What does Windows error code 4553 (ERROR_SYSTEM_INTEGRITY_POLICY_NOT_SIGNED) mean?

ERROR_SYSTEM_INTEGRITY_POLICY_NOT_SIGNED

The System Integrity policy is either not signed or is signed by a non-trusted signer.

ERROR_SYSTEM_INTEGRITY_POLICY_NOT_SIGNED is Win32 error 4553 (0x11C9) and belongs to System Integrity policy signature trust.

Where the result appears

• Activating a signed-policy deployment mode.
• Boot-time validation of a WDAC policy.
• Enterprise policy distribution requiring trusted signers.
• Replacement of an existing signed base policy.

Likely causes

• the policy has no signature where one is required.
• the signature is made by an untrusted or expired signer.
• the signed content changed after signing.
• certificate chain or revocation validation cannot establish trust.

Troubleshooting steps

• Record policy hash and embedded signature.
• Record signer certificate chain and EKU.
• Record timestamp and revocation status.
• Record active policy trust requirements.
• Record CodeIntegrity events explaining signature rejection.

What to verify

Verify whether the policy has no signature where one is required. Check policy hash and embedded signature together with signer certificate chain and EKU.

Handling, retry, and recovery

Sign the exact policy artifact with an authorized certificate and redeploy the unchanged signed file. Do not weaken signed-policy requirements to accept an unverified policy.

Difference from nearby codes

INVALID_POLICY concerns policy contents; NOT_SIGNED says the policy cannot establish the required signer trust.

Practical example

An administrator edits policy XML after the signing step and deploys a regenerated unsigned binary.

References

• Microsoft: System Error Codes (4000–5999) — reference for error 4553.
• Microsoft: Windows Defender Application Control — reference for error 4553.
• Microsoft: Application Control event logs — reference for error 4553.