| Previous | Next |
| SPAPI_E_AUTHENTICODE_DISALLOWED | SPAPI_E_AUTHENTICODE_TRUST_NOT_ESTABLISHED |
SPAPI_E_AUTHENTICODE_TRUSTED_PUBLISHER
SPAPI_E_AUTHENTICODE_TRUSTED_PUBLISHER means that SetupAPI reports that the INF catalog is signed by a trusted publisher; callers must interpret this documented setup status in the context of the operation rather than assuming every failure-bit HRESULT means installation failed.
What the status narrows down
For device installation, SetupAPI. Dev. Log is the chronological backbone. Correlate the HRESULT with the device instance ID, selected INF and section, signature or rank decision, file queue, class/co-installer dispatch, and rollback for that exact attempt instead of reading isolated lines from different installations.
A trusted publisher does not prove that the driver matches the device, is newest, or installed successfully; it describes the signer trust path.
Evidence worth preserving
- Catalog file, signer certificate chain, publisher trust-store membership, and timestamp
- INF-to-catalog association and catalog hash coverage
- SetupAPI. Dev. Log decision around rank, trust, and user prompting
- Caller logic that classifies this HRESULT and any subsequent setup status
A controlled diagnostic sequence
- Verify the catalog with SignTool and the target machine trust stores.
- Compare a trusted-publisher package with a valid but not pretrusted signer.
- Confirm the final device-install result separately from this intermediate trust classification.
Correction and proof
Apply the smallest change that addresses the first rejected condition: Treat the code according to the SetupAPI contract, preserve signature evidence, and continue evaluating package applicability and final installation status.
Close the incident only when automated deployment distinguishes trusted, unsigned, invalid, and unknown publishers and records the final install result independently.
Technical references
Looking for a different code? Search another status or error code.