Share via

I meet a install issue on Win11 v22621, the cerification of driver is invalid after pass the DUA submission.

Tina Zhao 1 Reputation point
2022-10-24T05:43:18.077+00:00

Hi All,

I meet a install issue, the digital signed driver fail to install on Win11 v22621, and it show error code 39 - "Windows cannot verify the digital signature for this file".
The digital certification of driver is generated by the DUA submission. I confirm the driver package doesn't have any change after DUA submission, because I know the digital signature will invalid if any file in the driver package is altered.
And there is not any error or warning message during DUA submission, so the modified INF should be accepted for DUA submission.
I confuse why the digital signed driver still has install issue with the error code 39 when install on Win11 v22621?
253441-1024.jpg

Regards,

Tina

Windows for business | Windows Client for IT Pros | Devices and deployment | Other
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Chen Tran 8,220 Reputation points Independent Advisor
    2026-03-02T08:40:15.9266667+00:00

    Hello Tina,

    Thank you for posting question on Microsoft Windows Forum!

    Based on the issue description as well as the provided Error Code 39 occurred on Windows 11 v22621 (22H2) which might indicate a conflict between the driver's attributes and the OS's modernized security policies.

    Since Windows 11 22H2 enables Hypervisor-Protected Code Integrity (HVCI), also known as Memory Integrity, by default. If your driver does not meet HVCI requirements, Windows will block it from loading and report Error 39. Even if the driver passed DUA, DUA does not re-run the full HLK (Hardware Lab Kit) tests. It only verifies the INF changes. If the original binary was not HVCI-compliant, or if the INF modification inadvertently removed the Needs or Include directives that signal HVCI compatibility to the OS, the install will fail. The suggestion is to try temporarily toggling Memory Integrity to Off (on a non-production machine for testing) and restart by going to Windows Security > Device Security > Core Isolation details. Try installing the driver again. If it works, your driver code (the .sys file) is not HVCI-compatible.

    Another point worth mentioning here is to check for Driver Isolation issues. As Windows 11 v22621 pushes heavily for Windows Drivers rather than "Legacy" or "Windows Desktop" drivers. Specifically, it looks for Driver Isolation, which requires that the driver package does not use co-installers and that the INF uses specific directives. If your DUA-modified INF changed the Manufacturer section or added hardware IDs in a way that conflicts with the original driver's isolation status, Windows may refuse to verify the signature's authority over those specific new IDs.

    If your driver is intended to be HVCI compliant. Sometimes DUA edits can strip out metadata if the "Base" driver selected during submission was different from the one used for the original test. Since you mentioned the INF was modified. Try to make sure that the Provider and Manufacturer strings in the [Strings] section have not been changed to something that does not match the original WHQL/HLK submission's identity, as this can sometimes trigger a "Signer not found" error during the DUA merge.

    You can consult the following article for more information

    Hope the above information is helpful! If it helps you getting more insight into the issue, It is appreciated to consider clicking "Accept Answer". Should you have more questions, feel free to leave a message.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.