Driver Signing

Using the Windows Driver Kit (WDK), enterprise administrators can sign custom-developed drivers using Authenticode and then stage these drivers to Windows systems or images. Windows 7 provides the ability to digitally sign drivers using an organization's own digital certificate, such as one generated by an enterprise certification authority (CA). An organization can use its digital certificate to sign unsigned drivers or to replace the driver vendor's signature with its own. The administrator can then use Group Policy settings to distribute the digital certificate to client computers and configure them to install only those drivers that the organization has signed. For information on how to do this, see Device Management and Installation Step-by-Step Guide: "Signing and Staging Device Drivers in Windows Vista and Windows Server 2008" found at http://technet.microsoft.com/en-us/library/cc754052.aspx. For information on the WDK, see http://www.microsoft.com/whdc/DevTools/WDK/.

Note Although you can use unsigned drivers with 32-bit versions of Windows Vista or later versions, 64-bit versions of Windows Vista or later versions require all device drivers to be digitally signed by the developer. For more information, see Knowledge Base article 946765, "A Description of the Differences Between 32-Bit Versions of Windows Vista and 64-Bit Versions of Windows Vista," found at http://support.microsoft.com/kb/946765.