Microsoft is tightening security in Windows 11. Starting April 2026, outdated kernel drivers will be phased out—the company’s response to a well-known security issue that has plagued Windows for years.
In a Windows IT Pro blog post, Microsoft announced that it will cease to trust drivers signed via the deprecated “cross-signed root program.” This procedure dates back to the early 2000s and was long considered the standard for allowing third-party drivers in the Windows kernel.
The problem? Certification was carried out by external authorities and only offered limited security checks. This led to abuse and stolen signature keys, paving the way for manipulated drivers. Although the program was discontinued back in 2021, Windows continued to accept many of these old drivers—until now.
Going forward, Windows will by default only allow kernel drivers that have been certified via the official Windows Hardware Compatibility Program (WHCP). These drivers are checked by Microsoft for malware and compatibility, among other things.
The aim is to make it significantly harder for malicious code to be injected into the kernel, the most sensitive part of the operating system.
Microsoft also emphasizes that the new policy is based on extensive telemetry data—specifically, data pulled from billions of driver load operations over the past two years. Feedback from developers has also been incorporated into the implementation.
By the way: If you’re using Windows 11 Home, you’re missing out on the many benefits of Windows 11 Pro. To learn more, see our comparison of Windows 11 Home and Pro. If you want to upgrade, snag it for cheap in the PCWorld Software Store: now just $59 instead of $99.
Though the announcement came yesterday, the change-up won’t be immediate. Microsoft is starting with a so-called “evaluation mode” for PCs, which entails the following:
A system will remain in evaluation mode until all evaluation criteria are met. For Windows 11, that means 100 hours of system operation and at least 3 system restarts.
Important: Systems with incompatible drivers detected will remain in diagnostic mode for now and won’t be affected by the full transition.
It’s not entirely without compromise: Microsoft is introducing a list of exceptions, which include older drivers that are classified as trustworthy and are intended to continue functioning.
Companies can also define their own rules. Special policies allow internal or custom-developed drivers to continue being used, though only under strictly controlled conditions.
To this end, Microsoft provides Application Control for Windows, a feature that allows organizations to selectively approve their own or non-officially certified drivers (for example, for internal applications or specialized hardware).
The new security policy applies to:
The rollout begins with the April 2026 update and will thereafter be a permanent feature of new Windows versions.
For you as a user, this change primarily means one thing: greater security when using Windows 11. Attacks via manipulated or insecure drivers will be made much harder with this policy.
But individual users may run into unforeseen problems, for example if very old hardware relies on drivers that are no longer supported. Microsoft is limiting this risk through its phased rollout and exceptions.
Author: Viviane Osswald
Source: PCWorld
Reviewed By: Editorial Team
