Windows Kernel Policy: Only WHCP Drivers from 2026

# New Driver Trust Policy in Windows Kernel: Dropping Outdated Certificates

Microsoft is changing its approach to verifying kernel drivers in Windows. Starting April 2026, the kernel will ignore drivers signed through the root certificate cross-signing program introduced in the early 2000s. Support for this program ended in 2021, but the certificates remained trusted. Now, priority is given to signatures from the Windows Hardware Compatibility Program (WHCP).

Changes in the Trust Mechanism

The Windows kernel will switch to exclusive trust in WHCP drivers. Outdated cross-signing certificates will no longer load by default. For backward compatibility, an explicit allowlist will be maintained: verified old drivers will still be able to load.

Changes will affect:

• Windows 11 24H2, 25H2, 26H1;
• Windows Server 2025;
• All future client and server releases.

This will enhance security by minimizing risks from outdated signing mechanisms, informed by telemetry from billions of devices.

Audit Mode and Configuration

The new policy will launch in audit mode. The system will track:

• Runtime with outdated drivers;
• Number of loads;
• Overall stability.

Administrators will be able to override the policy via AppLocker (formerly WDAC). This is useful for enterprise scenarios with internal drivers. Microsoft will continue monitoring feedback for refinements.

In enterprise environments, this will allow balancing security and compatibility with legacy hardware.

Security Update Context

These changes fit into a series of measures to strengthen protection. Previously, a critical network vulnerability was fixed. Microsoft is moving to the second stage of protecting Windows Deployment Services (WDS): blocking automatic installation of Windows 11 and Server 2025. In the future, a complete abandonment of outdated WDS processes in favor of modern protocols is expected.

Key Points

• From April 2026: Windows kernel trusts only WHCP signatures, outdated ones via whitelist;
• Audit mode for monitoring without immediate blocks;
• AppLocker for enterprise exceptions;
• Applies to Windows 11 24H2+ and Server 2025;
• Based on telemetry to minimize disruptions.

Driver developers are recommended to switch to WHCP certification ahead of time. Enterprise administrators should test policies in audit mode.

— Editorial Team