| Previous | Next |
| STATUS_SYSTEM_INTEGRITY_INVALID_POLICY | STATUS_NO_APPLICABLE_APP_LICENSES_FOUND |
STATUS_SYSTEM_INTEGRITY_POLICY_NOT_SIGNED
The policy does not have an acceptable signature
Signed App Control policies protect enforcement configuration from administrative or malware tampering. When a deployment path or existing protected policy requires signing, Windows verifies both the cryptographic signature and whether the signer is trusted for that policy scenario.
This status can therefore mean no signature is present, the policy changed after signing, the certificate chain is not trusted, or the wrong signer was used. Renaming the policy or importing the signer into an unrelated user certificate store does not satisfy Code Integrity trust requirements.
What to inspect
- Verify the compiled policy hash and signature after its final modification and transfer.
- Check the signer certificate chain, EKUs, validity, and trust available during early boot when applicable.
- Confirm the active base policy permits the intended supplemental-policy signer.
- Follow the documented signed-policy update or removal process to avoid boot failures.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: removing App Control policies
- Microsoft: Code Integrity diagnostic events
- Microsoft: App Control troubleshooting
Looking for a different code? Search another status or error code.