この記事では、Microsoft 中間証明機関 (CA) の TBS ハッシュ値が指定されている署名者ルールの新しい Application Control for Business (旧称 Windows Defender Application Control (WDAC)) 処理ロジックについて説明します。 Microsoft および Windows コンポーネントは、主に 6 つの Microsoft 発行元 CA によって発行されたリーフ証明書によって署名されます。 2025 年 7 月以降、これらの 15 年間の発行元 CA の有効期限は、次のスケジュールに従って開始されます。

Microsoft and Windows components are signed by leaf certificates mainly issued by six Microsoft Issuing CAs. Beginning in July 2025, these 15-year Issuing CAs begin to expire according to the following schedule.

A digital signature is an electronic, encrypted, stamp of authentication on digital information such as email messages, macros, or electronic documents. A signature confirms that the information originated from the signer and has not been altered.

このリンカー オプションは、Windows セキュリティ センターにコンポーネントを登録するマルウェア対策と詐欺対策のシナリオに必要です。 信頼された署名 (旧称 Azure Code Signing) を使用して IntegrityCheck にリンクされたユーザー モードの PEs に署名する必要があります。 クロス署名プログラム は非推奨であり、新しい署名証明書は発行されません。 Windows は、クロス署名プログラムによって署名された既存のバイナリを引き続き信頼します。 Microsoft ではまず、Windows 11 バージョン 21H2 でユーザー モードの PEs の署名要件が導入されました。

A digital signature is an electronic, encrypted, stamp of authentication on digital information such as email messages, macros, or electronic documents. A signature confirms that the information originated from the signer and has not been altered.

It works by verifying the digital signature of pre-boot software against a set of trusted digital certificates (also known as certificate authority or CA) stored in the device's firmware.

Your digital signature ensures that the project has not been tampered with since you signed it, but it does not prove that you wrote the project. Even if you have locked your macro project, another user may still be able to replace your signature with another signature.

The Signature Details dialog box displays certificate information such as the signer’s name in the Signing as box, and who issued the certificate. Open the file that contains the certificate you want to view.

For signing and signature verification, the Key Usage attribute of the certificate must be Digital Signature. For encryption and decryption, the Key Usage attribute of the certificate must be Data Encipherment or Key Encipherment.

You can package the file, apply a digital signature to the package, and then distribute the signed package to other users. The Package-and-Sign feature places the database in an Access Deployment (.accdc) file, signs the file, and then places the signed package at a location that you determine.