In summary:
- Microsoft is implementing a new Windows kernel trust policy starting April 2026 that will only allow WHCP-certified drivers by default, addressing years-old security vulnerabilities from cross-signed drivers.
- PCWorld reports this change targets the deprecated cross-signed root program that allowed malicious code injection due to weak security checks and stolen signature keys.
- Windows 11 systems will undergo a 100-hour evaluation period with at least 3 restarts to test driver compatibility before activating the stricter security measures.
Microsoft is tightening security in Windows 11. Starting April 2026, outdated kernel drivers will be phased out—the company’s response to a well-known security issue that has plagued Windows for years.
In a Windows IT Pro blog post, Microsoft announced that it will cease to trust drivers signed via the deprecated “cross-signed root program.” This procedure dates back to the early 2000s and was long considered the standard for allowing third-party drivers in the Windows kernel.
The problem? Certification was carried out by external authorities and only offered limited security checks. This led to abuse and stolen signature keys, paving the way for manipulated drivers. Although the program was discontinued back in 2021, Windows continued to accept many of these old drivers—until now.
Only verified drivers permitted now
Going forward, Windows will by default only allow kernel drivers that have been certified via the official Windows Hardware Compatibility Program (WHCP). These drivers are checked by Microsoft for malware and compatibility, among other things.
The aim is to make it significantly harder for malicious code to be injected into the kernel, the most sensitive part of the operating system.
Microsoft also emphasizes that the new policy is based on extensive telemetry data—specifically, data pulled from billions of driver load operations over the past two years. Feedback from developers has also been incorporated into the implementation.
By the way: If you’re using Windows 11 Home, you’re missing out on the many benefits of Windows 11 Pro. To learn more, see our comparison of Windows 11 Home and Pro. If you want to upgrade, snag it for cheap in the PCWorld Software Store: now just $59 instead of $99.
The rollout will be gradual
Though the announcement came yesterday, the change-up won’t be immediate. Microsoft is starting with a so-called “evaluation mode” for PCs, which entails the following:
The Windows kernel will monitor and audit all driver loads to determine if the new trust policy can be safely activated without causing compatibility issues caused by blocking critical cross-signed driver.
A system will remain in evaluation mode until all evaluation criteria are met. For Windows 11, that means 100 hours of system operation and at least 3 system restarts.
If all drivers loaded during the evaluation period are trusted by the kernel policy, the system activates and enforces the new kernel trust policy. Enforced systems are now protected against untrusted drivers from the cross-signed program, not on the kernel trust policy.
If any cross-signed drivers are audited during the evaluation period and determined they would not pass the new kernel trust policy, the policy is not activated and remains in evaluation, and the evaluation period is reset. The system stays in evaluation mode until the drivers blocking enablement are no longer audited.
Important: Systems with incompatible drivers detected will remain in diagnostic mode for now and won’t be affected by the full transition.
Exceptions and special rules
It’s not entirely without compromise: Microsoft is introducing a list of exceptions, which include older drivers that are classified as trustworthy and are intended to continue functioning.
Companies can also define their own rules. Special policies allow internal or custom-developed drivers to continue being used, though only under strictly controlled conditions.
To this end, Microsoft provides Application Control for Windows, a feature that allows organizations to selectively approve their own or non-officially certified drivers (for example, for internal applications or specialized hardware).
Which Windows versions are affected?
The new security policy applies to:
- Windows 11 version 24H2 and later
- Windows Server 2025
The rollout begins with the April 2026 update and will thereafter be a permanent feature of new Windows versions.
Greater security, potential side effects
For you as a user, this change primarily means one thing: greater security when using Windows 11. Attacks via manipulated or insecure drivers will be made much harder with this policy.
But individual users may run into unforeseen problems, for example if very old hardware relies on drivers that are no longer supported. Microsoft is limiting this risk through its phased rollout and exceptions.
This article originally appeared on our sister publication PC-WELT and was translated and localized from German.
Author: Viviane Osswald, Autorin
Viviane Osswald ist freie Redakteurin und Tech-Enthusiastin mit einer besonderen Leidenschaft für Mobile-Tech. Egal, ob Smartphones, Gadgets oder die neuesten Trends aus der Welt von Apple und Android – sie ist in beiden Welten zu Hause. Neben Technik widmet sie sich gerne Lifestyle-Themen, kulinarischen Entdeckungen sowie Filmen und Serien. Mit ihrer Begeisterung für moderne Technologien liefert sie gerne praxisnahe Tipps und spannende Einblicke, die den Alltag bereichern.