Windows Server 2016 – Secure Boot blocks legacy unsigned driver at startup – Fix and Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Hardware fails to initialize because legacy unsigned driver is blocked.

Environment & Reproduction

Triggered after Secure Boot enablement.

Confirm-SecureBootUEFI
pnputil /enum-drivers

Root Cause Analysis

Boot-critical package is unsigned or incorrectly signed.

Quick Triage

Identify blocked INF and signed replacement options.

Step-by-Step Diagnosis

Review integrity and boot event logs.

Solution — Primary Fix

Replace legacy package with signed compatible driver.

pnputil /delete-driver oem77.inf /uninstall /force
pnputil /add-driver C:DriversSigned*.inf /install

Solution — Alternative Approaches

Use temporary host replacement until certification is complete.

Verification & Acceptance Criteria

Device initializes with Secure Boot enabled.

Rollback Plan

Only under approved exception, restore prior firmware mode.

Prevention & Hardening

Maintain signed-driver inventory for boot-critical hardware.

Related Errors & Cross-Refs

May appear with code integrity and startup delays.

Related tutorial: View the step-by-step tutorial for Windows Server 2016.

View all Windows Server 2016 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Secure Boot and driver signing guidance.