Disable Driver Signature Enforcement Permanently in Windows 10

Driver signature enforcement is a Windows 10 security feature that blocks drivers without a valid Microsoft signature. If you need to install an unsigned or self-signed driver (for older hardware, custom devices, or development), you can disable this enforcement permanently. This guide shows you how to do it using the built-in Advanced Startup options—no third-party tools needed. You’ll need administrator access to your PC.

What You’ll Need

A Windows 10 PC with administrator privileges.
Your Windows login password (or PIN) if you have one.
About 10 minutes of time—your PC will restart several times.

Step-by-Step

Open Settings. Press Win + I to open the Settings app.
Go to Update & Security. Click on “Update & Security” (the icon with two curved arrows).
Open Recovery. In the left sidebar, click “Recovery”.
Restart in Advanced Startup. Under “Advanced startup”, click the “Restart now” button. Your PC will restart and show a blue screen with options.
Choose Troubleshoot. On the blue screen, click “Troubleshoot” (the icon with a wrench and screwdriver).
Select Advanced Options. Click “Advanced options”.
Choose Startup Settings. Click “Startup Settings”. You may be prompted to restart again—click “Restart”.
Press 7 or F7. After restarting, you’ll see a list of startup options. Press the 7 key or F7 to select “Disable driver signature enforcement”. Your PC will boot normally with enforcement disabled.
Install your driver. Once Windows loads, install the unsigned driver as you normally would. It should now work without error.
Verify the driver is installed. Open Device Manager (right-click the Start button and select “Device Manager”). If your device shows no yellow warning icon, the driver installed successfully.

Note: This method disables enforcement only for the current boot session. To make it permanent, you need to use the Advanced Startup method again after each reboot—or use the BCDEdit command-line method below, which persists until you undo it.

Permanent Method Using Command Prompt

Open Command Prompt as Administrator. Press Win, type “cmd”, right-click “Command Prompt”, and select “Run as administrator”.
Run the BCDEdit command. Type the following and press Enter:
bcdedit /set loadoptions DDISABLE_INTEGRITY_CHECKS
Note: This is case-sensitive. The correct text is DDISABLE_INTEGRITY_CHECKS (two D’s at the start).
Disable the test signing flag. Type the following and press Enter:
bcdedit /set testsigning on
Restart your PC. After reboot, driver signature enforcement will remain disabled until you turn it back on.

Common Mistakes

Typing the BCDEdit command wrong. The most common error is writing “DISABLE_INTEGRITY_CHECKS” instead of “DDISABLE_INTEGRITY_CHECKS”. The double D is intentional and required.
Forgetting to run as administrator. If you get an “access denied” error, you didn’t open Command Prompt as administrator.
Using the wrong boot option. In Startup Settings, pressing 7 disables enforcement for that session only. If you expect it to persist, you’ll be confused—use the BCDEdit method for permanent.
Not installing the driver after disabling. Disabling enforcement doesn’t install anything; you still need to run the driver installer or manually update the driver in Device Manager.

Tips

Backup your data. Before making system-level changes, it’s wise to back up important files, though this specific change is low-risk.
Re-enable enforcement when done. Leaving enforcement disabled permanently reduces security. After installing your driver, you can re-enable it by running:
bcdedit /set loadoptions ENABLE_INTEGRITY_CHECKS
and
bcdedit /set testsigning off
Use the temporary method first. If you only need to install one driver, the temporary method (Step 8) is safer and doesn’t require command-line changes.
Check for signed alternatives. Before disabling enforcement, see if the manufacturer offers a signed driver—it’s always better to use a signed one.

Troubleshooting

Driver still fails to install. Make sure you actually booted with enforcement disabled. Check by opening System Information (Win + R, type “msinfo32”) and look at “Secure Boot State”—if it says “Off”, enforcement is disabled. If it says “On”, you may need to disable Secure Boot in BIOS/UEFI as well, since Secure Boot can block unsigned drivers even with enforcement off.
BCDEdit gives “The boot configuration data store could not be opened.” This usually means you’re not running as administrator. Close and reopen Command Prompt with “Run as administrator”.
Windows won’t boot after changes. If you encounter boot issues, use the Advanced Startup menu to boot into Safe Mode (press 5 or F5 in Startup Settings). In Safe Mode, run the re-enable commands above to revert changes.
Driver installs but device shows an error. Right-click the device in Device Manager, select “Update driver”, and choose “Browse my computer for drivers”. Point to the folder with the driver files and select it. If it still fails, the driver may be incompatible with your Windows version.

Frequently Asked Questions

Is it safe to disable driver signature enforcement?

It reduces security because unsigned drivers can contain malicious code. Only disable it temporarily or when you trust the driver source. Re-enable it after installation.

Will Windows Update re-enable enforcement?

Windows Update doesn’t automatically re-enable enforcement, but a major feature update might reset the BCDEdit settings. You may need to reapply the commands after a major update.

Does this work on Windows 11?

The same methods work on Windows 11, though the Settings path may look slightly different. The BCDEdit commands are identical.

Can I use this to install old Windows 7 drivers?

Yes, many unsigned or legacy drivers from Windows 7 can be installed this way, but compatibility isn’t guaranteed—the driver must still be compatible with Windows 10’s kernel.

What is the difference between test signing and driver signature enforcement?

Test signing allows loading test-signed drivers (signed with a test certificate). Driver signature enforcement blocks any driver without a valid signature. Disabling enforcement is broader than enabling test signing.

How do I know if enforcement is currently disabled?

Open System Information (Win + R, type “msinfo32”) and look at “Driver Signature Enforcement”—it will say “Off” if disabled. Alternatively, run bcdedit in Command Prompt and check the “loadoptions” value.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →