Need to allow a blocked driver

Question

Hi - I am attempting to follow the instructions posted here to temporarily allow a blocked driver:

https://support.microsoft.com/en-us/windows/the-windows-driver-policy-ecd2a78c-750c-415d-93f2-e37302ce0443

Secure Boot is currently disabled.

Note that the examples given in the PowerShell commands appear to be generic driver IDs.

Navigating to the directories shown in the EFI partition as well as the Windows\System32\CodeIntegrity\CiPolicies\Active, I am able to see the actual audit and enforcement CIP files for the blocked driver in question and remove them.

However, every time I try this procedure and reboot, my machine will no longer boot to Windows and I need to use System Restore.

I only need to temporarily run a program to configure an RGB header and the driver used by this program was suddenly blocked after the last Windows 11 security update and subsequent reboot.

Answer 1

The problem is that none of the "normal" methods allow the driver to run and deleting the files manually is what Microsoft recommends in the article I linked. That said, why would manually deleting Code Integrity policy files be presented as a solution if it is known to cause problems?

Answer 2

Hi CLab,

The article's instructions to remove the Code Integrity policy files are intended for situations where you want to disable the Windows Driver Policy entirely, not to create an exception for a specific driver. The policy is designed this way so that protected drivers cannot be selectively bypassed while the feature remains enabled.

According to the article, there is currently no supported method to allow an individual blocked driver while keeping the Windows Driver Policy active. The recommended approach is still to obtain a WHCP-signed or updated driver from the hardware/software vendor.

To help narrow down the issue, could you please confirm:

1. What is the exact driver name and publisher that is being blocked?
2. After following the article and removing the policy files, did the driver remain blocked or did a different error appear?
3. Do you see any Code Integrity Event ID 3077 entries in Event Viewer that reference the driver?

These details will help determine whether the Windows Driver Policy is still enforcing the block or if another driver-signing or security mechanism is involved.

I look forward to your update and will be happy to help further. Thanks for your effort.

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

The supported way to temporarily allow a blocked driver on Windows 11 is to adjust the security feature that is blocking it, rather than manually deleting Code Integrity policy files. Manually removing CiPolicies from the EFI partition or from Windows\System32\CodeIntegrity\CiPolicies\Active can leave Secure Boot / Code Integrity in an inconsistent state and cause exactly the boot failures being seen.

For consumer Windows 11 devices, the block is typically coming from either:

• Memory integrity (HVCI) / Core isolation, and/or
• The Microsoft vulnerable driver blocklist, which is automatically enforced when memory integrity, Smart App Control, or S mode is on.

To temporarily allow the driver so the RGB utility can run, use one of these supported options instead of deleting CiPolicies:

1. Update the driver (recommended)
   • Check Windows Update and the device/program manufacturer for an updated, compatible driver.
   • Install the updated driver and reboot. This avoids weakening system security.
2. Temporarily turn off Memory integrity / vulnerable driver blocklist This reduces protection while it is off, so only do this long enough to run the configuration tool.
   1. Open the Windows Security app.
   2. Go to Device security.
   3. Under Core isolation, select Core isolation details.
   4. Turn Memory integrity to Off.
   5. Reboot the PC.
   Notes:
   • On Windows 11, when memory integrity, Smart App Control, or S mode is on, the Microsoft vulnerable driver blocklist is enforced. Turning off memory integrity disables that enforcement on most consumer systems.
   • After the reboot, install/run the RGB utility and complete the configuration.
   • When finished, return to Core isolation and turn Memory integrity back On, then reboot again.
3. If the driver is blocked by the Microsoft vulnerable driver blocklist alone
   • If memory integrity, Smart App Control, and S mode are all off, the blocklist can also be toggled from the Device security → Core isolation area in Windows Security where the Microsoft vulnerable driver blocklist option is surfaced.
   • Turn it off, reboot, perform the configuration, then turn it back on and reboot again.

If the driver remains blocked even with memory integrity and the vulnerable driver blocklist turned off, or if boot issues continue after restoring these settings, use System Restore to return to a known-good state and then avoid manual changes to EFI or CodeIntegrity policy files. In that case, contact the hardware/software vendor for an updated driver that is compatible with current Windows 11 security policies.

---

References:

• A driver can't load on this device
• Microsoft recommended driver block rules
• Device Security in the Windows Security App