| Previous | Next |
| STATUS_SECCORE_INVALID_COMMAND | STATUS_SYSTEM_INTEGRITY_POLICY_VIOLATION |
STATUS_SYSTEM_INTEGRITY_ROLLBACK_DETECTED
Policy rollback protection detected an older policy
Signed App Control and System Integrity policies can include version information used to prevent downgrade to an older policy with weaker rules. This status indicates that the proposed policy activation would move backward relative to the protected version known by the system.
Rollback protection is a security boundary, so copying an older .cip or SiPolicy file into an active policy directory is not a valid recovery method. Administrators should deploy a properly versioned replacement or follow the documented signed-policy removal process.
What to inspect
- Record the active and proposed PolicyID, BasePolicyID, version, signer, and deployment channel.
- Inspect CodeIntegrity Operational events around policy staging and activation.
- Confirm management software did not redeploy an obsolete policy after a newer rollout.
- Use an authorized update or removal sequence instead of deleting protected policy files blindly.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: App Control event IDs
- Microsoft: removing App Control policies
- Microsoft: App Control troubleshooting
Looking for a different code? Search another status or error code.