As a result, the program was deprecated in 2021, and all certificates have since expired. However, third-party drivers signed by the program are still “broadly trusted,” Microsoft says.
The new kernel trust policy will apply to Windows 11 24H2, 25H2, 26H1, and Windows Server 2025, and all future versions will enforce it, because, Peter Waxman, a group program manager at Microsoft, writes in a blog post, “drivers are a critical part of the Windows ecosystem, and ensuring their integrity is essential to providing a secure and trustworthy environment.”
However, in its initial evaluation mode, Microsoft will monitor and audit driver loads to test for compatibility issues should cross-signed drivers be blocked. Systems will remain in evaluation mode until they meet specific runtime (100 hours) and boot-start (2-3 restarts) scenarios. If all drivers loaded during the evaluation period are trusted, the policy activates, but if any cross-signed drivers are audited that would not pass the new kernel trust policy, the system remains in evaluation mode until those drivers are no longer audited.
