Learn more about these Integrity protection requirements and why they might not be enabled on your device.
What is Signed drivers?
Signed drivers is a Windows security protection that helps ensure Windows only loads drivers that meet standard production trust requirements.
Drivers operate with a high level of privilege in Windows. Requiring signed drivers helps strengthen the integrity of Windows and helps prevent development or test configurations from weakening driver trust requirements.
What is Kernel Debug Protection?
Kernel debugging is an advanced Windows capability designed for development, testing, and troubleshooting. It allows a debugger to run on another computer to connect directly to the Windows kernel. Kernel Debug Protection checks that kernel debugging is disabled on your device.
Why does Integrity protection check for this?
Integrity protection checks whether important security protections are active on your device.
Signed drivers are one of these protections because drivers run with kernel-level privileges and can significantly affect the security of Windows. Kernel Debug Protection is one of these protections because enabling it changes the normal security configuration of the device, and kernel debugging is intended only for specialized development and testing scenarios.
If these are not active, the Integrity protection page in Settings may show that your device Needs attention.
Why aren't these enabled on my device?
Your device may be using special settings intended for software development or testing.
These settings can allow test-signed drivers to run or support kernel debugging. They aren't normally needed on a consumer device.
This configuration may be present if:
- The device was intentionally set up for kernel or driver development, testing, or software that requires test-signed drivers.
- Secure Boot was turned off and the device's startup settings were changed.
- A troubleshooting or development tool changed the device's startup settings.
If you intentionally set up this PC for Windows kernel development or testing, you may want to keep these settings.
Why can't Windows automatically turn it on?
Some software development and testing tools rely on special settings that affect how Windows starts and loads drivers. Windows can't always tell whether you still need these settings, so it doesn't change them automatically.
To turn these protections on, you may need to restore Secure Boot. This setting is managed by your device's built-in firmware (UEFI), outside of Windows. You may need to restart your device, open its UEFI settings, and enable or restore Secure Boot. Follow your device manufacturer's instructions.
What should I do?
If you don't use this PC for kernel development or testing, we recommend restoring your device to its normal Secure Boot configuration. Follow the guidance here to restore Secure Boot.
After Windows starts, return to the Integrity protection page in Settings. Windows will check the device again to determine whether it now meets the security requirements.
Can I continue using my device?
Yes. You can continue using your device normally.
Integrity protection will indicate that your device doesn't currently meet this security criterion. The status helps you understand which protections are active and where your device may benefit from additional protection.
For IT administrators
If devices in your organization don't meet the Signed drivers and Kernel Debug Protection requirement, investigate whether test-signing, kernel debugging, or other software development configurations are enabled on managed devices. Where possible, return devices to a standard production configuration.