all updates on it doesn't work for the driver I had this problem with. I still receive the error message after the driver is installed after I ran the command prompt and restarting.


Comment #5 by: JON F FRIEDERICHS on 24 Dec 2008, 13:20 UTC reply to this comment

followed this thread with interest, as I have Monaco's xrite optix xr pro colorimeter and color checker for my monitor, scanner and printer in form of ez color and optix 2.0. It has worked great for me on xp pro platform using pscs4, lr2, and epson R2400. The colorimeter itself is a DTP94. Anyways, a frriend has built up a newer system for me which includes windows vista 64 bit, for which I am told ez color will not work. I was told options were color munki or eyeonedisplay2, until it was suggested that it is possible to disable the 64bit driver (in vista)? and then I would be able to use my ezcolor program. Would anyone care to elaborate what exatly I would have to do to make this happen? And, is it reversible? Thank you very much.


Comment #6 by: seasky on 05 Jan 2009, 23:49 UTC reply to this comment

I tried this on my Vista Ultimate 64 and never worked. In order to have access to my sound card driver, i still need to reboot, press F8 and select to disable driver signing each time I do the reboot.
Can anyone help me?
Thanks in advance


Comment #7 by: gary on 19 Feb 2009, 06:25 UTC reply to this comment

thanks everyone for the info above. running the command line works on Vista Premium 64 bit/SP1, but it is reset on your next boot. I just created a bat file to make it easier. This is a really crazy limitation of 64 bit Vista, MS should provide a workaround for known drivers. BTB the driver giving me trouble is for a Novatel wireless card and isn't some hack, and yes I'm pissed at Novatel too.

Comment #7.1 by: liam on 28 Apr 2009, 23:56 GMT

Hello, I've tried the techniques described here for disabling driver signing. But I still can't use DVD43. I've followed the directions to the letter. I've entered the "bcdedit..." command from a cmd box running as admin and rebooted. That failed. I've rebooted, hit F8, and selected disable driver signing. That also failed. There was mention by "Tim" earlier that Windows might possibly "plug" this and defeat attempts to circumvent driver signing. Has anyone else tried these techniques on Windows Vista Home Premium SP1 - 64 bit and successfully got DVD43 to work?


Comment #8 by: leyton on 04 May 2010, 07:27 UTC reply to this comment

The problem is still occurring, very frustrating! ive entered the correct code into command promt and it tells me success. i reboot and still the same problem >>


Comment #9 by: tom on 15 Jul 2010, 23:10 UTC reply to this comment

Shouldn't it be: bcdedit /set loadoptions DISABLE_INTEGRITY_CHECKS
without double D.

Comment #9.1 by: dion on 01 Feb 2011, 06:58 GMT

I had the same problem, and I already did like you write, with double D.But the problem is still occur. Is there another way to disable this?

Comment #9.2 by: foobio on 05 Sep 2012, 13:36 GMT

>bsdedit.exe /set TESTSIGNING ON

This should solve the issue. However - be warned ... this allows all unsigned drivers to load. A better solution is to install the Windows Driver SDK and create a certificate.

However - if you are pressed for time and avoid sites that substitute "s" with a "z" and don't run untrusted setup scripts ... you should be ok.

Our colleagues on the dark side who spend their time writing rootkits will embed this command in any setup script ... to ensure they hijack a system by loading their unsigned drivers. Thus, as a side effect ... most virus checkers may complain about it.

Remember - this is a feature for "testing" and not production. A production system should go through the process of creating a certificate for the driver. This process is outlined in the Driver SDK.

Copyright © 2001-2013 Softpedia. Contact/Tip us at

WindowsGamesDriversMacLinuxScriptsMobileHandheldNews

SUBMIT PROGRAM   |   ADVERTISE   |   GET HELP   |   SEND US FEEDBACK   |   RSS FEEDS   |   UPDATE YOUR SOFTWARE   |   ROMANIAN FORUM