Windows Server 2019 – Secure Boot blocks legacy unsigned driver at startup – Fix and Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Required hardware component fails to initialize after reboot because unsigned legacy driver is blocked.

Environment & Reproduction

Occurs after Secure Boot enablement or firmware reset.

Confirm-SecureBootUEFI
pnputil /enum-drivers
Get-CimInstance Win32_PnPSignedDriver | Select DeviceName,DriverVersion,IsSigned

Root Cause Analysis

Unsigned or improperly signed boot-critical driver violates Secure Boot policy requirements.

Quick Triage

Identify blocked driver and confirm whether signed replacement is available.

Step-by-Step Diagnosis

Review code integrity and kernel boot event logs to confirm enforcement point.

Solution — Primary Fix

Replace legacy package with vendor-signed driver compatible with Secure Boot.

pnputil /delete-driver oem77.inf /uninstall /force
pnputil /add-driver C:DriversSigned*.inf /install

Solution — Alternative Approaches

If business-critical, use temporary host replacement while signed package certification completes.

Verification & Acceptance Criteria

Device initializes correctly with Secure Boot enabled and no integrity violations.

Rollback Plan

Restore prior firmware setting only under approved risk exception and change control.

Prevention & Hardening

Maintain signed-driver inventory and precheck all boot-critical devices.

Related Errors & Cross-Refs

May appear with startup delays and kernel code integrity alerts.

Related tutorial: View the step-by-step tutorial for Windows Server 2019.

View all Windows Server 2019 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Secure Boot, code integrity, and driver signing guidance.