Release-Signing Driver Packages

In this section, a computer that signs drivers for release on Windows Vista and later versions of Windows is referred to as the signing computer. The signing computer must be running Windows XP SP2 or later versions of the Windows operating system. For example, a driver intended for release on Windows 7 can be signed on a computer that is running Windows Vista.

In addition, the signing computer must have the driver signing tools installed.

NoteВ В You must use the version of the SignTool tool that is provided in the Windows Vista and later versions of the Windows Driver Kit (WDK). Earlier versions of this tool do not support the kernel-mode code signing policy for Windows Vista and later versions of Windows.

To comply with the kernel-mode code signing policy and the Plug and Play (PnP) device installation signing requirements of Windows Vista and later versions of Windows, sign a driver for release as follows, based on the type of driver.

NoteВ В The Windows code-signing policy requires that a signed catalog file for a driver be installed in the system component and driver database. PnP device installation automatically installs the catalog file of a PnP driver in the driver database. However, if you use a signed catalog file to sign a non-PnP driver, the installation application that installs the driver must also install the catalog file in the driver database.

PnP Kernel-Mode Boot-Start Driver

To comply with the kernel-mode code signing policy of 64-bit versions of Windows Vista and later versions of Windows, embed a signature in the boot-start driver file as follows:

Starting with Windows Vista, embedding a signature in a boot-start driver file is optional for 32-bit versions of Windows. Although Windows will check whether a kernel-mode driver file has an embedded signature, an embedded signature is not required.

To comply with the PnP device installation signing requirements of Windows Vista and later versions of Windows, you must obtain a signed catalog file or sign the catalog file of the driver package. If a driver file will also include an embedded signature, embed the signature in the driver file before signing the driver package’s catalog file.

If the Hardware Certification Kit (HCK) has a test program for the driver, obtain a WHQL Release Signature for the driver package. If the HCK does not have a test program for the driver, create a catalog file and sign the catalog file as follows:

Signing a catalog file for 64-bit versions

You can sign a catalog file for 64-bit operating systems as follows:

Sign the catalog file with the SPC that was used to embed a signature in the driver file.

Verify the SPC signature of the catalog file. You can verify the signature of a catalog file or you can verify the signatures of the individual file entries in the catalog file.

Signing a catalog file for 32-bit versions

You can either sign the catalog file with an SPC, as described in the section for 64-bit versions, or with a commercial release certificate as follows:

Verify the signature of the catalog file. You can verify the signature of a catalog file or you can verify the signatures of the individual file entries in the catalog file.

Non-PnP Kernel-Mode Boot-Start Driver

To comply with the kernel-mode code signing policy of 64-bit versions of Windows Vista and later versions of Windows, embed a signature in a boot-start driver file as follows:

Starting with Windows Vista, embedding a signature in a boot-start driver file is optional for 32-bit versions of Windows. Although Windows will check whether a kernel-mode driver file has an embedded signature, an embedded signature is not required.

The PnP device installation signing requirements do not apply to non-PnP drivers.

PnP Kernel-Mode Driver that is not a Boot-Start Driver

The kernel-mode code signing policy on 64-bit versions of Windows Vista and later versions of Windows does not require a non-boot PnP driver have an embedded signature. However, if the driver file will include an embedded signature, embed the signature in the driver file before signing the driver package’sВ catalog file.

To comply with the PnP device installation signing requirements, you must obtain a signed catalog file or sign the catalog file of the driver package.

If the Hardware Certification Kit (HCK) has a test program for the driver, obtain a WHQL release signature for the driver package. If the HCK does not have a test program for the driver, create a catalog file and sign the catalog file in the same manner as described in this section for signing the catalog file of a PnP kernel-mode boot-start driver.

Non-PnP Kernel-Mode Driver that is not a Boot-Start Driver

To comply with the kernel-mode code signing policy of 64-bit versions Windows Vista and later versions of Windows , embed a signature in the driver file or sign a catalog file for the driver package.

Starting with Windows Vista, embedding a signature in a driver file is optional for 32-bit versions of Windows. Although Windows will check whether a kernel-mode driver file has an embedded signature, an embedded signature is not required.

The PnP device installation signing requirements do not apply to non-PnP drivers.

NoteВ В Using embedded signatures is generally simpler and more efficient than by using a signed catalog file. For more information about the advantages and disadvantages of using embedded signatures versus signed catalog files, see Test Signing a Driver.

To embed a release signature in a file for a non-PnP kernel-mode driver that is not a boot-start driver, follow these steps:

To release-sign a catalog file for a non-PnP kernel-mode driver that is not a boot-start driver, follow these steps:

If this type of driver has a signed catalog file instead of an embedded signature, the installation application that installs the driver must install the catalog file in the system component and driver database. For more information, see Installing a Release-Signed Catalog File for a Non-PnP Driver.

Download the Windows Driver Kit (WDK)

The WDK is used to develop, test, and deploy Windows drivers.

Runtime requirements

You can run the Windows 10, version 2004 WDK on Windows 7 and later, and use it to develop drivers for these operating systems:

Client OS	Server OS
Windows 10	Windows Server 2019, Windows Server 2016
Windows 8.1	Windows Server 2012 R2
Windows 8	Windows Server 2012
Windows 7	Windows Server 2008 R2 SP1

WDK for Windows 10, version 2004

Step 1: Install Visual Studio 2019

The WDK requires Visual Studio. For more information about system requirements for Visual Studio, see Visual Studio 2019 System Requirements.

The following editions of Visual Studio 2019 support driver development for this release:

When you install Visual Studio 2019, select the Desktop development with C++ workload. The Windows 10 Software Development Kit (SDK) is automatically included, and is displayed in the right-hand Summary pane. Note that the version of the SDK that is compatible with the WDK for Windows 10, version 2004 may not be the default SDK. To select the correct SDK:

In Visual Studio Installer, on the Individual components tab, search for Windows 10 SDK (10.0.19041.0), select this version and continue with install. Note that Visual Studio will automatically install Windows 10 SDK (10.0.19041.1) on your machine.

If you already have Visual Studio 2019 installed, you can install the Windows 10 SDK (10.0.19041.1) by using the Modify button in Visual Studio install.

WDK has Spectre mitigation enabled by default but requires spectre mitigated libraries to be installed with Visual Studio for each architecture you are developing for. Additionally, developing drivers for ARM/ARM64 require the build tools for these architectures to also be installed with Visual Studio. To locate these items you will need to know the latest version of MSVC installed on your system.

To find the latest version of MSVC installed on your system, in Visual Studio Installer go to workload page, on the right pane under installation details, expand Desktop development with C++ and locate the MSVC v142 — VS 2019 C++ x64/x86 build tools (V14.xx) — note where xx should be the highest version available.

With this information (v14.xx), go to Individual components and search for v14.xx. This will return the tool sets for all architectures, including Spectre mitigated libs. Select the driver architecture you are developing for.

For example, searching for v14.25 returns the following:

Step 1.5 Install Refreshed Windows SDK 10.0.19041.685 for Windows 10, version 2004

This SDK is strongly recommended and will eventually be made available through Visual Studio

Step 2: Install Refreshed WDK for Windows 10, version 2004

The WDK Visual Studio extension is included in the default WDK installation.

If you can’t find driver project templates in Visual Studio, the WDK Visual Studio extension didn’t install properly. To resolve this, run the WDK.vsix file from this location: C:\Program Files (x86)\Windows Kits\10\Vsix\VS2019\WDK.vsix.

Enterprise WDK (EWDK) for Windows 10, version 2004

The EWDK is a standalone, self-contained command-line environment for building drivers. It includes the Visual Studio Build Tools, the SDK, and the WDK. The latest public version of the EWDK contains Visual Studio 2019 Build Tools 16.7.0 and MSVC toolset v14.23. To get started, mount the ISO and run LaunchBuildEnv.

The EWDK also requires the .NET Framework version 4.7.2. For more information about other requirements for the .NET Framework, see .NET Framework system requirements.

EWDK with Visual Studio Build Tools

You can use the Visual Studio interface with the build tools provided in the EWDK.

1. Mount the EWDK ISO.
2. Run LaunchBuildEnv.cmd .
3. In the environment created in step 2, type SetupVSEnv, and then press Enter.
4. Launch devenv.exe from the same environment, using the full file path. Example: «C:\Program Files (x86)\Microsoft Visual Studio\2019\\%Community|Professional|Enterprise%\Common7\IDE\devenv.exe»

Note that the Visual Studio major version should match with the version in the EWDK. For example, Visual Studio 2019 works with the EWDK that contain VS16.X build tools.

Driver samples for Windows 10

To download the driver samples, do one of the following:

• Go to the driver samples page on GitHub, click Clone or download, and then click Download ZIP.
• Download the GitHub Extension for Visual Studio, and then connect to the GitHub repositories.
• Browse the driver samples on the Microsoft Samples portal.

Installing the Updated Version of the Driver Package

After you configure Windows to rank driver signatures equally, you can install the private build of the inbox driver on the target system. To install the private build, complete the following steps:

Add the driver package to the driver store by using the PnPUtil utility that is provided in Windows Vista and later versions of Windows. For example:

Use the DevCon Remove command to remove the device or device class that is installed by the updated driver package. The device or device class is specified through all or part of a hardware ID, compatible ID, or device instance ID of a device. For example:

The new driver is automatically loaded when the device is reinstalled after the system is restarted. To have DevCon automatically restart the system, add the conditional reboot parameter (/r) to the remove command.

NoteВ В The DevCon tool is provided in the WDK. For more information about its commands, see DevCon Commands.

An alternative to the DevCon Remove command is to update the driver package by using one of the following:

Device Manager to perform an «update driver» operation on the device.

From within Device Manager’s window, right-click the device’s name or icon and choose Properties. In the Properties window, click the Driver tab and then click the Update Driver button.

The DevCon Update command. For more information about this command, see DevCon Commands.

Hardware drivers category page Microsoft Download Center

Microsoft 365

Premium Office apps, extra cloud storage, advanced security, and more—all in one convenient subscription

What will you do?

Office 365 unlocks the potential of your device, and brings out the best in you

Surface Pro

The most versatile laptop

Popular Hardware drivers downloads

Microsoft® ODBC Driver 13.1 for SQL Server® — Windows, Linux, & macOS

The Microsoft ODBC Driver for SQL Server provides native connectivity from Windows, Linux, & macOS to Microsoft SQL Server and Microsoft Azure SQL Database.

Surface Pro 4 Drivers and Firmware

All current drivers and firmware for the Surface Pro 4; including optional WinTab drivers

Surface Pro 3

All current software, firmware, and drivers for the Surface Pro 3; including optional WinTab drivers

Surface Pro 7 Drivers and Firmware

All current drivers and firmware for the Surface Pro 7

Microsoft® OLE DB Driver 18 for SQL Server®

This page is no longer maintained. Please read the details below.

Surface Dock 2 Firmware and Drivers

All current software, firmware, and drivers for the Surface Dock 2

Surface Book 2 Drivers and Firmware

All current drivers and firmware for the Surface Book 2

Microsoft® ODBC Driver 17 for SQL Server® — Windows, Linux, & macOS

This page is no longer maintained. Please read the details below.

Surface Pro 6 Drivers and Firmware

All current drivers and firmware for the Surface Pro 6

Surface Book Drivers and Firmware

All current drivers and firmware for the Surface Book; including optional WinTab drivers