| Previous | Next |
| STATUS_DRIVER_BLOCKED_CRITICAL | STATUS_DRIVER_DATABASE_ERROR |
STATUS_DRIVER_BLOCKED
Find the blocking policy and the exact driver image
STATUS_DRIVER_BLOCKED means the load path rejected a driver. The status alone does not identify whether the relevant evidence is signature validation, Code Integrity policy, a vulnerable-driver block rule, or another driver-loading restriction. The first task is to preserve the exact image and the corresponding Code Integrity or driver-installation event.
Windows Code Integrity logs diagnostic events in the CodeIntegrity operational log. Microsoft also documents event 3076 for an audit result and 3077 for a file that enforcement blocked under applicable Windows Defender Application Control policy. Those event details are much more useful than repeatedly renaming or copying the .sys file.
What to inspect
- Full driver path, file hash, signer, catalog/package identity and loaded Windows build.
- CodeIntegrity operational events at the same timestamp and any policy name or rule identifier recorded there.
- Whether the driver came from a coherent vendor package or a leftover binary from an older installation.
- Whether the issue reproduces after installing a vendor-supported driver for the current platform.
Do not disable integrity protections merely to make the status disappear. Determine which rule rejected which binary; the safe correction is normally a compatible, properly packaged driver or an intentional policy change made with full knowledge of the affected image.
References
- Microsoft: Code Integrity diagnostic events
- Microsoft: Windows driver policy
- Microsoft: Application Control event IDs
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.