How to disable enforcement via recovery Command Prompt????

Question

A newly deployed WDAC policy is preventing critical storage controller drivers from loading during boot, resulting in INACCESSIBLE_BOOT_DEVICE bugchecks. How do we boot into recovery mode and disable WDAC policy enforcement via Command Prompt?

Answer 1

Dear Isabella Brown,

When a WDAC policy blocks critical storage drivers, the system halts with INACCESSIBLE_BOOT_DEVICE and you must disable enforcement from recovery mode. Boot the server into the Windows Recovery Environment by interrupting startup three times or booting from installation media, then open Command Prompt. From there, navigate to the system drive and rename or remove the active WDAC policy files under C:\Windows\System32\CodeIntegrity\. The key files are SiPolicy.p7b or any custom .cip policy file. For example, run ren C:\Windows\System32\CodeIntegrity\SiPolicy.p7b SiPolicy.old. This prevents Code Integrity from loading the WDAC policy at next boot.

After reboot, the host will start without WDAC enforcement, allowing the storage controller drivers to load normally. Once the system is stable, you can re‑author the WDAC policy to include the required driver binaries and redeploy it. This is the only supported way to recover from a blocking WDAC policy without bypassing secure boot or BitLocker.

If my answer is useful for you, please hit Accept the answer to support me.

Thank you,

HL.