| Previous | Next |
| STATUS_SYSTEM_INTEGRITY_ROLLBACK_DETECTED | STATUS_SYSTEM_INTEGRITY_INVALID_POLICY |
STATUS_SYSTEM_INTEGRITY_POLICY_VIOLATION
The active integrity policy blocked the requested action
This status means enforcement reached a policy decision and the requested image, driver, script, or protected operation did not satisfy the active rules. It is different from an invalid policy file: the policy may be valid and loaded correctly while intentionally denying the content.
The useful explanation is normally in the CodeIntegrity Operational event, which can identify the file, policy, signing scenario, hash, signer, and rule context. Disabling enforcement before collecting those details destroys the evidence needed to write a precise allow rule.
What to inspect
- Find the matching CodeIntegrity event and record the PolicyID and blocked file path or hash.
- Verify the file signature, certificate chain, catalog membership, and current file contents.
- Determine whether the policy is in audit or enforcement mode and whether supplemental policies apply.
- Change policy rules only after confirming the binary is trusted and operationally required.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: Code Integrity diagnostic events
- Microsoft: App Control event IDs
- Microsoft: App Control troubleshooting
Looking for a different code? Search another status or error code.