Unsigned Driver on Windows 11? Disable Memory Integrity First

Disable Memory Integrity first – go to Windows Security, Device Security, Core Isolation Details, toggle it off, and restart before running bcdedit /set testsigning on – or Test Mode will not activate on most Windows 11 systems regardless of what the command prompt reports. Most guides for installing unsigned drivers on Windows start with the bcdedit command. On Windows 10 this worked reliably. On Windows 11, Memory Integrity (HVCI) is enabled by default on most machines, and it operates at a level below Test Mode. Even after bcdedit runs successfully, HVCI continues to block unsigned drivers at the kernel level unless you explicitly disable it first. The result is a working bcdedit command that does nothing visible – the watermark never appears and the driver still refuses to load.

Before You Start – Check These Two Things

Two quick checks before touching any security settings can save you significant time.

Check Optional Updates first. Open Settings > Windows Update > Advanced Options > Optional Updates. Microsoft validates and distributes drivers for specific hardware here that may not appear in the main Windows Update or in Device Manager’s automatic search. If your device appears in Optional Updates, install from there – it will install a properly signed driver with no enforcement changes needed at all.

Check the manufacturer site for a signed version. Many drivers that users download from third-party driver aggregator sites are unsigned builds – the same driver from the manufacturer’s own site is often properly signed. Search the manufacturer’s official support page for your specific hardware model and Windows 11 before assuming the driver is inherently unsigned. If a signed version exists, use it.

Step 1 – Disable Memory Integrity (HVCI)

Open Windows Security from the Start menu. Go to Device Security, then click Core Isolation Details. Find the Memory Integrity toggle and set it to off. Windows will warn that this reduces security – acknowledge and continue. Restart the PC. After the reboot, Memory Integrity is no longer enforcing kernel driver isolation. You can confirm it is off by returning to Windows Security > Device Security > Core Isolation Details and checking that the toggle shows off and there is no green checkmark next to it.

If the Memory Integrity toggle is greyed out and cannot be changed, a Group Policy or MDM (Mobile Device Management) policy is enforcing it. This usually means the PC is enrolled in a corporate domain or has company security policies applied. On a corporate machine, contact your IT administrator – installing unsigned drivers on a managed machine may violate security policy. On a personal machine, check if a third-party security tool is locking the setting.

Step 2 – Enable Test Mode via bcdedit

After the Memory Integrity restart, open an elevated Command Prompt. Right-click the Start button and select Windows Terminal (Admin) or Command Prompt (Admin). Run the following command: bcdedit /set testsigning on. The command should report The operation completed successfully. Restart the PC again. After this second restart, check for the Test Mode text watermark at the bottom-right corner of the desktop. If the watermark appears, Test Mode is active and Windows will allow unsigned drivers to load. If the watermark does not appear, Secure Boot is still blocking it – proceed to Step 3. You can verify the current state by running bcdedit /enum {current} in Command Prompt and checking that testsigning shows Yes.

Step 3 – Handle Secure Boot if Test Mode Does Not Activate

If the desktop shows no Test Mode watermark after disabling Memory Integrity and running bcdedit, Secure Boot in the UEFI firmware is preventing the bcdedit setting from taking effect. Hold Shift and click Restart from the Start menu. In the recovery menu, go to Troubleshoot > Advanced Options > UEFI Firmware Settings and click Restart. Inside the UEFI BIOS, locate the Secure Boot option – usually under the Security, Boot, or Authentication tab. Set it to Disabled. Save the change and exit. Windows will restart. Open an elevated Command Prompt again, run bcdedit /set testsigning on, and restart once more. The Test Mode watermark should now appear.

Per Olusegun A., who is a Senior Systems Engineer at Accenture, “Older line-of-business hardware often ships with unsigned drivers that simply will not load under the default Windows 11 enforcement settings. Disabling HVCI is usually the missing step – most people try bcdedit first without realising Memory Integrity overrides Test Mode entirely on Windows 11.”

Important for BitLocker users: if the system drive uses BitLocker encryption, disabling Secure Boot triggers a TPM measurement change that causes BitLocker to prompt for the recovery key on the next boot. Before entering UEFI to disable Secure Boot, confirm your BitLocker recovery key is accessible – check account.microsoft.com/devices/recoverykey while signed into your Microsoft account. Without the recovery key, you will be locked out of Windows after the Secure Boot change.

Step 4 – Install the Unsigned Driver via Device Manager

With Test Mode active, install the unsigned driver. Open Device Manager (press Win + X, select Device Manager). Find the device that needs the unsigned driver – it may show as an Unknown Device or with a yellow triangle. Right-click it and select Update driver. Choose Browse my computer for drivers, then Let me pick from a list of available drivers on my computer, then click Have Disk. Browse to the folder containing the unsigned driver’s .inf file and select it. Windows will install the driver. If the device does not appear in Device Manager yet (because no driver was ever matched), go to Action > Add legacy hardware instead and follow the wizard, choosing manual install from a local path.

After installation, open Device Manager and check the device’s Properties > Driver tab. Confirm the driver version, provider, and date match the unsigned driver package you installed. The device should show no yellow triangle if the driver loaded correctly. Test the hardware to confirm it is working as expected before proceeding.

Step 5 – Verify With Event Viewer if the Device Still Shows an Error

If the device still shows a yellow exclamation in Device Manager after installing the unsigned driver in Test Mode, open Event Viewer by pressing Win + R and typing eventvwr.msc. Go to Windows Logs > System and look for recent error events. Filter for source Code Integrity and look for Event IDs with error codes. Code 52 means the driver failed a cryptographic signature check even in Test Mode – this can happen if the driver has an invalid or corrupted signature block rather than simply being unsigned. A structurally invalid signature is different from no signature and may require a different driver source or version. Code 37 means the driver’s INF file references a device that does not match the detected hardware ID – the driver is for a different hardware variant than the one installed. According to Microsoft’s Code Integrity diagnostic event documentation, checking Event Viewer for these codes is the correct next step when a driver fails to load even in Test Mode.

Step 6 – Re-Enable Protections After Confirming the Driver Works

Once the unsigned driver is installed and confirmed working, re-enable security protections to return the system to a safe state. Run bcdedit /set testsigning off from an elevated Command Prompt to turn off Test Mode. Restart. Check whether the unsigned driver still loads normally with Test Mode off – some drivers only need to survive the installation phase and will work in a subsequent boot without Test Mode active. If the driver loads correctly in normal mode, re-enable Memory Integrity in Windows Security and re-enable Secure Boot in UEFI. Restart after each change. If the device stops working after re-enabling Memory Integrity, the driver requires Test Mode to remain active – leave Memory Integrity off and accept the security trade-off, or find a newer HVCI-compatible driver from the manufacturer.

Frequently Asked Questions

Why does bcdedit /set testsigning on say it succeeded but nothing changes?

The bcdedit command writes to the Boot Configuration Data store successfully – that is why it reports success. But Memory Integrity or Secure Boot intercepts the change at boot time and prevents Test Mode from activating. The command itself does not fail; the enforcement happens at a different layer. Disable Memory Integrity and Secure Boot first, then run bcdedit, to see the change take effect.

Is it safe to install unsigned drivers from the internet?

Signed drivers carry a verifiable certificate that proves the publisher’s identity and that the file has not been modified since signing. Unsigned drivers carry no such guarantee – you are trusting the source entirely. Only install unsigned drivers from sources you trust completely: the original hardware manufacturer, a known open-source project with verified releases, or software you have personally reviewed. Never install an unsigned driver from an unknown or third-party aggregator site – malware is frequently distributed as fake unsigned drivers.

What is the difference between a test-signed driver and an unsigned driver?

A test-signed driver has a signature issued by a development certificate – it is technically signed, but the certificate is not from a trusted certificate authority recognized by Windows. Test Mode allows test-signed drivers because they are used during driver development before official submission to Microsoft. An unsigned driver has no signature at all. Both categories are allowed in Test Mode, but unsigned drivers represent a higher risk because there is no chain of trust to verify the publisher.

Can I install an unsigned driver without entering Test Mode using Advanced Startup?

Yes – at the Startup Settings screen (reached via Shift + Restart > Troubleshoot > Advanced Options > Startup Settings), press 7 to disable driver signature enforcement for a single boot session. Install the unsigned driver during that session. On the next normal boot, enforcement returns. The driver may or may not load on the next boot depending on whether Windows validates it at startup – test it before assuming it is permanently installed.

Conclusion

Installing an unsigned driver on Windows 11 requires disabling Memory Integrity before running bcdedit – skipping this step is why most users find that bcdedit appears to succeed but Test Mode never activates. After disabling HVCI and enabling Test Mode, install via Device Manager using Have Disk. If the device still fails, check Event Viewer for Code 52 or Code 37 to identify whether the issue is a structurally invalid signature or a mismatched device ID. Re-enable all protections after the driver is confirmed working – do not leave HVCI and Secure Boot disabled permanently.