| Previous | Next |
| STATUS_DS_CANT_MOD_PRIMARYGROUPID | STATUS_PNP_REBOOT_REQUIRED |
STATUS_SYSTEM_IMAGE_BAD_SIGNATURE
A system image failed the mandatory signing policy
System images are evaluated under stricter trust rules than ordinary application data. This status indicates that the file selected for a protected system role does not carry a signature accepted by the active Windows integrity policy. The result can follow tampering, a mismatched servicing payload, an untrusted signer, or replacement with a same-named non-system binary.
Re-signing the file with a local certificate does not make it an authentic Windows component. Recovery must restore the exact version through supported servicing, component-store repair, installation media, or vendor update while preserving evidence if compromise is suspected.
What to inspect
- Capture the full path, file version, signer, catalog association, hash, and Code Integrity events before replacement.
- Compare the image with the component-store or installation source for the same Windows build and architecture.
- Check Secure Boot, App Control, catalog databases, and recent servicing actions for the policy context.
- Investigate unauthorized modification or storage corruption when multiple protected images fail validation.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: verifying the signature of a PE file
- Microsoft: Code Integrity event log messages
- Microsoft: App Control file rule and Authenticode hashes
Looking for a different code? Search another status or error code.