How to Disable Driver Signature Enforcement in Windows 11

Windows 11 may refuse to install or load a driver when it cannot verify the driver’s digital signature. For a trusted legacy, diagnostic, or specialist device, you can temporarily disable Driver Signature Enforcement through Windows Startup Settings. The exception lasts for one boot and normal enforcement returns after the next restart.

That temporary method is the right choice for most people. It lets you test a known driver without permanently changing the Windows boot configuration. Do not use it to install a driver from an unknown download site or to silence a security warning you have not investigated.

Understand What You Are Changing

Driver Signature Enforcement, often shortened to DSE, helps Windows confirm that a driver package comes from an identifiable publisher and has not been altered after signing. This protection matters because kernel-mode drivers run with deep access to Windows.

Disabling DSE does not make a driver compatible. It only relaxes one signature check for the current startup session. A driver can still fail because it:

• Does not match the device’s hardware ID
• Was built for the wrong processor architecture
• Depends on components removed from Windows 11
• Is corrupted or incomplete
• Conflicts with Memory Integrity
• Is blocked by an organization’s security policy

Check the manufacturer’s website and Windows Update for a current signed version before changing DSE. When Windows cannot find a network driver at all, use the separate network adapter driver troubleshooting guide instead. That problem normally requires the correct driver package, not weaker signature enforcement.

Before You Restart Into Advanced Startup

Confirm three details about the driver:

1. Source: Download it from the device manufacturer, your organization, or a developer you can verify.
2. Compatibility: Check that it supports Windows 11 and the PC’s architecture, usually 64-bit or ARM64.
3. Recovery: Keep the driver’s uninstall instructions and a current replacement driver available.

Save your work because the process restarts the computer. Also locate the BitLocker recovery key when Device Encryption or BitLocker is enabled. Microsoft notes that encrypted devices may require the recovery key when entering Windows Recovery Environment.

A restore point is useful before installing an old kernel driver. The DSE setting itself does not delete files, but an incompatible driver can cause a blue screen, failed startup, lost networking, or unusable hardware.

Temporarily Disable Driver Signature Enforcement

Follow this route while signed into Windows 11:

1. Open Settings.
2. Select System > Recovery.
3. Find Advanced startup and select Restart now.
4. Confirm Restart now when Windows asks.
5. On the blue Choose an option screen, select Troubleshoot.
6. Select Advanced options > Startup Settings.
7. Select Restart.
8. When the numbered Startup Settings list appears, press 7 or F7 for Disable driver signature enforcement.

Microsoft lists this as option 7 in its current Windows Startup Settings documentation.

The PC will start Windows normally, but signature enforcement is relaxed for this session. Sign in and install the trusted driver before restarting again.

This is not a permanent setting. The next ordinary restart restores Driver Signature Enforcement automatically, so no command is required to turn it back on.

Reach the Same Option From the Sign-In Screen

Use the power menu when Windows reaches the sign-in screen but you cannot sign in:

1. Select the Power icon.
2. Hold Shift and select Restart.
3. Keep holding Shift until the recovery screen appears.
4. Select Troubleshoot > Advanced options > Startup Settings > Restart.
5. Press 7 or F7.

The Shift-and-Restart route opens the same one-boot exception. It is not a different or stronger form of DSE disabling.

When Windows repeatedly fails before the sign-in screen, it may enter Automatic Repair after several unsuccessful starts. From there, select Advanced options and follow the Startup Settings path. Do not force repeated shutdowns when the drive is processing an update or showing signs of storage failure.

Install and Check the Driver During That Boot

Use the manufacturer’s installer when one is provided. It may install services, firmware components, or companion software that Device Manager cannot add on its own.

For a package supplied only as INF files:

1. Right-click Start and open Device Manager.
2. Find the device, which may appear under Other devices when no working driver is installed.
3. Right-click it and select Update driver.
4. Select Browse my computer for drivers.
5. Choose the folder containing the extracted driver package.
6. Complete the installation and check the result in Device Manager.

Do not choose a driver for a different model simply because its name looks similar. Open the device’s Properties > Details, choose Hardware Ids, and compare those identifiers with the manufacturer’s supported-device list when the match is uncertain.

Test the device before restarting. Then restart Windows normally and test it again. These two results tell you something important:

• The device works before and after restart: Windows accepts the installed driver under its normal policy.
• It works only before restart: the driver cannot load after DSE returns, so replace it with a properly signed version.
• It never works: the problem is probably compatibility, hardware matching, package damage, or another Windows security feature.

Repeatedly entering the one-boot mode is not a stable repair. It also leaves the computer dependent on an obsolete or improperly signed driver.

When the Driver Still Will Not Install

Read the exact Windows message instead of assuming DSE is always responsible.

Windows Cannot Verify the Digital Signature, Code 52

Device Manager Code 52 points directly to signature verification. Confirm the driver’s source and compatibility, then retry the temporary Startup Settings method. A driver that still fails may use an unsupported signing method or contain a damaged catalog file.

The Third-Party INF Does Not Contain Digital Signature Information

The package does not include signature information Windows accepts. Check whether the download was completely extracted and whether the manufacturer provides a newer installer. The temporary method may allow a trusted legacy package to install, but it cannot make an unknown package safe.

A Driver Cannot Load on This Device

This message commonly appears when Memory Integrity blocks an incompatible driver. DSE and Memory Integrity are different protections. Search using the exact driver filename and obtain an updated version rather than disabling multiple safeguards.

The article about Memory Integrity that cannot be turned on explains how to identify and replace incompatible drivers without treating security features as the problem.

Windows Found Drivers but Encountered an Error

Open the device’s Properties and record the error code. Code 10, Code 28, Code 31, and Code 43 can involve damaged packages, device startup failures, firmware, or hardware faults. Disabling DSE is relevant only when the message specifically identifies signature enforcement.

The Driver Is for an Older Windows Release

A Windows 7-era or 32-bit driver may rely on interfaces that modern 64-bit Windows 11 no longer supports. Signature enforcement is not a compatibility layer. Look for a newer driver, a supported replacement device, or a virtual machine when the hardware must run with its original software.

When Startup Settings Is Missing

The Startup Settings tile may not appear in a limited manufacturer recovery environment. Try Shift + Restart from the Windows sign-in screen or open Settings > System > Recovery from a working desktop.

On a managed work or school PC, recovery choices may be restricted by policy. Contact the administrator instead of trying to bypass that policy. They may need to deploy an approved signed package through the organization’s normal driver-management process.

When BitLocker requests a recovery key, stop and retrieve the correct key. Do not clear the TPM, format the drive, or disable encryption simply to reach Startup Settings.

Test Mode Is for Driver Development, Not a Permanent Consumer Fix

Test Mode and the F7 startup option are not the same feature. The temporary F7 method affects one boot. Test Mode changes the boot configuration and displays a Test Mode watermark on the desktop.

Microsoft documents Test Mode for developing and testing test-signed kernel drivers. It is not a general switch that makes every unsigned driver work. With Memory Integrity enabled, the binary must still be test-signed rather than completely unsigned.

Developers who specifically need the documented test-signing environment can open Terminal as administrator and run:

bcdedit /set testsigning on

Restart for the change to take effect. When testing is finished, restore the normal configuration with:

bcdedit /set testsigning off

Restart again. Microsoft’s Test Mode documentation warns that BCDEdit changes can make a computer unbootable when used incorrectly.

Secure Boot can prevent the TESTSIGNING value from being changed. Do not disable Secure Boot merely to install one consumer driver. Firmware changes can affect BitLocker recovery, organizational compliance, and startup protection. Find a signed driver or replace the unsupported device instead.

Recover From a Blue Screen or Failed Startup

An incompatible driver may crash Windows after installation. Return to Windows Recovery Environment and select Troubleshoot > Advanced options > Startup Settings > Restart, then choose Safe Mode.

In Safe Mode:

1. Open Device Manager.
2. Locate the device whose driver was just installed.
3. Open Properties > Driver.
4. Use Roll Back Driver when available, or select Uninstall device.
5. Remove the associated application from Installed apps when its own uninstaller is available.
6. Restart normally.

When Test Mode was enabled during development, run bcdedit /set testsigning off from an elevated terminal after Windows is stable, then restart. Avoid copying unrelated BCDEdit commands from forum posts because they may change other boot protections or the wrong boot entry.

Keep the Exception Temporary

For a trusted driver that fails only its signature check, use Advanced startup > Startup Settings > option 7, install and test the driver, then restart normally. That sequence answers the search intent without leaving a permanent reduction in boot security.

A driver that stops loading after the restart needs a current signed replacement. A package blocked by Memory Integrity, hardware mismatch, or obsolete Windows dependencies needs a compatibility solution, not repeated DSE bypasses. Keeping those cases separate protects the computer and makes the troubleshooting process far more reliable.